Struct Finding 

pub struct Finding {
    pub priority: Priority,
    pub confidence: Confidence,
    pub rule_id: String,
    pub interpretation: String,
    pub provenance: Provenance,
    pub user: Option<String>,
    pub profile: Option<String>,
    pub browser: Option<BrowserFamily>,
    pub evidence: String,
    pub next: Option<String>,
}

A court-safe forensic finding (RFC 0001 D4/D5/D9).

Priority, Confidence and Interpretation are three structurally separate axes; provenance (Provenance) and origin (user/profile/browser) stamp every finding with where it came from. Render with Finding::render.

Fields

priority: Priority

Triage attention cue — look here first, not a verdict.

confidence: Confidence

Confidence in the interpretation (paired with rule_id).

rule_id: String

Identifier of the rule that produced this finding.

interpretation: String

The hedged “consistent with …” statement.

provenance: Provenance

The four-axis provenance record (D4).

user: Option<String>

Originating user (SID or name), when known (D9).

profile: Option<String>

Originating browser profile (e.g. Chrome/Default), when known (D9).

browser: Option<BrowserFamily>

Originating browser family, when known (D9).

evidence: String

The concrete datum this finding rests on (e.g. Chrome History urls rowid gap 128 → 944).

next: Option<String>

A drill-down command pointer for the examiner’s next step.

Implementations

impl Finding

pub fn new( priority: Priority, confidence: Confidence, rule_id: impl Into<String>, interpretation: impl Into<String>, provenance: Provenance, evidence: impl Into<String>, ) -> Self

Build a finding from its three separate axes, a full provenance record, and the concrete evidence datum.

Priority and Confidence are distinct types, so the three axes cannot be conflated at a call site. Origin (user/profile/browser) and next are attached with the with_* builder methods.

pub fn with_user(self, user: impl Into<String>) -> Self

Stamp the originating user (SID or name) (D9).

pub fn with_profile(self, profile: impl Into<String>) -> Self

Stamp the originating browser profile (D9).

pub fn with_browser(self, browser: BrowserFamily) -> Self

Stamp the originating browser family (D9).

pub fn with_next(self, next: impl Into<String>) -> Self

Attach a drill-down “next step” command pointer.

pub fn render(&self) -> String

Render the finding as a multi-line, court-safe block.

The three axes are always shown separately and labelled; Priority is explicitly framed as a triage attention cue (never a verdict); the Interpretation hedge is always present. This is the only renderer for a finding — there is no Display impl that could collapse it into a bare conclusion. (RFC 0001 D5.)

Trait Implementations

impl Clone for Finding

fn clone(&self) -> Finding

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Finding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Finding

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Finding

impl PartialEq for Finding

fn eq(&self, other: &Finding) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Finding

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Finding