Enum OlecfAnomaly 

pub enum OlecfAnomaly {
    OrphanedDirEntry(OrphanDetail),
    FreeSectorResidue {
        sid: u32,
        space: &'static str,
        offset: u64,
        residue_len: usize,
    },
    SlackResidue {
        sid: u32,
        name: String,
        space: &'static str,
        slack_len: usize,
    },
    StructureAnomaly(StructureIssue),
    RootClsid {
        sid: u32,
        name: String,
        clsid: String,
        create_time: u64,
        modify_time: u64,
    },
}

A forensic anomaly observed in an OLE Compound File. Each variant maps to a stable, scheme-prefixed code (the published contract).

Variants

OrphanedDirEntry(OrphanDetail)

OLECF-ORPHANED-DIR-ENTRY — a stream/storage entry unreachable from the live root tree: deleted-stream metadata that survived.

FreeSectorResidue

OLECF-FREE-SECTOR-RESIDUE — a free FAT/mini-FAT slot whose backing sector still holds non-zero bytes.

Fields

sid: u32

The (mini-)sector id marked free.

space: &'static str

"FAT" or "mini-FAT".

offset: u64

Byte offset in the file of the residual sector.

residue_len: usize

Count of non-zero bytes recovered.

SlackResidue

OLECF-SLACK-RESIDUE — non-zero bytes past a stream’s declared size in its final allocated (mini-)sector.

Fields

sid: u32

The owning entry’s SID.

name: String

The owning entry’s name.

space: &'static str

"FAT" or "mini-FAT".

slack_len: usize

Number of non-zero slack bytes.

StructureAnomaly(StructureIssue)

OLECF-STRUCTURE-ANOMALY — a structural / tamper violation.

RootClsid

OLECF-ROOT-CLSID — the root/storage CLSID and the FILETIMEs CFB carries.

Fields

sid: u32

The entry’s SID (0 for the root storage).

name: String

The entry’s name.

clsid: String

CLSID rendered as a canonical upper-case GUID string.

create_time: u64

Creation FILETIME (raw u64).

modify_time: u64

Modification FILETIME (raw u64).

Implementations

impl OlecfAnomaly

pub fn code(&self) -> &'static str

The stable, scheme-prefixed machine code for this anomaly.

pub fn severity(&self) -> Severity

Severity of this anomaly.

pub fn category(&self) -> Category

Analytical lens for this anomaly.

pub fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK techniques this anomaly is consistent with (never a verdict).

pub fn note(&self) -> String

Human-readable, hedged note.

pub fn to_finding(&self, src: Source) -> Finding

Convert to a canonical Finding. Dynamic codes carry runtime detail, so this uses the forensicnomicon::report builder directly.

Trait Implementations

impl Clone for OlecfAnomaly

fn clone(&self) -> OlecfAnomaly

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OlecfAnomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for OlecfAnomaly

impl PartialEq for OlecfAnomaly

fn eq(&self, other: &OlecfAnomaly) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for OlecfAnomaly