forensic-mount 0.6.1

Mount forensic disk images, archives, and memory dumps as a filesystem on Linux, macOS, and Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK containers, zip/7z/tar, LiME/AVML/crash dumps
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
//! Write a synthetic Windows crash dump to a path, for end-to-end memory-mount
//! smoke testing. Build with `--features memory`.
//!
//! Usage: `cargo run --features memory --example mkdump -- /tmp/crash.dmp`

// A developer smoke-test helper, not shipped code: a panic on a bad argument is
// the intended failure mode.
#![allow(clippy::unwrap_used, clippy::expect_used)]

fn main() {
    let path = std::env::args().nth(1).expect("usage: mkdump <out.dmp>");
    let bytes = memf_format::test_builders::CrashDumpBuilder::new()
        .cr3(0x1a_b000)
        .build();
    std::fs::write(&path, &bytes).expect("write dump");
    eprintln!("wrote {} bytes to {path}", bytes.len());
}