1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
//! # forensicnomicon-core
//!
//! Stable engine layer of the ForensicNomicon. Houses the slow-moving pieces that
//! downstream analyzers and readers depend on, kept apart from the fast-moving
//! detection knowledge (the ~6.5k artifact descriptors) in the umbrella
//! `forensicnomicon` crate:
//!
//! - [`report`] — the normalized cross-scheme DFIR finding vocabulary
//! (`Finding`/`Severity`/`Observation`) that every `*-forensic` analyzer emits.
//! - [`catalog`] — the descriptor `types`, the [`catalog::ForensicCatalog`] lookup
//! engine and its query methods, container/record parsing profiles, and the
//! in-core decoders. It carries **no** artifact data; the umbrella crate wires
//! the assembled dataset into a global `CATALOG` via `ForensicCatalog::new`.
//! - [`evidence::EvidenceStrength`] and [`volatility::VolatilityClass`] — the
//! rating types stored on each descriptor (the catalog-querying helpers live in
//! the umbrella crate, where the global catalog is wired).
//! - Structural format constants readers depend on: [`decmpfs`], [`filesystems`],
//! [`partition_schemes`], [`partition_types`].
//!
//! These carry no dependency on the assembled detection catalog, so a knowledge
//! change never forces a republish of crates that only need this engine. The
//! umbrella `forensicnomicon` crate re-exports everything here, so existing imports
//! such as `forensicnomicon::report::Finding` or `forensicnomicon::catalog::CATALOG`
//! continue to resolve unchanged.
/// Filesystem-object identity, re-exported at the crate root so consumers write
/// `forensicnomicon_core::FileId` (ADR 0009). `forensic-vfs` re-exports this in
/// turn, keeping every existing `forensic_vfs::FileId` import working unchanged.
pub use FileId;