forensicnomicon 1.0.0

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# Public API baselines

`forensicnomicon-core.txt` and `forensicnomicon-data.txt` are the recorded public
API surface of the two published library crates, generated by
[`cargo-public-api`](https://github.com/cargo-public-api/cargo-public-api). The
`.github/workflows/public-api.yml` job regenerates each surface on every PR and
**fails if it differs from the committed baseline** — so any change to the public
API is a conscious, reviewable edit rather than an accident.

## When CI flags a change

If the change is intentional, regenerate the baseline in the same PR:

```sh
cargo public-api -p forensicnomicon-core --all-features \
  --omit blanket-impls,auto-trait-impls,auto-derived-impls > public-api/forensicnomicon-core.txt
cargo public-api -p forensicnomicon-data --all-features \
  --omit blanket-impls,auto-trait-impls,auto-derived-impls > public-api/forensicnomicon-data.txt
```

Install the tool with `brew install cargo-public-api` (or `cargo install
cargo-public-api`); it needs a nightly toolchain for rustdoc JSON. Pin to the same
version CI uses (see `CARGO_PUBLIC_API_VERSION` in the workflow) so the textual
output matches.