ntfs-forensic 0.4.0

Forensic anomaly auditor for NTFS — timestomping, alternate data streams, deleted records, and MFT-record slack as graded report::Finding, built on ntfs-core

Documentation

Coverage
100%
35 out of 35 items documented0 out of 16 items with examples
Size
Source code size: 29.94 kB This is the summed size of all the files inside the crates.io package for this release.
Documentation size: 637.81 kB This is the summed size of all files generated by rustdoc for all configured targets
Ø build duration
this release: 13s Average build duration of successful builds.
all releases: 11s Average build duration of successful builds in releases after 2024-10-23.
Links
Homepage
SecurityRonin/ntfs-forensic
0 0 0
crates.io
Dependencies
- forensicnomicon ^0.3.1 normal
- ntfs-core ^0.4.0 normal
Versions
Owners

ntfs-forensic

Forensic anomaly auditor for NTFS — turns the artifacts a clean reader hides (timestomping, alternate data streams, deleted MFT records, record slack) into graded forensicnomicon::report::Findings via the Observation trait, built on ntfs-core.

use ntfs_forensic::audit_record; // -> Vec<Anomaly>; an.to_finding(source) for a canonical Finding

Codes: NTFS-TIMESTOMP (High), NTFS-ADS / NTFS-SLACK-RESIDUE (Low), NTFS-DELETED-RECORD (Info).