prefetch-core 0.1.0

Pure-Rust read-only Windows Prefetch (.pf) reader — MAM/Xpress-Huffman decompression + SCCA v30/31 (run count, last-8 run times, volume info, loaded files).
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

[package]
name = "prefetch-core"
version = "0.1.0"
edition = "2021"
rust-version = "1.85"
description = "Pure-Rust read-only Windows Prefetch (.pf) reader — MAM/Xpress-Huffman decompression + SCCA v30/31 (run count, last-8 run times, volume info, loaded files)."
license = "Apache-2.0"
authors = ["Albert Hui"]
keywords = ["forensics", "prefetch", "windows", "dfir", "execution"]
categories = ["parser-implementations"]
repository = "https://github.com/SecurityRonin/prefetch-forensic"
readme = "../README.md"
exclude = ["tests/data/", "fuzz/"]

[dependencies]
# The MAM/Xpress-Huffman codec lives in its own reusable crate (also used for
# hiberfil.sys / SMB3 / registry-hive decompression across the fleet).
xpress-huffman = "0.1"

[lints]
workspace = true