vshadow 0.2.0

Pure Rust parser for Windows Volume Shadow Copy (VSS) snapshots. Read-only access to VSS stores from forensic disk images without Windows APIs.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

use std::fmt;
use std::io;

#[derive(Debug)]
pub enum VssError {
    /// I/O error reading from the volume.
    Io(io::Error),
    /// The VSS header signature is invalid — no VSS on this volume.
    InvalidSignature,
    /// Unsupported VSS version.
    UnsupportedVersion(u32),
    /// Invalid catalog block structure.
    InvalidCatalog(String),
    /// Store index out of range.
    InvalidStoreIndex(usize),
    /// Error parsing block descriptors.
    BlockDescriptorError(String),
}

impl fmt::Display for VssError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::Io(e) => write!(f, "I/O error: {}", e),
            Self::InvalidSignature => write!(f, "No VSS signature found at offset 0x1E00"),
            Self::UnsupportedVersion(v) => write!(f, "Unsupported VSS version: {}", v),
            Self::InvalidCatalog(msg) => write!(f, "Invalid VSS catalog: {}", msg),
            Self::InvalidStoreIndex(i) => write!(f, "VSS store index {} out of range", i),
            Self::BlockDescriptorError(msg) => write!(f, "Block descriptor error: {}", msg),
        }
    }
}

impl std::error::Error for VssError {}

impl From<io::Error> for VssError {
    fn from(e: io::Error) -> Self {
        Self::Io(e)
    }
}