Struct DarEntry 

pub struct DarEntry {
    pub path: Vec<u8>,
    pub kind: EntryKind,
    pub size: u64,
    pub uid: u64,
    pub gid: u64,
    pub mode: u16,
    pub atime: i64,
    pub mtime: i64,
    pub ctime: Option<i64>,
    pub symlink_target: Option<Vec<u8>>,
}

Metadata about one archived filesystem object.

Paths and symlink targets are exposed as raw bytes — DAR (like the filesystems it archives) does not guarantee UTF-8, and a forensic reader must never lose or reject a byte-exact name. Use DarEntry::path_lossy for display.

Fields

path: Vec<u8>

Path as stored, raw bytes — may not be valid UTF-8. In JSON this is the lossy-UTF-8 display string (use the field directly for byte-exact data).

kind: EntryKind

What kind of filesystem object this entry describes.

size: u64

Uncompressed size in bytes (0 for entries with no data).

uid: u64

Owner user id.

gid: u64

Owner group id.

mode: u16

Permission bits (the low bits of the mode).

atime: i64

Access time, seconds since the Unix epoch.

mtime: i64

Modification time, seconds since the Unix epoch.

ctime: Option<i64>

Status-change time, seconds since the Unix epoch; None for formats before 8, which do not record it.

symlink_target: Option<Vec<u8>>

Target of a symbolic link, raw bytes; None for non-symlinks. In JSON this is the lossy-UTF-8 display string (or null).

Implementations

impl DarEntry

pub fn path_lossy(&self) -> Cow<'_, str>

The path decoded as lossy UTF-8 (invalid byte sequences become U+FFFD).

Trait Implementations

impl Clone for DarEntry

fn clone(&self) -> DarEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl DarBodyfile for DarEntry

fn bodyfile(&self) -> String

One Sleuth Kit bodyfile line for this entry (no trailing newline) — the input format for TSK’s mactime timeline tool.

impl Debug for DarEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.