Struct DarReader 

pub struct DarReader<R>
where
    R: Read + Seek,
{ /* private fields */ }

Read-only DAR archive reader.

Implementations

impl<R> DarReader<R>

where R: Read + Seek,

pub fn open(reader: R) -> Result<DarReader<R>, DarError>

pub fn entry_count(&self) -> usize

Number of catalogue entries, in O(1) — without materialising or cloning the entry list (cheap even for a multi-hundred-thousand-entry archive).

pub fn iter_entries(&self) -> impl Iterator<Item = DarEntry>

Iterate the catalogue entries lazily, cloning one DarEntry at a time rather than allocating the whole Vec up front — for streaming over a large archive (hashing, timelining, filtering) without holding every entry in memory at once. Use entries when you want them all collected.

pub fn entries(&self) -> Vec<DarEntry>

List all archived file entries (path and uncompressed size).

pub fn is_complete(&self) -> bool

Whether the catalog was parsed to a clean end.

false means parsing stopped early — typically at a catalog entry type this reader does not model (e.g. a hardlink or device node) or at corruption — so entries may be an incomplete listing. A forensic caller should treat an incomplete listing as “more may exist”.

pub fn verify<P>(&mut self, path: P) -> Result<CrcStatus, DarError>

where P: AsRef<[u8]>,

Verify a file entry’s data against the CRC stored in the catalogue, decompressing the entry as needed. Returns CrcStatus::Match, CrcStatus::Mismatch, or CrcStatus::NotStored. Unlike a verify-on-extract design, this never refuses to hand over the bytes — a forensic caller can still extract data that fails its CRC in order to examine the corruption.

pub fn extract_to<P, W>( &mut self, path: P, out: &mut W, ) -> Result<u64, DarError>

where P: AsRef<[u8]>, W: Write,

Extract a file by path, streaming its (decompressed) bytes to out and returning the number of bytes written. Unlike extract, this never holds the whole file in memory, so it is safe for multi-GiB entries (and composes with hashing, scanning, or writing to disk).

pub fn extract<P>(&mut self, path: P) -> Result<Vec<u8>, DarError>

where P: AsRef<[u8]>,

Extract a file by path, returning its raw bytes. Buffers the whole entry in memory; prefer extract_to for large files.

impl DarReader<SliceReader>

pub fn open_slices(basename: &Path) -> Result<DarReader<SliceReader>, DarError>

Open a multi-volume (sliced) archive from its basename: base resolves base.1.dar, base.2.dar, … until a slice is missing. The catalogue lives in the last slice and entry data may span slices — both are handled transparently. Errors if no base.1.dar exists.

Trait Implementations

impl<R: Read + Seek> DarAudit for DarReader<R>

fn audit(&self) -> Vec<Anomaly>

Audit the loaded catalogue for forensic anomalies, returning them sorted most-severe first. See AnomalyKind for what is detected; each Anomaly is an observation, not a conclusion.

fn write_bodyfile<W: Write>(&self, out: &mut W) -> Result<()>

Write a Sleuth Kit bodyfile — one line per catalogue entry, newline-terminated — to out, for feeding TSK’s mactime timeline tool. Pure metadata over the parsed catalogue; no archive data is read.