Enum dfir_toolkit::common::bodyfile::bodyfile3::Bodyfile3ParserError

pub enum Bodyfile3ParserError {
    WrongNumberOfColumns,
    IllegalUid,
    IllegalGid,
    IllegalSize,
    IllegalATime,
    IllegalMTime,
    IllegalCTime,
    IllegalCRTime,
}

Variants

WrongNumberOfColumns

indicates that number of columns is not valid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from(""), Err(Bodyfile3ParserError::WrongNumberOfColumns));
assert_matches!(Bodyfile3Line::try_from("|||||||||"), Err(Bodyfile3ParserError::WrongNumberOfColumns));
assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-1|-1|-1|-1"), Ok(_));
assert_matches!(Bodyfile3Line::try_from("0|{\"activity_id\":null,\"channel_name\":\"Microsoft-Windows-PowerShell/Operational\",\"custom_data\":{\"EventData\":{\"ContextInfo\":\"        Severity = Warning\\r\\n        Host Name = ConsoleHost\\r\\n        Host Version = 4.0\\r\\n        Host ID = 5635c559-63c7-4bdc-8bb6-e2aa0448e7b9\\r\\n        Host Application = powershell get-VMNetworkAdapter -ManagementOS | fl | out-file -encoding ASCII VMNetworkAdapterInstances.txt\\r\\n        Engine Version = 4.0\\r\\n        Runspace ID = d315d83a-8923-4530-9553-e63551c33cbc\\r\\n        Pipeline ID = 1\\r\\n        Command Name = \\r\\n        Command Type = Script\\r\\n        Script Name = \\r\\n        Command Path = \\r\\n        Sequence Number = 15\\r\\n        User = TEST\\\\SYSTEM\\r\\n        Shell ID = Microsoft.PowerShell\\r\\n\",\"Payload\":\"Error Message = Could not load file or assembly 'System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' or one of its dependencies. The media is write protected. (Exception from HRESULT: 0x80070013)\\r\\nFully Qualified Error ID = System.IO.FileLoadException\\r\\n\",\"UserData\":\"\"}},\"event_id\":4100,\"event_record_id\":2424468,\"provider_name\":\"Microsoft-Windows-PowerShell\"}|0||0|0|0|-1|1645178371|-1|-1"), Ok(_));

IllegalUid

indicates that the uid is syntactically invalid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from("0||0||X|0|0|-1|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalUid));
assert_matches!(Bodyfile3Line::try_from("0||0||-1|0|0|-1|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalUid));
let valid_bf = Bodyfile3Line::try_from("0||0||1|0|0|-1|-1|-1|-1").unwrap();
assert_eq!(valid_bf.get_uid(), 1);

IllegalGid

indicates that the gid is syntactically invalid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from("0||0||0|X|0|-1|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalGid));
assert_matches!(Bodyfile3Line::try_from("0||0||0|-2|0|-1|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalGid));
let valid_bf = Bodyfile3Line::try_from("0||0||1|2|0|-1|-1|-1|-1").unwrap();
assert_eq!(valid_bf.get_gid(), 2);

IllegalSize

indicates that the size is syntactically invalid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from("0||0||0|0|X|-1|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalSize));
assert_matches!(Bodyfile3Line::try_from("0||0||0|0|-4|-1|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalSize));
let valid_bf = Bodyfile3Line::try_from("0||0||1|0|4|-1|-1|-1|-1").unwrap();
assert_eq!(valid_bf.get_size(), 4);

IllegalATime

indicates that the atime is syntactically invalid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|X|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalATime));
assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-5|-1|-1|-1"), Err(Bodyfile3ParserError::IllegalATime));
let valid_bf = Bodyfile3Line::try_from("0||0||1|0|0|5|-1|-1|-1").unwrap();
assert_eq!(valid_bf.get_atime(), 5);

IllegalMTime

indicates that the mtime is syntactically invalid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-1|X|-1|-1"), Err(Bodyfile3ParserError::IllegalMTime));
assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-1|-5|-1|-1"), Err(Bodyfile3ParserError::IllegalMTime));
let valid_bf = Bodyfile3Line::try_from("0||0||1|0|0|-1|5|-1|-1").unwrap();
assert_eq!(valid_bf.get_mtime(), 5);

IllegalCTime

indicates that the ctime is syntactically invalid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-1|-1|X|-1"), Err(Bodyfile3ParserError::IllegalCTime));
assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-1|-1|-5|-1"), Err(Bodyfile3ParserError::IllegalCTime));
let valid_bf = Bodyfile3Line::try_from("0||0||1|0|0|-1|-1|5|-1").unwrap();
assert_eq!(valid_bf.get_ctime(), 5);

IllegalCRTime

indicates that the crtime is syntactically invalid

Examples

extern crate matches;
use dfir_toolkit::common::bodyfile::{Bodyfile3Line, Bodyfile3ParserError};
use std::convert::TryFrom;
use matches::assert_matches;

assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-1|-1|-1|X"), Err(Bodyfile3ParserError::IllegalCRTime));
assert_matches!(Bodyfile3Line::try_from("0||0||0|0|0|-1|-1|-1|-5"), Err(Bodyfile3ParserError::IllegalCRTime));
let valid_bf = Bodyfile3Line::try_from("0||0||1|0|0|-1|-1|-1|5").unwrap();
assert_eq!(valid_bf.get_crtime(), 5);

Trait Implementations

impl Debug for Bodyfile3ParserError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Bodyfile3ParserError

implements Display for this enum

Example

use dfir_toolkit::common::bodyfile::Bodyfile3ParserError;
 
let myerror = Bodyfile3ParserError::IllegalCRTime;
assert_eq!(myerror.to_string(), "IllegalCRTime")

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for Bodyfile3ParserError

fn source(&self) -> Option<&(dyn Error + 'static)>

The lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0: use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0: replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type based access to context intended for error reports.