Skip to main content

analyse_disk

disk_forensic

Function analyse_disk 

Source 
pub fn analyse_disk<R: Read + Seek>(
    reader: &mut R,
    disk_size_bytes: u64,
) -> Result<DiskReport, Error>
Expand description

Detect the partitioning scheme of the disk behind reader and run the matching forensic parser.

disk_size_bytes bounds MBR/GPT gap and out-of-bounds analysis (pass the image length; 0 skips it). The reader is rewound before each parser runs.

§Errors

Error::UnknownScheme when no scheme signature is present, Error::Apm / Error::Mbr when the chosen parser fails, or Error::Io on a read error.