Struct evtx::EvtxChunk

pub struct EvtxChunk<'chunk> {
    pub data: &'chunk [u8],
    pub header: &'chunk EvtxChunkHeader,
    pub string_cache: StringCache,
    pub template_table: TemplateCache<'chunk>,
    // some fields omitted
}

A struct which can hold references to chunk data (EvtxChunkData). All references are created together, and can be assume to live for the entire duration of the parsing phase. See more info about lifetimes in IterChunkRecords.

Fields

data: &'chunk [u8]

header: &'chunk EvtxChunkHeader

string_cache: StringCache

template_table: TemplateCache<'chunk>

Methods

impl<'chunk> EvtxChunk<'chunk>

pub fn new(
    data: &'chunk [u8],
    header: &'chunk EvtxChunkHeader,
    settings: &'chunk ParserSettings
) -> Result<EvtxChunk<'chunk>>

Will fail if the data starts with an invalid evtx chunk header.

Important traits for IterChunkRecords<'a>

impl<'a> Iterator for IterChunkRecords<'a> type Item = Result<EvtxRecord<'a>>;

pub fn iter<'a: 'chunk>(&'a mut self) -> IterChunkRecords

Return an iterator of records from the chunk. See IterChunkRecords for more lifetime info.

pub fn iter_serialized_records<'a: 'chunk, O: BinXmlOutput<Vec<u8>>>(
    &'a mut self
) -> impl Iterator<Item = Result<SerializedEvtxRecord>> + 'a

Return an iterator of serialized records (containing textual data, not tokens) from the chunk.