Struct evtx::EvtxChunkData

pub struct EvtxChunkData {
    pub header: EvtxChunkHeader,
    pub data: Vec<u8>,
}

A struct which owns all the data associated with a chunk. See EvtxChunk for more.

Fields

header: EvtxChunkHeader

data: Vec<u8>

Methods

impl EvtxChunkData

pub fn new(data: Vec<u8>, validate_checksum: bool) -> Result<Self>

Construct a new chunk from the given data. Note that even when validate_checksum is set to false, the header magic is still checked.

pub fn parse<'chunk, 'b: 'chunk>(
    &'chunk mut self,
    settings: &'b ParserSettings
) -> Result<EvtxChunk<'chunk>>

Require that the settings live at least as long as &self.

pub fn validate_data_checksum(&self) -> bool

pub fn validate_header_checksum(&self) -> bool

pub fn validate_checksum(&self) -> bool