Enum EwfIntegrityAnomaly 

pub enum EwfIntegrityAnomaly {
    InvalidSignature,
    SegmentNumberZero,
    SectionDescriptorCrcMismatch {
        offset: u64,
        section_type: String,
        computed: u32,
        stored: u32,
    },
    SectionChainBroken {
        at_offset: u64,
        next_offset: u64,
    },
    SectionGapNonZero {
        gap_offset: u64,
        gap_size: u64,
    },
    VolumeSectionMissing,
    UnknownSectionType {
        offset: u64,
        type_name: String,
    },
    DoneSectionMissing,
    SectorsSectionMissing,
    TableSectionMissing,
    ChunkSizeInvalid {
        sectors_per_chunk: u32,
        bytes_per_sector: u32,
    },
    SectorCountMismatch {
        declared: u64,
        expected: u64,
    },
    BytesPerSectorInvalid {
        bytes_per_sector: u32,
    },
    TableChunkCountMismatch {
        in_volume: u32,
        in_table: u32,
    },
    TableHeaderAdler32Mismatch {
        computed: u32,
        stored: u32,
    },
    TableEntryOutOfBounds {
        chunk_index: u32,
        entry_offset: u64,
        file_size: u64,
    },
    TableEntryOutsideSectorsRange {
        chunk_index: u32,
        entry_offset: u64,
        sectors_start: u64,
        sectors_end: u64,
    },
    SectionGapZero {
        gap_offset: u64,
        gap_size: u64,
    },
    HashMismatch {
        computed: [u8; 16],
        stored: [u8; 16],
    },
    HashSectionMissing,
    Table2Mismatch {
        offset: usize,
    },
    BadSectorsPresent {
        count: u32,
    },
    SegmentOutOfOrder {
        segment_number: u16,
        expected: u16,
    },
    DigestSha1Mismatch {
        computed: [u8; 20],
        stored: [u8; 20],
    },
    DigestSha256Mismatch {
        computed: [u8; 32],
        stored: [u8; 32],
    },
    ExternalMd5Mismatch {
        computed: [u8; 16],
        expected: [u8; 16],
    },
    ExternalSha1Mismatch {
        computed: [u8; 20],
        expected: [u8; 20],
    },
    Ewf2SectionDataHashMismatch {
        offset: u64,
        section_type_id: u32,
        computed: [u8; 16],
        stored: [u8; 16],
    },
    Ewf2EncryptedSection {
        offset: u64,
    },
    Ewf2HashSectionMissing,
    VolumeBodyCrcMismatch {
        computed: u32,
        stored: u32,
    },
    MediaTypeUnknown {
        media_type: u8,
    },
    SetIdentifierMismatch {
        segment: usize,
    },
    Ewf2MediaInfoMissing,
    Ewf2ChunkTableChecksumMismatch {
        computed: u32,
        stored: u32,
    },
    ChunkChecksumMismatch {
        chunk_index: usize,
        computed: u32,
        stored: u32,
    },
    ChunkDecompressionError {
        chunk_index: usize,
    },
    UnsupportedCompressionAlgorithm {
        method_id: u16,
    },
    ExternalSha256Mismatch {
        computed: [u8; 32],
        expected: [u8; 32],
    },
    Ewf2MediaInfoParseFailed,
}

Variants

InvalidSignature

SegmentNumberZero

SectionDescriptorCrcMismatch

Fields

offset: u64

section_type: String

computed: u32

stored: u32

SectionChainBroken

Fields

at_offset: u64

next_offset: u64

SectionGapNonZero

Fields

gap_offset: u64

gap_size: u64

VolumeSectionMissing

UnknownSectionType

Fields

offset: u64

type_name: String

DoneSectionMissing

SectorsSectionMissing

No sectors section was found in this EWF v1 segment.

TableSectionMissing

No table section was found in this EWF v1 segment.

ChunkSizeInvalid

Fields

sectors_per_chunk: u32

bytes_per_sector: u32

SectorCountMismatch

Fields

declared: u64

expected: u64

BytesPerSectorInvalid

Fields

bytes_per_sector: u32

TableChunkCountMismatch

Fields

in_volume: u32

in_table: u32

TableHeaderAdler32Mismatch

Fields

computed: u32

stored: u32

TableEntryOutOfBounds

Fields

chunk_index: u32

entry_offset: u64

file_size: u64

TableEntryOutsideSectorsRange

Fields

chunk_index: u32

entry_offset: u64

sectors_start: u64

sectors_end: u64

SectionGapZero

Fields

gap_offset: u64

gap_size: u64

HashMismatch

Fields

computed: [u8; 16]

stored: [u8; 16]

HashSectionMissing

Table2Mismatch

table2 body differs from table body — one of the redundant copies is corrupt.

Fields

offset: usize

Byte offset into the table body where the first difference was found.

BadSectorsPresent

The error2 section records acquisition errors (unreadable sectors).

Fields

count: u32

Number of error entries in the error2 section.

SegmentOutOfOrder

Segment number does not match the expected sequential position.

Fields

segment_number: u16

expected: u16

DigestSha1Mismatch

Computed SHA-1 of all sector data does not match the stored SHA-1 in the digest section.

Fields

computed: [u8; 20]

stored: [u8; 20]

DigestSha256Mismatch

Computed SHA-256 of all sector data does not match the stored SHA-256 in the hash section.

Fields

computed: [u8; 32]

stored: [u8; 32]

ExternalMd5Mismatch

Computed MD5 does not match an externally supplied reference (e.g. chain-of-custody form).

Fields

computed: [u8; 16]

expected: [u8; 16]

ExternalSha1Mismatch

Computed SHA-1 does not match an externally supplied reference.

Fields

computed: [u8; 20]

expected: [u8; 20]

Ewf2SectionDataHashMismatch

A section’s stored data_integrity_hash does not match MD5 of the section body.

Fields

offset: u64

section_type_id: u32

computed: [u8; 16]

stored: [u8; 16]

Ewf2EncryptedSection

An encrypted section was found; its content cannot be verified.

Fields

offset: u64

Ewf2HashSectionMissing

No MD5 or SHA-1 hash section found in the final EWF v2 segment.

VolumeBodyCrcMismatch

Adler-32 of the 1052-byte ewf_data_t body is wrong. Only checked when the volume body is ≥ 1052 bytes (as in real acquisitions).

Fields

computed: u32

stored: u32

MediaTypeUnknown

media_type byte (offset 0 of ewf_data_t) is not a known valid value. Valid: 0x00=removable, 0x01=fixed, 0x03=optical, 0x0e=LVF, 0x10=memory.

Fields

media_type: u8

SetIdentifierMismatch

The set_identifier GUID (bytes 64-79 of ewf_data_t) differs between segments of the same acquisition — indicates segments from different acquisitions were mixed.

Fields

segment: usize

Ewf2MediaInfoMissing

No media information (device information) section found in the EWF v2 image.

Ewf2ChunkTableChecksumMismatch

The Adler-32 checksum stored at the end of the EWF v2 chunk table body does not match the Adler-32 computed over the chunk table entries.

Fields

computed: u32

stored: u32

ChunkChecksumMismatch

The Adler-32 stored at the end of a chunk’s byte range does not match the Adler-32 computed over the chunk’s raw (possibly compressed) bytes.

Fields

chunk_index: usize

computed: u32

stored: u32

ChunkDecompressionError

A compressed chunk’s zlib stream could not be decompressed. The chunk index identifies exactly which chunk is corrupt.

Fields

chunk_index: usize

UnsupportedCompressionAlgorithm

EWF v2 file header specifies a compression algorithm not supported by this tool.

Fields

method_id: u16

Value from file header bytes [10..12].

ExternalSha256Mismatch

Computed SHA-256 does not match an externally supplied reference.

Fields

computed: [u8; 32]

expected: [u8; 32]

Ewf2MediaInfoParseFailed

The EWF v2 media information section body could not be decompressed (zlib failure) or decoded as UTF-16LE. The body is required to be a zlib- compressed, BOM-prefixed UTF-16LE key=value table.

Implementations

impl EwfIntegrityAnomaly

pub fn severity(&self) -> Severity

impl EwfIntegrityAnomaly

pub fn code(&self) -> &'static str

Stable, scheme-prefixed machine code for this anomaly.

Trait Implementations

impl Clone for EwfIntegrityAnomaly

fn clone(&self) -> EwfIntegrityAnomaly

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EwfIntegrityAnomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for EwfIntegrityAnomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for EwfIntegrityAnomaly

impl Observation for EwfIntegrityAnomaly

fn severity(&self) -> Option<Severity>

Severity, or None if the analyzer deliberately does not grade this kind.

fn code(&self) -> &'static str

Stable, scheme-prefixed machine code.

fn note(&self) -> String

Human-readable, consistent-with note.

fn category(&self) -> Category

Analytical lens; defaults to Category::from_code of Observation::code. Override when a code’s keyword classification is wrong.

fn subjects(&self) -> Vec<SubjectRef>

Non-disk subjects this kind is about (default: none).

fn evidence(&self) -> Vec<Evidence>

Backing evidence rows (default: none).

fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with (default: none).

fn confidence(&self) -> Option<Confidence>

Heuristic confidence, if inferential (default: none).

fn to_finding(&self, source: Source) -> Finding

Assemble the canonical Finding from this kind and its producing source.

impl PartialEq for EwfIntegrityAnomaly

fn eq(&self, other: &EwfIntegrityAnomaly) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for EwfIntegrityAnomaly