Struct EwfIntegrityPath 

pub struct EwfIntegrityPath { /* private fields */ }

Path-based, mmap-backed EWF integrity analyser.

Unlike EwfIntegrity (which takes &[u8] slices already in memory), EwfIntegrityPath opens segment files and memory-maps them read-only. The OS pages data on demand, so 500 GB evidence files are handled without loading them into RAM.

Segment auto-discovery

from_path accepts the first segment (evidence.E01 / evidence.e01) and automatically discovers consecutive siblings (E02, E03, … up to EZZ) in the same directory. Pass from_paths to supply the segment list explicitly.

Implementations

impl EwfIntegrityPath

pub fn from_path(path: impl AsRef<Path>) -> Self

Analyse a single segment or auto-discover a multi-segment image.

If path has an extension matching the EWF numbered-segment pattern (E01/e01, E02/e02, …) this will look for consecutive siblings in the same directory and include them automatically.

pub fn from_paths(paths: &[impl AsRef<Path>]) -> Self

Analyse an explicit ordered list of segment paths.

pub fn with_expected_md5(self, hash: [u8; 16]) -> Self

Supply an external chain-of-custody MD5 to compare against.

pub fn with_expected_sha1(self, hash: [u8; 20]) -> Self

Supply an external chain-of-custody SHA-1 to compare against.

pub fn with_expected_sha256(self, hash: [u8; 32]) -> Self

Supply an external chain-of-custody SHA-256 to compare against. Mismatch → ExternalSha256Mismatch (Critical).

pub fn compute_hashes(&self) -> Result<Option<ComputedHashes>>

Memory-map every segment and compute sector data hashes.

Returns Err if any segment cannot be opened or mapped. Returns Ok(None) if the image is unparseable or is EWF v2.

pub fn analyse(&self) -> Result<Vec<EwfIntegrityAnomaly>>

Memory-map every segment and run the full integrity analyser.

Returns Err if any segment file cannot be opened or mapped.

pub fn analyse_and_compute_hashes( &self, ) -> Result<(Vec<EwfIntegrityAnomaly>, ComputedHashes)>

Memory-map every segment once and run analysis + hash computation in a single pass, avoiding duplicate I/O compared to calling [analyse] and [compute_hashes] separately.

Returns Err if any segment file cannot be opened or mapped. If the image is too corrupted to compute hashes, a zeroed ComputedHashes is returned alongside the anomalies.

pub fn analyse_with_progress( &self, progress: impl FnMut(AnalysisProgress), ) -> Result<(Vec<EwfIntegrityAnomaly>, ())>

Run integrity analysis while reporting progress to a callback.

Identical to [analyse] but invokes progress after each chunk is processed so callers can display a progress bar for large images.

Returns (anomalies, ()) on success, or Err if a segment cannot be opened or memory-mapped.