Struct Inode 

pub struct Inode {

    pub mode: u16,
    pub uid: u32,
    pub gid: u32,
    pub size: u64,
    pub atime: Timestamp,
    pub ctime: Timestamp,
    pub mtime: Timestamp,
    pub dtime: u32,
    pub crtime: Timestamp,
    pub links_count: u16,
    pub blocks_count: u64,
    pub flags: InodeFlags,
    pub i_block: [u8; 60],
    pub generation: u32,
    pub file_acl: u64,
    pub extra_isize: u16,
    pub checksum: u32,
    pub projid: u32,
}

Parsed on-disk ext4 inode (128-byte base + optional extended fields).

Fields

mode: u16

uid: u32

gid: u32

size: u64

Full 64-bit file size (i_size_lo | i_size_hi << 32).

atime: Timestamp

ctime: Timestamp

mtime: Timestamp

dtime: u32

Deletion time (raw 32-bit seconds; 0 = not deleted).

crtime: Timestamp

Creation time — only valid when extra_isize >= 28.

links_count: u16

blocks_count: u64

Full 48-bit block count in 512-byte units (i_blocks_lo | i_blocks_hi << 32).

flags: InodeFlags

i_block: [u8; 60]

generation: u32

file_acl: u64

extra_isize: u16

checksum: u32

Combined 32-bit checksum (lo 16 at 0x7C, hi 16 at 0x82).

projid: u32

Implementations

impl Inode

pub fn parse(buf: &[u8], inode_size: u16) -> Result<Self>

Parse an inode from buf.

inode_size is the value from the superblock (s_inode_size); it determines how many bytes are available for extended fields.

pub fn file_type(&self) -> FileType

Extract the file type from the high nibble of i_mode.

pub fn mode_permissions(&self) -> u16

Extract the permission bits (low 12 bits of i_mode).

pub fn uses_extents(&self) -> bool

True if this inode uses the extent tree (EXTENTS flag set).

pub fn has_inline_data(&self) -> bool

True if this inode stores data inline in i_block.

pub fn has_htree(&self) -> bool

True if this directory uses an HTree (htree/INDEX flag set).

pub fn is_deleted(&self) -> bool

True if the inode has been deleted (dtime != 0).

This is the authoritative deletion marker in ext4. When the kernel deletes a file, it sets dtime to the current time. An inode with links_count == 0 but dtime == 0 is an orphan (unlinked while still open, or system crashed mid-deletion) — a forensically distinct state. Use Self::is_orphan to detect those.

pub fn verify_checksum( &self, raw_buf: &[u8], uuid: &[u8; 16], ino: u32, generation: u32, csum_seed: u32, ) -> bool

Verify the inode’s CRC32C checksum (METADATA_CSUM feature).

The algorithm:

1. Seed from csum_seed (or crc32c(0xFFFFFFFF, uuid) if zero)
2. Feed le32(ino) then le32(generation)
3. Feed the full raw inode bytes with both checksum fields zeroed
4. Compare the 32-bit result against self.checksum

pub fn is_orphan(&self) -> bool

True if the inode is an orphan: unlinked (links_count == 0) but never fully deleted (dtime == 0) and still has content (mode != 0).

Orphans typically result from:

• A file unlinked while still held open by a process (common temp file pattern)
• A system crash during file deletion before dtime was written
• An unclean shutdown leaving inodes in the orphan list

Forensically distinct from deleted inodes — orphans were not intentionally removed by the user/process at the time of imaging.

Trait Implementations

impl Clone for Inode

fn clone(&self) -> Inode

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Inode

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.