Struct Ext4Fs 

pub struct Ext4Fs<R: Read + Seek> { /* private fields */ }

Forensic-grade ext4 filesystem reader.

Accepts any Read + Seek source (raw image file, EWF reader, etc.). Provides both standard filesystem access (tier 1) and forensic operations (tier 2).

Implementations

impl<R: Read + Seek> Ext4Fs<R>

pub fn open(source: R) -> Result<Self>

Open an ext4 filesystem from a Read+Seek source.

pub fn superblock(&self) -> &Superblock

Reference to the superblock.

pub fn read_file(&mut self, path: &str) -> Result<Vec<u8>>

Read a file’s contents by path.

pub fn read_dir(&mut self, path: &str) -> Result<Vec<DirEntry>>

List directory entries by path.

pub fn metadata(&mut self, path: &str) -> Result<InodeMetadata>

Get full metadata for a path.

pub fn symlink_target(&mut self, path: &str) -> Result<Vec<u8>>

Read a symlink’s target by path.

pub fn exists(&mut self, path: &str) -> Result<bool>

Check if a path exists.

pub fn read_dir_by_ino(&mut self, dir_ino: u64) -> Result<Vec<DirEntry>>

List directory entries by inode number.

pub fn lookup_by_ino( &mut self, dir_ino: u64, name: &[u8], ) -> Result<Option<u64>>

Lookup a name inside a directory by inode number.

pub fn read_link_by_ino(&mut self, ino: u64) -> Result<Vec<u8>>

Read symlink target by inode number.

pub fn read_inode_data(&mut self, ino: u64) -> Result<Vec<u8>>

Read file data by inode number.

pub fn read_inode_data_range( &mut self, ino: u64, offset: u64, len: usize, ) -> Result<Vec<u8>>

Read a range of file data by inode number.

pub fn inode(&mut self, ino: u64) -> Result<Inode>

Read any inode by number.

pub fn all_inodes(&mut self) -> Result<Vec<(u64, Inode)>>

Enumerate all inodes (allocated and deleted).

pub fn deleted_inodes(&mut self) -> Result<Vec<DeletedInode>>

Find all deleted inodes (dtime != 0).

pub fn orphan_inodes(&mut self) -> Result<Vec<DeletedInode>>

Find all orphan inodes (links_count == 0, dtime == 0, mode != 0).

pub fn recover_file(&mut self, ino: u64) -> Result<RecoveryResult>

Attempt to recover a deleted file by inode number.

pub fn journal(&mut self) -> Result<Journal>

Parse the jbd2 journal.

pub fn timeline(&mut self) -> Result<Vec<TimelineEvent>>

Generate a forensic timeline of all filesystem events.

pub fn xattrs(&mut self, ino: u64) -> Result<Vec<Xattr>>

Read block-stored extended attributes for an inode.

pub fn unallocated_blocks(&mut self) -> Result<Vec<BlockRange>>

Get all unallocated block ranges.

pub fn read_unallocated(&mut self, range: &BlockRange) -> Result<Vec<u8>>

Read raw data from an unallocated block range.

pub fn slack_space(&mut self, ino: u64) -> Result<Option<SlackSpace>>

Read slack space for a single file inode.

pub fn scan_all_slack(&mut self) -> Result<Vec<SlackSpace>>

Scan all allocated regular file inodes for slack space.

pub fn hash_file(&mut self, ino: u64) -> Result<FileHash>

Compute BLAKE3, SHA-256, MD5, and SHA-1 hashes for a file by inode number.

pub fn hash_all_files(&mut self) -> Result<Vec<FileHash>>

Hash all allocated regular files on the filesystem.

pub fn inode_history(&mut self, ino: u64) -> Result<Vec<HistoryVersion>>

Reconstruct the version history of an inode from the journal.

pub fn recover_dir_entries( &mut self, dir_ino: u64, ) -> Result<Vec<RecoveredDirEntry>>

Recover deleted directory entries from rec_len gaps in a single directory.

pub fn recover_all_dir_entries(&mut self) -> Result<Vec<RecoveredDirEntry>>

Recover deleted directory entries from all directories on the filesystem.

pub fn is_inode_allocated(&mut self, ino: u64) -> Result<bool>

Check if a specific inode is allocated.

pub fn is_block_allocated(&mut self, block: u64) -> Result<bool>

Check if a specific block is allocated.

pub fn read_block(&mut self, block: u64) -> Result<Vec<u8>>

Read a raw block by number.

pub fn verify_superblock_backups(&mut self) -> Result<Vec<SuperblockComparison>>

Verify all superblock backups against the primary.

pub fn search_blocks( &mut self, pattern: &[u8], scope: SearchScope, ) -> Result<Vec<SearchHit>>

Search for a byte pattern across filesystem blocks.