Enum Ext4Anomaly 

pub enum Ext4Anomaly {
    SuperblockBackupMismatch {
        group: u32,
        block: u64,
        differences: Vec<String>,
    },
    DeletedInode {
        ino: u64,
        file_type: FileType,
        size: u64,
        dtime: u32,
        recoverability: f64,
    },
    SlackResidue {
        ino: u64,
        file_size: u64,
        block: u64,
        slack_offset: usize,
        nonzero_bytes: usize,
    },
    JournalInconsistent {
        sequence: u32,
        commit_seconds: i64,
        prior_sequence: u32,
        prior_commit_seconds: i64,
    },
}

A classified ext4 forensic anomaly, carrying the engine evidence needed to reproduce the observation. The benign / suspicious framing lives in Ext4Anomaly::note: an anomaly is an observation, never an assertion of intent.

Variants

SuperblockBackupMismatch

A backup superblock disagrees with the primary on one or more invariant fields. ext4 replicates the superblock at group 0 (primary), group 1, and powers of 3/5/7; the copies are written together and should be identical. A divergence is consistent with a filesystem resize that did not propagate, a tune2fs edit, on-disk corruption, or deliberate tampering of one copy.

Fields

group: u32

Block group holding the diverging backup.

block: u64

Block number of the backup superblock.

differences: Vec<String>

Field names that differ from the primary (or unparseable).

DeletedInode

An inode whose deletion time (dtime) is set — the kernel stamps dtime when a file is removed. The inode metadata (and, when the block bitmap still shows its data blocks free, the file content) may be recoverable.

Fields

ino: u64

Inode number.

file_type: FileType

File type recorded in the (now deleted) inode.

size: u64

File size in bytes.

dtime: u32

Raw 32-bit deletion time (seconds; non-zero by construction here).

recoverability: f64

Estimated recoverability: fraction of the file’s data blocks still unallocated in the block bitmap, in [0.0, 1.0].

SlackResidue

Non-zero bytes in a file’s block slack — the unused tail of its final allocated block, past the recorded file size. ext4 does not zero this region on allocation, so it commonly retains fragments of previously resident data; consistent with leaked residue from prior block use (often benign) or, rarely, deliberately hidden bytes.

Fields

ino: u64

Inode owning the slack.

file_size: u64

File size in bytes.

block: u64

Physical block number holding the slack.

slack_offset: usize

Byte offset within the block where slack begins.

nonzero_bytes: usize

Number of non-zero bytes in the slack region.

JournalInconsistent

A committed journal (jbd2) transaction whose commit timestamp precedes that of an earlier-sequenced, already-committed transaction. jbd2 commits transactions in strictly increasing sequence order, so commit times should be non-decreasing along that order. A regression is consistent with a wall-clock change between commits, a journal assembled from out-of-order sources, or tampering — and is replay-relevant, since recovery replays by sequence regardless of the timestamp.

Fields

sequence: u32

Sequence number of the later (out-of-order) transaction.

commit_seconds: i64

Its commit time (epoch seconds).

prior_sequence: u32

Sequence number of the earlier transaction it regressed against.

prior_commit_seconds: i64

That earlier transaction’s commit time (epoch seconds).

Implementations

impl Ext4Anomaly

pub fn severity(&self) -> Severity

Severity assigned to this kind — the single source of truth.

pub fn code(&self) -> &'static str

Stable machine-readable code (a published contract).

pub fn category(&self) -> Category

Analytical lens. The keyword classifier in forensicnomicon::report::Category::from_code does not recognise these ext4-specific codes, so each is set explicitly.

pub fn note(&self) -> String

Human-readable description (observation, not a conclusion).

Trait Implementations

impl Clone for Ext4Anomaly

fn clone(&self) -> Ext4Anomaly

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Ext4Anomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Observation for Ext4Anomaly

fn severity(&self) -> Option<Severity>

Severity, or None if the analyzer deliberately does not grade this kind.

fn code(&self) -> &'static str

Stable, scheme-prefixed machine code.

fn note(&self) -> String

Human-readable, consistent-with note.

fn category(&self) -> Category

Analytical lens; defaults to Category::from_code of Observation::code. Override when a code’s keyword classification is wrong.

fn subjects(&self) -> Vec<SubjectRef>

Non-disk subjects this kind is about (default: none).

fn evidence(&self) -> Vec<Evidence>

Backing evidence rows (default: none).

fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with (default: none).

fn confidence(&self) -> Option<Confidence>

Heuristic confidence, if inferential (default: none).

fn to_finding(&self, source: Source) -> Finding

Assemble the canonical Finding from this kind and its producing source.

impl PartialEq for Ext4Anomaly

fn eq(&self, other: &Ext4Anomaly) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Ext4Anomaly