Struct ExFatForensicFs 

pub struct ExFatForensicFs { /* private fields */ }

ForensicFs implementation for exFAT volumes.

Implementations

impl ExFatForensicFs

pub fn new<R: Read + Seek>(source: R) -> Result<Self, FsError>

Open an exFAT volume and walk its directory tree, caching file contents.

Errors

FsError::Corrupt if the boot sector / directory structure is invalid.

Trait Implementations

impl ForensicFs for ExFatForensicFs

fn root_ino(&self) -> u64

The root directory inode number for this filesystem.

fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>

List directory entries for the given inode.

fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>

Look up a name in a directory, returning the child inode if found.

fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>

Get file/directory metadata for an inode.

fn read_file(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the entire contents of a file.

fn read_file_range( &mut self, ino: u64, offset: u64, len: u64, ) -> FsResult<Vec<u8>>

Read a range of bytes from a file.

fn read_link(&mut self, _ino: u64) -> FsResult<Vec<u8>>

Read the target of a symbolic link.

fn fs_info(&self) -> FsResult<Value>

Get filesystem-specific info as JSON (superblock, volume label, etc.).

fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>>

List deleted inodes.

fn recover_file(&mut self, _ino: u64) -> FsResult<FsRecoveryResult>

Attempt to recover a deleted file by inode number.

fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>>

Generate a forensic timeline of all filesystem events.

fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>>

Get all unallocated block ranges.

fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>>

Read raw data from an unallocated block range.

fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>>

List journal transactions.

fn block_size(&self) -> u64

The block size of this filesystem.