pub struct ZipForensicFs<R: Read + Seek> { /* private fields */ }Expand description
ForensicFs implementation for ZIP archives.
Implementations§
Trait Implementations§
Source§impl<R: Read + Seek> ForensicFs for ZipForensicFs<R>
impl<R: Read + Seek> ForensicFs for ZipForensicFs<R>
Source§fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>
fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>
List directory entries for the given inode.
Source§fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>
fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>
Look up a name in a directory, returning the child inode if found.
Source§fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>
fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>
Get file/directory metadata for an inode.
Source§fn read_file_range(
&mut self,
ino: u64,
offset: u64,
len: u64,
) -> FsResult<Vec<u8>>
fn read_file_range( &mut self, ino: u64, offset: u64, len: u64, ) -> FsResult<Vec<u8>>
Read a range of bytes from a file.
Source§fn fs_info(&self) -> FsResult<Value>
fn fs_info(&self) -> FsResult<Value>
Get filesystem-specific info as JSON (superblock, volume label, etc.).
Source§fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>>
fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>>
List deleted inodes.
Source§fn recover_file(&mut self, _ino: u64) -> FsResult<FsRecoveryResult>
fn recover_file(&mut self, _ino: u64) -> FsResult<FsRecoveryResult>
Attempt to recover a deleted file by inode number.
Source§fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>>
fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>>
Generate a forensic timeline of all filesystem events.
Source§fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>>
fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>>
Get all unallocated block ranges.
Source§fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>>
fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>>
Read raw data from an unallocated block range.
Source§fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>>
fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>>
List journal transactions.
Source§fn block_size(&self) -> u64
fn block_size(&self) -> u64
The block size of this filesystem.
Auto Trait Implementations§
impl<R> Freeze for ZipForensicFs<R>where
R: Freeze,
impl<R> RefUnwindSafe for ZipForensicFs<R>where
R: RefUnwindSafe,
impl<R> Send for ZipForensicFs<R>where
R: Send,
impl<R> Sync for ZipForensicFs<R>where
R: Sync,
impl<R> Unpin for ZipForensicFs<R>where
R: Unpin,
impl<R> UnsafeUnpin for ZipForensicFs<R>where
R: UnsafeUnpin,
impl<R> UnwindSafe for ZipForensicFs<R>where
R: UnwindSafe,
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more
impl<ST, DT> CastableFrom<ST, Initialized, Initialized> for DT
impl<ST, DT> CastableFrom<ST, Uninit, Uninit> for DT
Source§impl<T> IntoEither for T
impl<T> IntoEither for T
Source§fn into_either(self, into_left: bool) -> Either<Self, Self>
fn into_either(self, into_left: bool) -> Either<Self, Self>
Converts
self into a Left variant of Either<Self, Self>
if into_left is true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read moreSource§fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
fn into_either_with<F>(self, into_left: F) -> Either<Self, Self>
Converts
self into a Left variant of Either<Self, Self>
if into_left(&self) returns true.
Converts self into a Right variant of Either<Self, Self>
otherwise. Read more