Skip to main content

ForensicFs

forensic_mount

Trait ForensicFs 

Source 
pub trait ForensicFs {

Show 15 methods    // Required methods
    fn root_ino(&self) -> u64;
    fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>;
    fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>;
    fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>;
    fn read_file(&mut self, ino: u64) -> FsResult<Vec<u8>>;
    fn read_file_range(
        &mut self,
        ino: u64,
        offset: u64,
        len: u64,
    ) -> FsResult<Vec<u8>>;
    fn read_link(&mut self, ino: u64) -> FsResult<Vec<u8>>;

    // Provided methods
    fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>> { ... }
    fn recover_file(&mut self, _ino: u64) -> FsResult<FsRecoveryResult> { ... }
    fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>> { ... }
    fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>> { ... }
    fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>> { ... }
    fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>> { ... }
    fn fs_info(&self) -> FsResult<Value> { ... }
    fn block_size(&self) -> u64 { ... }

}
Expand description

The core trait that filesystem crates implement.

Provides both standard filesystem access (required methods) and forensic operations (optional, with sensible defaults).

Required Methods§

Source

fn root_ino(&self) -> u64

The root directory inode number for this filesystem.

Source

fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>

List directory entries for the given inode.

Source

fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>

Look up a name in a directory, returning the child inode if found.

Source

fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>

Get file/directory metadata for an inode.

Source

fn read_file(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the entire contents of a file.

Source

fn read_file_range( &mut self, ino: u64, offset: u64, len: u64, ) -> FsResult<Vec<u8>>

Read a range of bytes from a file.

Read the target of a symbolic link.

Provided Methods§

Source

fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>>

List deleted inodes.

Source

fn recover_file(&mut self, _ino: u64) -> FsResult<FsRecoveryResult>

Attempt to recover a deleted file by inode number.

Source

fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>>

Generate a forensic timeline of all filesystem events.

Source

fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>>

Get all unallocated block ranges.

Source

fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>>

Read raw data from an unallocated block range.

Source

fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>>

List journal transactions.

Source

fn fs_info(&self) -> FsResult<Value>

Get filesystem-specific info as JSON (superblock, volume label, etc.).

Source

fn block_size(&self) -> u64

The block size of this filesystem.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§