Struct MultiPartitionFs 

pub struct MultiPartitionFs { /* private fields */ }

The ADR-0010 volume multiplexer: it surfaces each volume of a disk image as a <volume>/ subdirectory under a synthetic root (_partition<N>, a wired label, or root for a bare unpartitioned filesystem — see [volume_dir_name]), so an analyst reaches every filesystem (e.g. both the FAT EFI System Partition and the NTFS Windows volume of a GPT disk) rather than only the first the engine finds, at a constant <mount>/<volume>/… depth even for a single-filesystem image.

Each volume is a mounted EngineFs; the multiplexer keeps a dense (partition, inner inode) -> global inode map so partition inode spaces stay disjoint. A partition << 48 bit-pack would be simpler but overflows the FUSE mount layer’s ro_ino (backend + 1000) / decode_fuse_ino namespace [1000, 10_000_000); the dense allocator (the same pattern EngineFs uses for FileId -> u64) keeps globals small, so the tree flows through the mount exactly like a single filesystem.

Trait Implementations

impl ForensicFs for MultiPartitionFs

fn root_ino(&self) -> u64

The root directory inode number for this filesystem.

fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>

List directory entries for the given inode.

fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>

Look up a name in a directory, returning the child inode if found.

fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>

Get file/directory metadata for an inode.

fn read_file(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the entire contents of a file.

fn read_file_range( &mut self, ino: u64, offset: u64, len: u64, ) -> FsResult<Vec<u8>>

Read a range of bytes from a file.

fn read_link(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the target of a symbolic link.

fn block_size(&self) -> u64

The block size of this filesystem.

fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>>

List deleted inodes.

fn deleted_nodes(&mut self) -> FsResult<Vec<FsDeletedNode>>

List deleted/orphan nodes with recovered identity — a readable inode, the recovered name, parent inode, record id, and MACB times — so the mount can render each in place (or route it to $Orphans) and read its bytes via read_file. Default empty: a backend opts in once it can recover the rich identity (e.g. NTFS $FILE_NAME + the MFT reference). It never fabricates an entry.

fn recover_file(&mut self, _ino: u64) -> FsResult<FsRecoveryResult>

Attempt to recover a deleted file by inode number.

fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>>

Generate a forensic timeline of all filesystem events.

fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>>

Get all unallocated block ranges.

fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>>

Read raw data from an unallocated block range.

fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>>

List journal transactions.

fn fs_info(&self) -> FsResult<Value>

Get filesystem-specific info as JSON (superblock, volume label, etc.).