Trait ForensicFs

Source

pub trait ForensicFs {
Show 16 methods    // Required methods
    fn root_ino(&self) -> u64;
    fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>;
    fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>;
    fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>;
    fn read_file(&mut self, ino: u64) -> FsResult<Vec<u8>>;
    fn read_file_range(
        &mut self,
        ino: u64,
        offset: u64,
        len: u64,
    ) -> FsResult<Vec<u8>>;
    fn read_link(&mut self, ino: u64) -> FsResult<Vec<u8>>;

    // Provided methods
    fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>> { ... }
    fn deleted_nodes(&mut self) -> FsResult<Vec<FsDeletedNode>> { ... }
    fn recover_file(&mut self, _ino: u64) -> FsResult<FsRecoveryResult> { ... }
    fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>> { ... }
    fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>> { ... }
    fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>> { ... }
    fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>> { ... }
    fn fs_info(&self) -> FsResult<Value> { ... }
    fn block_size(&self) -> u64 { ... }
}

Expand description

One mounted, browsable forensic filesystem, in 4n6mount’s own u64-inode vocabulary. A backend (the memory VFS, or EngineFs over a disk image) converts its native model into these calls; the FUSE/Dokan mount layer consumes them directly.

The core navigation ops are required. The forensic ops have default impls so a backend that cannot honor one degrades cleanly (an empty list, or a loud NotSupported for the byte-producing ones).

Required Methods§

Source

fn root_ino(&self) -> u64

The root directory inode number for this filesystem.

Source

fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>

List directory entries for the given inode.

Source

fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>

Look up a name in a directory, returning the child inode if found.

Source

fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>

Get file/directory metadata for an inode.

Source

fn read_file(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the entire contents of a file.

Source

fn read_file_range( &mut self, ino: u64, offset: u64, len: u64, ) -> FsResult<Vec<u8>>

Read a range of bytes from a file.

Source

fn read_link(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the target of a symbolic link.

Provided Methods§

Source

fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>>

List deleted inodes.

Source

fn deleted_nodes(&mut self) -> FsResult<Vec<FsDeletedNode>>

List deleted/orphan nodes with recovered identity — a readable inode, the recovered name, parent inode, record id, and MACB times — so the mount can render each in place (or route it to $Orphans) and read its bytes via read_file. Default empty: a backend opts in once it can recover the rich identity (e.g. NTFS $FILE_NAME + the MFT reference). It never fabricates an entry.

Source