Struct EngineFs 

pub struct EngineFs { /* private fields */ }

A disk-image filesystem mounted through the engine.

_tmp keeps a peeled-and-spilled inner image (e.g. from evidence.dd.gz) alive for exactly the mount’s lifetime: fs is declared first so its open file handle drops before the temp file is unlinked (correct on Windows).

Implementations

impl EngineFs

pub fn fs_kind_str(&self) -> &'static str

The mounted filesystem’s kind as a short lowercase tag (e.g. "ntfs", "fat") — used to label a partition in a MultiPartitionFs.

Trait Implementations

impl ForensicFs for EngineFs

fn root_ino(&self) -> u64

The root directory inode number for this filesystem.

fn read_dir(&mut self, ino: u64) -> FsResult<Vec<FsDirEntry>>

List directory entries for the given inode.

fn lookup(&mut self, parent_ino: u64, name: &[u8]) -> FsResult<Option<u64>>

Look up a name in a directory, returning the child inode if found.

fn metadata(&mut self, ino: u64) -> FsResult<FsMetadata>

Get file/directory metadata for an inode.

fn read_file(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the entire contents of a file.

fn read_file_range( &mut self, ino: u64, offset: u64, len: u64, ) -> FsResult<Vec<u8>>

Read a range of bytes from a file.

fn read_link(&mut self, ino: u64) -> FsResult<Vec<u8>>

Read the target of a symbolic link.

fn deleted_inodes(&mut self) -> FsResult<Vec<FsDeletedInode>>

List deleted inodes.

fn deleted_nodes(&mut self) -> FsResult<Vec<FsDeletedNode>>

List deleted/orphan nodes with recovered identity — a readable inode, the recovered name, parent inode, record id, and MACB times — so the mount can render each in place (or route it to $Orphans) and read its bytes via read_file. Default empty: a backend opts in once it can recover the rich identity (e.g. NTFS $FILE_NAME + the MFT reference). It never fabricates an entry.

fn recover_file(&mut self, ino: u64) -> FsResult<FsRecoveryResult>

Attempt to recover a deleted file by inode number.

fn timeline(&mut self) -> FsResult<Vec<FsTimelineEvent>>

Generate a forensic timeline of all filesystem events.

fn unallocated_blocks(&mut self) -> FsResult<Vec<FsBlockRange>>

Get all unallocated block ranges.

fn read_unallocated(&mut self, _range: &FsBlockRange) -> FsResult<Vec<u8>>

Read raw data from an unallocated block range.

fn journal_transactions(&mut self) -> FsResult<Vec<FsTransaction>>

List journal transactions.

fn fs_info(&self) -> FsResult<Value>

Get filesystem-specific info as JSON (superblock, volume label, etc.).

fn block_size(&self) -> u64

The block size of this filesystem.