Module engine_fs 

The disk-image ForensicFs backend: an adapter over the forensic-vfs engine’s read-only FileSystem contract.

The FUSE/Dokan mount layer speaks 4n6mount’s own u64-inode ForensicFs vocabulary; the engine speaks forensic_vfs::FileId (a per-filesystem identity enum) and streams owned iterators. EngineFs bridges the two: it keeps a bidirectional FileId <-> u64 map (a dense allocator, so the huge inode space collapses to small FUSE inodes) and converts FsMeta into the mount layer’s FsMetadata.

Some forensic surfaces of the old backends have no equivalent on the engine’s inode-addressed FileSystem trait — deleted-file recovery, event timelines, and journal transactions. Those degrade loud (an explicit NotSupported error, never a fabricated success); see each gate’s TODO(engine).

Structs

EngineFs

A disk-image filesystem mounted through the engine.

MultiPartitionFs

The ADR-0010 volume multiplexer: it surfaces each volume of a disk image as a <volume>/ subdirectory under a synthetic root (_partition<N>, a wired label, or root for a bare unpartitioned filesystem — see volume_dir_name, private), so an analyst reaches every filesystem (e.g. both the FAT EFI System Partition and the NTFS Windows volume of a GPT disk) rather than only the first the engine finds, at a constant <mount>/<volume>/… depth even for a single-filesystem image.

Functions

open_image

Open a disk-image evidence file as a mountable ForensicFs.

open_image_all

Open a disk-image evidence file into the ADR-0010 unified mount layout: <mount>/<volume>/<fs tree> at constant depth, so a consumer walks the same shape whether the image holds one filesystem or many.