Crate forensic_vfs_engine 

forensic-vfs-engine

The openers registry + resolver over the forensic-vfs contracts: one Vfs::open that detects the container/volume/filesystem stack of a piece of evidence and mounts a read-only dyn FileSystem. This is the ORCHESTRATION crate — the one place that depends down on every fleet reader.

Structs

Evidence

One resolved piece of evidence: its locator plus the mounted filesystem, when the engine detected one (None for a source no registered prober recognized).

SnapshotView

One snapshot of an APFS volume, viewed as a time-indexed state in the [H] cohort: the wall-clock EpochTag, the APFS transaction id, the snapshot name, and a re-openable PathSpec locator (base ⇒ Snapshot{ApfsXid}).

Vfs

The engine handle: the reader openers plus the resolver.

WalkEntry

One node found by walk: its path components (filesystem names are bytes, not guaranteed UTF-8), its filesystem id, and its metadata.

Functions

default_openers

The fleet reader openers: filesystem probers + volume-system probers + container decoders + the archive (ArchiveOpen) and encryption (EncryptionOpen) layers. BitLocker / LUKS / FileVault / VeraCrypt register as signature probers; the readers themselves do the decryption.

walk

Recursively enumerate every node of a mounted filesystem from the root — the traversal a triage consumer runs over Vfs::open(...).fs. Depth-capped and visited-guarded against directory loops; ./.. self/parent entries are skipped. Returns the nodes; a per-node read error aborts loud.