Crate forensic_vfs_resolver 

forensic-vfs-resolver

The generic layer resolver: sniff a byte source, match a registered prober, and descend container/volume/filesystem layers until a filesystem mounts.

This is the reader-independent core of detection — it touches only the forensic_vfs::Openers prober traits and the layered PathSpec/Layer model, never a concrete reader. It is deliberately split out of the forensic-vfs contract leaf so the evolving detection behavior (this crate) is firewalled from the frozen contract the fleet’s reader crates pin.

The orchestration layer (forensic-vfs-engine) wires concrete probers into a Openers, resolves a base DynSource from a path (EWF-by-path vs a raw file), and offers the by-path open/snapshot API; everything below that — the recursion, the sniff windows, walk, and the snapshot view — lives here so any tool or test can drive it openers-first.

Because open cannot be an inherent method on the leaf’s Openers from another crate (the orphan rule), it is exposed as the SourceOpen extension trait; bring it into scope and call openers.open(source, spec, 0).

Structs

Evidence

One resolved piece of evidence: its locator plus the mounted filesystem, when the resolver detected one (None for a source no registered prober recognized).

Resolved

One resolved layer stack: the mounted filesystem, its locator, and the byte source it was mounted from (plus that source’s pre-filesystem locator, the base a snapshot layer is pushed onto).

SnapshotView

One snapshot of a filesystem, viewed as a time-indexed state in the [H] cohort: the wall-clock EpochTag, the transaction id, the snapshot name, and a re-openable PathSpec locator (base ⇒ Snapshot{ApfsXid}).

WalkEntry

One node found by walk: its path components (filesystem names are bytes, not guaranteed UTF-8), its filesystem id, and its metadata.

Traits

SourceOpen

The generic layer resolver, exposed as an extension trait on the leaf’s Openers. Bring it into scope (use forensic_vfs_resolver::SourceOpen;) to call openers.open(source, spec, 0).

Functions

epoch_from_create_time

Derive an EpochTag from a snapshot create_time (nanoseconds since 1970-01-01 UTC). The big-endian nanosecond timestamp occupies the low 8 bytes (indices 24..32) of the 32-byte tag; the rest is zero. This is simple and reversible — the timestamp round-trips back out of those 8 bytes — and orders correctly: a later create_time yields a lexicographically greater tag.

snapshot_view

Build a SnapshotView under source_spec (the source’s pre-filesystem locator) from a snapshot’s transaction id, name, and create_time. Takes primitives rather than a concrete reader’s #[non_exhaustive] snapshot type so the mapping is unit-testable directly.

walk

Recursively enumerate every node of a mounted filesystem from the root — the traversal a triage consumer runs over a resolved filesystem. Depth-capped and visited-guarded against directory loops; ./.. self/parent entries are skipped. Returns the nodes; a per-node read error aborts loud.