forensic_vfs/
volume.rs

1//! [`VolumeSystem`] — a partitioning/volume scheme over one [`crate::ImageSource`].
2//!
3//! MBR/GPT/APM partitions and snapshot store-sets (VSS, APFS container) are all
4//! volume systems: `volumes()` are partitions *or* stores/snapshots — the
5//! libvshadow `volume → store[]` model — not special cases bolted onto a
6//! filesystem. `open_volume` returns a read-only [`DynSource`] a normal
7//! [`crate::fs::FileSystem`] mounts unchanged.
8
9use crate::error::VfsResult;
10use crate::source::DynSource;
11
12/// The partitioning/volume scheme.
13#[non_exhaustive]
14#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
15pub enum VolumeScheme {
16    Mbr,
17    Gpt,
18    Apm,
19    Vss,
20    ApfsContainer,
21    Lvm,
22}
23
24/// What one volume is.
25#[non_exhaustive]
26#[derive(Debug, Clone, Copy, PartialEq, Eq)]
27pub enum VolumeKind {
28    Partition,
29    ShadowStore,
30    Snapshot,
31    Unallocated,
32}
33
34/// A description of one volume within a scheme, in the parent's address space.
35#[derive(Debug, Clone, PartialEq, Eq)]
36pub struct VolumeDesc {
37    pub index: usize,
38    pub kind: VolumeKind,
39    pub start: u64,
40    pub len: u64,
41    /// GUID / type name / label hint.
42    pub type_hint: Option<String>,
43    pub label: Option<String>,
44}
45
46/// A partitioning/volume scheme over one [`crate::ImageSource`]. `&self` throughout.
47pub trait VolumeSystem: Send + Sync {
48    fn scheme(&self) -> VolumeScheme;
49    /// The volumes/stores this scheme exposes.
50    fn volumes(&self) -> &[VolumeDesc];
51    /// A read-only byte source for one volume (a sub-range of the parent, or a
52    /// snapshot-materialized source).
53    fn open_volume(&self, index: usize) -> VfsResult<DynSource>;
54
55    /// Findings raised while parsing the volume table. Behind the `findings`
56    /// feature so a bare reader does not inherit forensicnomicon.
57    #[cfg(feature = "findings")]
58    fn findings(&self) -> VfsResult<Vec<forensicnomicon::report::Finding>> {
59        Ok(Vec::new())
60    }
61}
forensic_vfs/volume.rs

forensic_vfs/
volume.rs
