forensicnomicon_core/evidence.rs
1//! Evidence strength / confidence model for forensic artifacts.
2//!
3//! [`EvidenceStrength`] is the rating type stored on
4//! [`crate::catalog::ArtifactDescriptor::evidence_strength`]. The catalog-querying
5//! helpers (`evidence_for`, `artifacts_with_strength`) live in the umbrella
6//! `forensicnomicon` crate, where the assembled global catalog is wired.
7
8/// How strongly an artifact proves a fact in isolation.
9#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
10#[non_exhaustive]
11#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
12pub enum EvidenceStrength {
13 /// Known false-positive generator; use only with strong corroboration.
14 Unreliable = 0,
15 /// Suggestive but easily explained by benign activity.
16 Circumstantial = 1,
17 /// Useful with other evidence; not standalone proof.
18 Corroborative = 2,
19 /// Strong evidence; edge-case alternative explanations exist.
20 Strong = 3,
21 /// Definitive proof of the claimed activity (e.g., Prefetch = execution occurred).
22 Definitive = 4,
23}
24
25#[cfg(test)]
26mod tests {
27 use super::*;
28
29 #[test]
30 fn strength_ordering_is_consistent() {
31 assert!(EvidenceStrength::Definitive > EvidenceStrength::Strong);
32 assert!(EvidenceStrength::Strong > EvidenceStrength::Corroborative);
33 assert!(EvidenceStrength::Corroborative > EvidenceStrength::Circumstantial);
34 assert!(EvidenceStrength::Circumstantial > EvidenceStrength::Unreliable);
35 }
36}