Enum VolatilityClass 

#[non_exhaustive]
pub enum VolatilityClass {
    Residual = 0,
    Persistent = 1,
    ActivityDriven = 2,
    RotatingBuffer = 3,
    Volatile = 4,
}

Acquisition urgency for a forensic artifact under RFC 3227 Order of Volatility.

Values run from 0 (lowest urgency / most stable) to 4 (highest urgency / most ephemeral). acquisition_order (umbrella crate) returns artifacts sorted 4→0 (most ephemeral first), matching live-response triage practice.

Choosing the right class

Class	Collect when	Rationale
Volatile	Immediately — before reboot	Only in RAM
RotatingBuffer	Before buffer fills	Fixed-size circular store
ActivityDriven	Before more user activity	Overwritten by normal use
Persistent	Standard scheduled collection	Present until explicit deletion
Residual	Last — always present on a live volume	Storage-level structure

What Residual means — and what it does NOT mean

Residual is the lowest acquisition urgency class. Use it only for artifacts that are structurally present on any live mounted volume and cannot be destroyed by normal system operation (only by reformatting, physical destruction, or deliberate forensic manipulation). The canonical example is $MFT — any mounted NTFS volume always has an MFT; it is the last artifact you need to rush to collect.

Residual does NOT mean “recoverable via .LOG1/.LOG2, VSS, or $UsnJrnl after deletion.” That property applies to virtually every NTFS artifact and provides no discrimination between classes. A registry key that could be recovered from a transaction log after deletion is Persistent while it exists — use Persistent for all live registry keys and files regardless of post-deletion recoverability.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Residual = 0

Storage-level artifact inherently present on any live mounted volume — cannot be destroyed by normal system operation. Lowest acquisition urgency: collect last. Example: $MFT (always present on NTFS), Volume Boot Record.

Not a synonym for “recoverable via VSS/.LOG1/.LOG2 after deletion” — that applies to virtually all NTFS artifacts and is not discriminating.

Persistent = 1

Present in its primary location until explicitly deleted. Default class for registry keys, configuration files, and most forensic artifacts on a live system. Examples: Run keys, NTDS.dit, event log files (the file itself, not its contents — for contents see RotatingBuffer).

ActivityDriven = 2

Overwritten by ordinary user activity; degrades with normal system use. Examples: MRU lists, Recent Documents, browser history, typed URL cache.

RotatingBuffer = 3

Overwritten when a fixed-size circular buffer fills; oldest entries lost. Examples: Windows Event Log records (when log reaches max size), Prefetch files (128-entry limit), $UsnJrnl (wraps based on configured max size).

Volatile = 4

Lost on reboot or process termination; exists only in volatile memory. Collect immediately in a live response before system shutdown. Examples: RAM contents, process handles, network connections, open file handles, the in-memory ShimCache state not yet flushed to registry.

Trait Implementations

impl Clone for VolatilityClass

fn clone(&self) -> VolatilityClass

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for VolatilityClass

impl Debug for VolatilityClass

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for VolatilityClass

impl Hash for VolatilityClass

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for VolatilityClass

fn cmp(&self, other: &VolatilityClass) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for VolatilityClass

fn eq(&self, other: &VolatilityClass) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for VolatilityClass

fn partial_cmp(&self, other: &VolatilityClass) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StructuralPartialEq for VolatilityClass