forensicnomicon_core/
file_id.rs

1//! Filesystem-object identity — the stable name each filesystem gives one node.
2//!
3//! Relocated here from `forensic-vfs` per ADR 0009 (the `FsKind` keystone
4//! precedent): [`FileId`] is pure, format-defined identity *structure* — how each
5//! filesystem names an object — which is KNOWLEDGE, not VFS machinery. Keeping it
6//! beside [`FsKind`](crate::filesystems::FsKind) lets every fleet crate depend
7//! **down** onto the zero-dep leaf: `forensic-vfs` re-exports it unchanged (so
8//! `forensic_vfs::FileId` keeps working), and `state-history-forensic` reuses it
9//! verbatim as a component of the `[P]` evidential-address key rather than
10//! mirroring a partial copy.
11//!
12//! The address domain matches each filesystem's real identity primitive, so a
13//! reused slot is never confused with the original: the second field on each
14//! slotted variant (`seq`/`gen`/`xid`/`index`) is the slot-reuse discriminator.
15
16/// Filesystem-specific stable identity. The address domain matches each FS's real
17/// identity primitive, so a reused slot is never confused with the original.
18#[non_exhaustive]
19#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
20pub enum FileId {
21    /// NTFS MFT reference: record number + sequence.
22    NtfsRef { entry: u64, seq: u16 },
23    /// ext2/3/4 inode + generation.
24    ExtInode { ino: u64, gen: u32 },
25    /// APFS object id + transaction id.
26    ApfsOid { oid: u64, xid: u64 },
27    /// FAT/exFAT physical directory-entry address (no stable inode).
28    FatDirEntry { cluster: u32, index: u16 },
29    /// ISO 9660 path-table / extent address.
30    IsoExtent { block: u32 },
31    /// A filesystem with a plain inode and nothing finer.
32    Opaque(u64),
33}
forensicnomicon_core/file_id.rs

forensicnomicon_core/
file_id.rs
