forensicnomicon_core/lib.rs
1#![cfg_attr(
2 test,
3 allow(clippy::unwrap_used, clippy::expect_used, clippy::float_cmp)
4)]
5//! # forensicnomicon-core
6//!
7//! Stable engine layer of the ForensicNomicon. Houses the slow-moving pieces that
8//! downstream analyzers and readers depend on, kept apart from the fast-moving
9//! detection knowledge (the ~6.5k artifact descriptors) in the umbrella
10//! `forensicnomicon` crate:
11//!
12//! - [`report`] — the normalized cross-scheme DFIR finding vocabulary
13//! (`Finding`/`Severity`/`Observation`) that every `*-forensic` analyzer emits.
14//! - [`catalog`] — the descriptor `types`, the [`catalog::ForensicCatalog`] lookup
15//! engine and its query methods, container/record parsing profiles, and the
16//! in-core decoders. It carries **no** artifact data; the umbrella crate wires
17//! the assembled dataset into a global `CATALOG` via `ForensicCatalog::new`.
18//! - [`evidence::EvidenceStrength`] and [`volatility::VolatilityClass`] — the
19//! rating types stored on each descriptor (the catalog-querying helpers live in
20//! the umbrella crate, where the global catalog is wired).
21//! - Structural format constants readers depend on: [`decmpfs`], [`filesystems`],
22//! [`partition_schemes`], [`partition_types`].
23//!
24//! These carry no dependency on the assembled detection catalog, so a knowledge
25//! change never forces a republish of crates that only need this engine. The
26//! umbrella `forensicnomicon` crate re-exports everything here, so existing imports
27//! such as `forensicnomicon::report::Finding` or `forensicnomicon::catalog::CATALOG`
28//! continue to resolve unchanged.
29
30pub mod catalog;
31pub mod decmpfs;
32pub mod evidence;
33pub mod file_id;
34pub mod filesystems;
35pub mod partition_schemes;
36pub mod partition_types;
37pub mod report;
38pub mod volatility;
39pub mod volume_encryption;
40pub mod volume_serial;
41
42/// Filesystem-object identity, re-exported at the crate root so consumers write
43/// `forensicnomicon_core::FileId` (ADR 0009). `forensic-vfs` re-exports this in
44/// turn, keeping every existing `forensic_vfs::FileId` import working unchanged.
45pub use file_id::FileId;