Struct ForensicCatalog 

pub struct ForensicCatalog { /* private fields */ }

A queryable collection of ArtifactDescriptors with built-in decode logic.

Implementations

impl ForensicCatalog

pub const fn new(entries: &'static [ArtifactDescriptor]) -> ForensicCatalog

Create a new catalog from a static slice of descriptors.

pub fn list(&self) -> &[ArtifactDescriptor]

Return all descriptors in the catalog.

pub fn by_id(&self, id: &str) -> Option<&ArtifactDescriptor>

Look up a descriptor by its id field.

pub fn filter(&self, query: &ArtifactQuery) -> Vec<&ArtifactDescriptor>

Return all descriptors matching the given query. Every Some field in the query must match; None fields are wildcards.

pub fn by_mitre(&self, technique: &str) -> Vec<&ArtifactDescriptor>

Return all descriptors associated with the given MITRE ATT&CK technique ID.

pub fn for_triage(&self) -> Vec<&ArtifactDescriptor>

Return all descriptors sorted by triage priority descending (Critical first). Within the same priority, original catalog order is preserved.

pub fn unassessed(&self) -> Vec<&ArtifactDescriptor>

Return all descriptors that have not yet received an evidence/volatility assessment, sorted by triage priority descending.

Use this to drive demand-prioritised assessment sweeps: unassessed().first() is always the highest-impact unassessed artifact.

pub fn assessment_coverage(&self) -> (usize, usize)

Return (assessed_count, total_count) for coverage reporting.

pub fn filter_by_keyword(&self, keyword: &str) -> Vec<&ArtifactDescriptor>

Return all descriptors whose meaning or name contains keyword (case-insensitive).

impl ForensicCatalog

pub fn parsing_profile( &self, id: &str, ) -> Option<&'static ArtifactParsingProfile>

Look up parsing guidance for an artifact id.

pub fn container_profile(&self, id: &str) -> Option<&'static ContainerProfile>

Look up the container parsing layer for an artifact id.

pub fn container_signature( &self, id: &str, ) -> Option<&'static ContainerSignature>

Look up carving/recognition guidance for an artifact’s outer container.

pub fn record_signatures(&self, id: &str) -> Vec<&'static RecordSignature>

Look up carving/recognition guidance for records associated with an artifact.

pub fn decode( &self, descriptor: &ArtifactDescriptor, name: &str, raw: &[u8], ) -> Result<ArtifactRecord, DecodeError>

Decode raw data using the descriptor’s embedded decoder.

Parameters

• descriptor – the catalog entry describing the artifact
• name – the registry value name (or filename), used by ROT13 and PipeDelimited decoders
• raw – the raw byte payload of the registry value or file content