Module catalog 

Forensic artifact catalog — assembled dataset + global CATALOG.

The catalog engine (descriptor types, the ForensicCatalog lookup engine and its query methods, container/record parsing profiles, and in-core decoders) lives in the forensicnomicon-core crate. This module owns the fast-moving data — the ~6.5k assembled artifact descriptors — and wires them into the compile-time global CATALOG.

The whole engine surface is re-exported here, so existing forensicnomicon::catalog::* (and crate-internal crate::catalog::*) paths — including the types submodule the generated descriptors reference — resolve exactly as they did before the engine/data split.

Curated source corpus

Artifact additions are researched from a maintained DFIR source corpus under archive/sources/ (catalog-directories.json, manual-sources.json, dfir-feeds.opml, source-inventory.json). Prefer primary/vendor documentation and well-cited practitioner research; each ArtifactDescriptor::sources entry should still point to the specific authoritative references that justify the artifact.

Modules

types

All public enums and structs for the forensic artifact catalog.

Structs

ArtifactDescriptor

A single entry in the forensic artifact catalog. Fully const-constructible so it can live in a static.

ArtifactParsingProfile

Parsing guidance for artifacts whose interpretation requires more than a flat decoder or field schema.

ArtifactQuery

Filter parameters for querying the catalog. All fields are optional – None means “match any”.

ArtifactRecord

A fully decoded forensic artifact record. This is the universal output type that all consumers receive – no raw bytes, no hardcoded field names.

BinaryField

One field inside a fixed-layout binary record (e.g. the 72-byte UserAssist value). Fully const-constructible.

ContainerProfile

How to acquire and enumerate the outer container that holds one or more forensic artifacts.

ContainerSignature

How to recognize or carve a container format from raw bytes.

FieldSchema

Describes one field in a decoded artifact record – purely metadata, no data.

ForensicCatalog

A queryable collection of ArtifactDescriptors with built-in decode logic.

PlatformMask

Bitmask of selected Platform values.

RecordSignature

How to recognize or validate individual records or payloads inside a container, including carved fragments.

Enums

ArtifactLocation

The kind of forensic artifact location.

ArtifactValue

A decoded value produced by the catalog’s decode logic. Uses only std types.

BinaryFieldType

Primitive type of a field inside a fixed-layout binary record.

DataScope

Whether the artifact is per-user, system-wide, or mixed.

DecodeError

Errors that can occur during artifact decoding.

Decoder

Describes how to decode raw bytes (and/or a registry value name) into structured fields.

HiveTarget

Which Windows registry hive an artifact lives in.

OsScope

Minimum OS version / platform required for the artifact to exist.

Platform

High-level platform group — used for multi-select filtering.

TriagePriority

Triage collection priority for this artifact during live incident response.

ValueType

The semantic type of a decoded output field value.

Statics

CATALOG

The global forensic artifact catalog containing all known artifact descriptors.

Functions

all_container_profiles

Returns all container-layer parsing profiles maintained by the catalog.

all_container_signatures

Returns all container carving/signature profiles maintained by the catalog.

all_parsing_profiles

Returns all parser knowledge profiles maintained by the catalog.

all_record_signatures

Returns all record signatures maintained by the catalog.

container_profile

Returns the container profile by id.

container_profile_for_artifact

Returns the outer-container parsing profile for a catalog artifact id.

container_signature

Returns the container signature by container id.

container_signature_for_artifact

Returns the outer-container carving/signature guidance for a catalog artifact id.

parsing_profile

Returns parsing guidance for a catalog artifact id.

record_signatures_for_artifact

Returns record signatures associated with a catalog artifact id.

record_signatures_for_container

Returns record signatures associated with a container id.