Enum TimelineOutputFormat 

#[non_exhaustive]
pub enum TimelineOutputFormat {
    Bodyfile,
    PlasoStore,
    L2tCsv,
    MacTimeCsv,
    DynamicCsv,
    StoreReport,
    ExtractedFiles,
}

Output format produced by a timeline tool.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Bodyfile

Pipe-delimited bodyfile (MD5|name|inode|…|crtime).

PlasoStore

Plaso binary store (.plaso); post-process with psort.py.

L2tCsv

L2T CSV — legacy/deprecated in Plaso (second-only timestamps, fixed 17 fields); superseded by the ‘dynamic’ module. Readable by Timeline Explorer.

MacTimeCsv

CSV output from mactime.

DynamicCsv

Plaso “dynamic” CSV — the psort/psteal default module, with customizable columns (written directly by psteal.py -o dynamic -w timeline.csv).

StoreReport

Textual metadata report about a .plaso store (event counts, time range, parsers, warnings) written to stdout by pinfo.py; not a timeline.

ExtractedFiles

Files carved out of a storage-media image to an output directory by image_export.py (with a hashes.json manifest); targeted collection, not a timeline.

Trait Implementations

impl Clone for TimelineOutputFormat

fn clone(&self) -> TimelineOutputFormat

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for TimelineOutputFormat

impl Debug for TimelineOutputFormat

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for TimelineOutputFormat

impl PartialEq for TimelineOutputFormat

fn eq(&self, other: &TimelineOutputFormat) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TimelineOutputFormat