Crate libesedb

rust-libesedb

Safe Rust bindings to libyal/libesedb (via libesedb-sys).

use libesedb::EseDb;

let filename = std::env::args()
    .nth(1)
    .unwrap_or("Catalog1.edb".to_string());
let db = EseDb::open(filename).unwrap();
println!("Db load finished!");
let string = db.table_by_name("string").unwrap();
for rec in string.iter_records().unwrap() {
    let rec = rec.unwrap();
    let vals = rec.iter_values().unwrap().map(|v| v.unwrap_or_default().to_string()).collect::<Vec<_>>();
    println!("{}", vals.join("\t"));
}

Test Data

• https://github.com/janstarke/ntdsextract2/blob/10-include-deleted-entries-in-timeline/tests/data/ntds_plain.dit

Future Changes

• v0.3.0
  • Remove close() methods in favour of drop!()
  • Lazy-load Values (store some sort of record reference, similar to current LongValue and MultiValue internally)
  • Values come in either FlatValue, LongValue, MultiValue variants, with a defined ValueType

License and Acknowledgement

This project is made available under the LGPL-3.0-or-later.

The time crate (used in FILETIME/OLETIME conversions) is available under the MIT License.

The core functionality that this library binds to is the hard work of Joachim Metz (~joachimmetz).

Structs

Column

Instance of a ESE database column in a currently open crate::Table.

EseDb

A loaded instance of an ESE database.

LongValue

MultiValue

Record

Instance of a ESE database record in a currently open crate::Table.

Table

Instance of a ESE database table in a currently open crate::EseDb.

Enums

Value

Represents a field value from a table.

Functions

filetime_from_systemtime

oletime_from_systemtime

systemtime_from_filetime

systemtime_from_oletime