Struct Prefetch

pub struct Prefetch { /* private fields */ }

A Prefetch file reader and parser.

Basic Example

use libprefetch::Prefetch;


let file = std::fs::File::open("assets/WUAUCLT.EXE-399A8E72.pf").unwrap();

let prefetch = Prefetch::new(file).unwrap();

// Or with a path

let prefetch =
     Prefetch::from_path("assets/WUAUCLT.EXE-399A8E72.pf").unwrap();

Implementations

impl Prefetch

pub fn version(&self) -> FormatVersion

Returns the version of the Prefetch file.

pub fn size(&self) -> usize

Returns the size of the Prefetch file.

pub fn name(&self) -> &str

Returns the name of the executable.

pub fn hash(&self) -> u32

Returns the prefetch hash of the executable.

pub fn last_execution_time(&self) -> u64

Returns the last execution time, in FILETIME format

pub fn execution_counter(&self) -> usize

Returns the execution counter (how many times the exe was run).

pub fn metrics(&self) -> Result<MetricIterator<'_>, Error>

Returns an Iterator for file metrics.

Example

use libprefetch::Prefetch;

let prefetch =
    Prefetch::from_path("assets/WUAUCLT.EXE-399A8E72.pf").unwrap();

// Iterate over metrics
for metric in prefetch.metrics().unwrap() {
    println!("Loaded file by the exe: {}", metric.filename());
}

pub fn trace(&self) -> Result<TraceIterator<'_>, Error>

Returns an Iterator for the trace chains.

Example

use libprefetch::Prefetch;

let prefetch =
    Prefetch::from_path("assets/WUAUCLT.EXE-399A8E72.pf").unwrap();

// Iterate over the chain
for item in prefetch.trace().unwrap() {
    println!("Trace #{}, bytes loaded:: {}", item.id(), item.load_count());
}

pub fn volumes(&self) -> Result<VolumeIterator<'_>, Error>

Returns an Iterator for the volumes.

Example

use libprefetch::Prefetch;

let prefetch =
    Prefetch::from_path("assets/WUAUCLT.EXE-399A8E72.pf").unwrap();

// Iterates over the volumes
println!(" ===== Volumes ===== ");
for volume in prefetch.volumes().unwrap() {
  println!("Volume #{}:", volume.id());
  println!("    Path: {}", volume.device_path());
  println!("    Creation time: {}", volume.creation_time());
  println!("    Serial number: {}", volume.serial_number());
  println!("    Directories: ");
  for directory in volume.directories().unwrap() {
    println!("        {}", directory);
  }
}

pub fn new<T>(src: T) -> Result<Prefetch, Error>

where T: Read,

Constructs a new Prefetch from a std::io::Read source.

Example

use libprefetch::Prefetch;

let file = std::fs::File::open("assets/WUAUCLT.EXE-399A8E72.pf").unwrap();

let prefetch = Prefetch::new(file).unwrap();

pub fn from_path(path: &str) -> Result<Prefetch, Error>

Constructs a new Prefetch from a file path.

Example

use libprefetch::Prefetch;

let prefetch
     = Prefetch::from_path("assets/WUAUCLT.EXE-399A8E72.pf").unwrap();