Skip to main content

Module tmpfs_recovery

Module tmpfs_recovery 

Source
Expand description

Tmpfs/ramfs inode enumeration for ephemeral file recovery.

Walks the kernel super_blocks list to find all tmpfs/ramfs superblocks, then enumerates their in-memory inodes via s_inodes (i_sb_list). Executable or hidden files are flagged as suspicious.

Re-exports§

pub use crate::heuristics::classify_tmpfs_file;

Structs§

TmpfsFileInfo
Information about a file found in an in-memory tmpfs/ramfs filesystem.

Functions§

walk_tmpfs_files
Walk all tmpfs/ramfs inodes across all superblocks in memory.