Struct BootTimeInfo 

pub struct BootTimeInfo {
    pub best_estimate: Option<i64>,
    pub estimates: Vec<BootTimeEstimate>,
    pub inconsistent: bool,
    pub max_drift_secs: i64,
}

Aggregated boot time information from multiple sources.

Holds all collected estimates and detects inconsistencies between them (clock manipulation indicator in DFIR). The best_estimate is the first (highest-priority) source’s epoch value.

Fields

best_estimate: Option<i64>

Best estimated boot epoch (Unix seconds), if any source was available.

estimates: Vec<BootTimeEstimate>

All collected estimates for cross-validation.

inconsistent: bool

Whether sources disagree beyond the drift threshold (60s).

max_drift_secs: i64

Maximum drift between any two sources, in seconds.

Implementations

impl BootTimeInfo

pub fn from_estimates(estimates: Vec<BootTimeEstimate>) -> Self

Build from a collection of estimates.

The first estimate is treated as highest-priority (“best”). Inconsistency is flagged when any pair of estimates differs by more than 60 seconds.

pub fn absolute_secs(&self, boot_ns: u64) -> Option<i64>

Convert boot-relative nanoseconds to absolute Unix epoch seconds.

Returns None if no boot time estimate is available.

Trait Implementations

impl Clone for BootTimeInfo

fn clone(&self) -> BootTimeInfo

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BootTimeInfo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.