Enum AnomalyKind 

pub enum AnomalyKind {
    Timestomp {
        record: u64,
        signal: &'static str,
    },
    AlternateDataStream {
        record: u64,
        stream: String,
    },
    DeletedRecord {
        record: u64,
    },
    RecordSlackResidue {
        record: u64,
        residue_len: usize,
    },
}

Classification of an NTFS forensic anomaly. Each variant carries the MFT record it was observed in plus the evidence to reproduce it.

Variants

Timestomp

$STANDARD_INFORMATION timestamps show forgery tells relative to the harder-to-forge $FILE_NAME times (or land on whole seconds).

Fields

record: u64

MFT record number.

signal: &'static str

The specific tell that fired.

AlternateDataStream

A named $DATA attribute — an alternate data stream, a common place to carry hidden payloads (also used benignly, e.g. Zone.Identifier).

Fields

record: u64

MFT record number.

stream: String

The stream name.

DeletedRecord

The MFT record is not in use — a recoverable deleted file.

Fields

record: u64

MFT record number.

RecordSlackResidue

Non-zero residue in the record’s slack (past used_size).

Fields

record: u64

MFT record number.

residue_len: usize

Count of non-zero bytes in the slack.

Implementations

impl AnomalyKind

pub fn record(&self) -> u64

The MFT record this anomaly was observed in.

pub fn severity(&self) -> Severity

Severity — the single source of truth for this kind.

pub fn code(&self) -> &'static str

Stable machine-readable code.

pub fn note(&self) -> String

Human-readable, “consistent with” note.

Trait Implementations

impl Clone for AnomalyKind

fn clone(&self) -> AnomalyKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AnomalyKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AnomalyKind

impl PartialEq for AnomalyKind

fn eq(&self, other: &AnomalyKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for AnomalyKind