Struct TimestompIndicators 

pub struct TimestompIndicators {
    pub si_created_before_fn: bool,
    pub created_mismatch: bool,
    pub si_whole_second: bool,
}

Indicators that a file’s $STANDARD_INFORMATION timestamps were forged.

$FN timestamps are harder to forge than $SI, so divergence between the two — or $SI times landing on a whole second — is suspicious.

Fields

si_created_before_fn: bool

$SI creation time predates $FN creation time.

created_mismatch: bool

$SI creation time differs from $FN creation time.

si_whole_second: bool

One or more $SI timestamps fall exactly on a whole second (no sub-second precision — a common timestomp artifact).

Implementations

impl TimestompIndicators

pub fn is_suspicious(&self) -> bool

true if any strong indicator fired.

Trait Implementations

impl Clone for TimestompIndicators

fn clone(&self) -> TimestompIndicators

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for TimestompIndicators

impl Debug for TimestompIndicators

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TimestompIndicators

fn default() -> TimestompIndicators

Returns the “default value” for a type.

impl Eq for TimestompIndicators

impl PartialEq for TimestompIndicators

fn eq(&self, other: &TimestompIndicators) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for TimestompIndicators