srum_core/
push_notification.rs

1//! Push notification record — app notification activity per interval.
2//!
3//! Source table: `{D10CA2FE-6FCF-4F6D-848E-B2E99266FA89}` in SRUDB.dat.
4
5use chrono::{DateTime, Utc};
6use serde::{Deserialize, Serialize};
7
8/// One SRUM push notification record: app notification delivery per interval.
9///
10/// Forensic value: proves app engagement at specific timestamps even without
11/// foreground CPU cycles — a communication app receiving C2 instructions shows
12/// here before the user interacts.
13#[derive(Debug, Clone, Serialize, Deserialize)]
14pub struct PushNotificationRecord {
15    /// Integer ID of the application (look up in [`crate::IdMapEntry`]).
16    pub app_id: i32,
17    /// Integer ID of the user account (look up in [`crate::IdMapEntry`]).
18    pub user_id: i32,
19    /// UTC timestamp of the measurement interval start.
20    pub timestamp: DateTime<Utc>,
21    /// Notification category (0=toast, 1=badge, 2=tile, 3=raw).
22    pub notification_type: u32,
23    /// Number of notifications delivered in this interval.
24    pub count: u32,
25    /// Foreground CPU cycle time from real ESE `ForegroundCycleTime` column.
26    /// Zero when decoded from the synthetic fixture format.
27    pub foreground_cycle_time: u64,
28    /// Background CPU cycle time from real ESE `BackgroundCycleTime` column.
29    /// Zero when decoded from the synthetic fixture format.
30    pub background_cycle_time: u64,
31}
srum_core/push_notification.rs

srum_core/
push_notification.rs
