Module linux 

Read-only reader for the Linux freedesktop.org / XDG Trash artifact.

When a file is trashed on a freedesktop.org desktop (GNOME, KDE, XFCE, …) the implementation moves the bytes into a trash directory’s files/ subdirectory and writes a sibling info/<name>.trashinfo metadata file recording where the file came from and when it was deleted.

A trash directory therefore holds two sibling subdirectories:

• info/ — one <name>.trashinfo INI file per trashed item, and
• files/ — the trashed bytes (a file or a directory), named <name>.

The pairing is info/<name>.trashinfo ⇄ files/<name>, where <name> is identical minus the .trashinfo extension. Per the spec the content name is derived from the trashinfo name and never from any path stored inside the file. This crate parses the .trashinfo metadata and pairs the two subdirectories; it produces no findings — the trash-forensic analyzer layers anomaly detection on top.

.trashinfo format

Per the freedesktop.org Trash Specification v1.0 (2014-01-02, https://specifications.freedesktop.org/trash/latest/) the file is a .desktop-like INI:

[Trash Info]
Path=foo/bar/meow.bow-wow
DeletionDate=20040831T22:32:08

• The first line is the group header [Trash Info].
• Path= holds the original location, percent-encoded per RFC 2396 section 2 (https://www.rfc-editor.org/rfc/rfc2396#section-2). This is URI escaping, not form encoding: + is a literal plus, not a space.
• DeletionDate= holds the deletion time as YYYY-MM-DDThh:mm:ss. The spec’s own example uses the basic form 20040831T22:32:08; real writers emit the extended form 2024-01-15T13:45:09. Both are accepted. The value carries no timezone — it is naive local time, so it is decoded into a NaiveDateTime and must never be treated as UTC.
• If Path= or DeletionDate= appears more than once, the first occurrence wins (spec footnote [8]).

Structs

TrashEntry

A trashed item discovered by scanning a trash directory: its info/ metadata file paired with its files/ content (if the content is still present).

TrashInfo

Decoded metadata from a single .trashinfo file.

Enums

TrashInfoError

Errors returned while parsing a .trashinfo file.

Functions

parse_trashinfo

Parse the raw bytes of a .trashinfo file.

scan_trash

Scan a trash directory (the parent of info/ and files/) and pair every info/<name>.trashinfo with its files/<name> content.