Crate trash_forensic 

Forensic anomaly analysis for trash / deleted-file artifacts, layered on the trash_core readers. Each platform’s analyzer lives in its own module, gated behind a same-named Cargo feature (all enabled by default):

Module	Feature	Scheme	Artifact
windows	windows	RECYCLEBIN-*	Recycle Bin $I/$R
linux	linux	TRASH-*	freedesktop.org / XDG .trashinfo

Every analyzer inspects a parsed reader record + its pairing and reports anomalies as canonical forensicnomicon::report::Findings, so trash findings aggregate alongside every other SecurityRonin analyzer. Findings are observations, never legal conclusions: the analyst concludes.

use trash_core::{parse_index, scan_pairs};
use trash_forensic::audit_pair;
for pair in scan_pairs(dir)? {
    let bytes = std::fs::read(&pair.index_path)?;
    if let Ok(index) = parse_index(&bytes) {
        for finding in audit_pair(&index, &pair) {
            println!("[{:?}] {} — {}", finding.severity, finding.code, finding.note);
        }
    }
}

Re-exports

pub use windows::audit_pair;

pub use windows::AnomalyKind;

pub use linux::audit_entry;

pub use linux::TrashAnomaly;

pub use macos::audit_put_back;

pub use macos::DsStoreAnomaly;

pub use android::audit_trashed_name;

pub use android::TrashedNameAnomaly;

pub use ios::audit_trashed_asset;

pub use ios::IosAssetAnomaly;

Modules

android

Forensic anomaly analysis for Android MediaStore .trashed-/.pending- filenames decoded by trash_core::android.

ios

Forensic anomaly analysis for iOS Photos “Recently Deleted” assets recovered by trash_core::ios from Photos.sqlite.

linux

Forensic anomaly analysis for the Linux freedesktop.org / XDG Trash artifact.

macos

Forensic anomaly analysis for the macOS Trash put-back metadata recovered by trash_core::macos from a Trash folder’s .DS_Store.

windows

Forensic anomaly analysis for Windows Recycle Bin $I/$R artifacts.

Constants

ANALYZER

Analyzer name, recorded on every finding’s forensicnomicon::report::Source for reproducibility, shared across the per-OS analyzers.