Module linux 

Forensic anomaly analysis for the Linux freedesktop.org / XDG Trash artifact.

trash_core::linux is the reader: it parses a .trashinfo into a TrashInfo and pairs info/↔files/. This module grades a parsed record + its pairing into canonical forensicnomicon::report::Findings.

Code	Category	Severity	Meaning
TRASH-CONTENT-PURGED	Residue	Medium	info/<name>.trashinfo survives but files/<name> is gone
TRASH-PATH-TRAVERSAL	Concealment	High	the stored Path= escapes its directory via .. (spec-forbidden)
TRASH-DELETION-TIME-MISSING	Integrity	Medium	DeletionDate= was absent or unparseable

Findings are observations, never legal conclusions: the analyst concludes.

Enums

TrashAnomaly

An XDG-trash anomaly, with the offending evidence attached.

Functions

audit_entry

Audit a parsed .trashinfo record together with its info/↔files/ pairing, returning a canonical Finding for each anomaly detected.