Enum SourceKind 

#[non_exhaustive]
pub enum SourceKind {
    Usbstor,
    MountedDevices,
    SetupApi,
    PartitionDiag,
    KernelPnp,
    Lnk,
    JumpList,
    LinuxKernelLog,
    VolumeInfoCache,
    MountPoints2,
    EmdMgmt,
    DeviceImage,
    AppleIPod,
    MacosUsb,
    MacosUnifiedLog,
}

Which artifact a claim was extracted from.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Usbstor

SYSTEM\...\Enum\{USBSTOR,SCSI,USB} — device instance keys and their install / first-install / last-arrival / last-removal property FILETIMEs.

MountedDevices

SYSTEM\MountedDevices — drive-letter ↔ device mapping.

SetupApi

setupapi.dev.log — first device-install time.

PartitionDiag

Microsoft-Windows-Partition/Diagnostic event log — volume serials.

KernelPnp

Microsoft-Windows-Kernel-PnP/Configuration event log — USB device-configuration events (a connection witness keyed by the device instance serial).

Lnk

A Windows Shell Link (.lnk) — the volume-serial file join.

JumpList

A Windows Jump List (*.automaticDestinations-ms / *.customDestinations-ms).

LinuxKernelLog

A Linux kernel log (syslog / dmesg) — USB enumeration events.

VolumeInfoCache

SOFTWARE\...\Windows Search\VolumeInfoCache — cached volume labels per drive.

MountPoints2

NTUSER\...\Explorer\MountPoints2 — per-user volume mounts (by volume GUID).

EmdMgmt

SOFTWARE\...\EMDMgmt — the ReadyBoost cache: volume label + serial history.

DeviceImage

A raw disk image of a physical device — its MBR/VBR boot sectors.

AppleIPod

macOS com.apple.iPod.plist — Apple-device (iPhone/iPad/iPod) connection history.

MacosUsb

macOS system_profiler / IORegistry — the live USB device tree.

MacosUnifiedLog

macOS unified log — USB enumeration (connect) events with times.

Implementations

impl SourceKind

pub const fn container(self) -> ArtifactContainer

The storage container this source lives in — its tamper surface. Total.

pub fn clock_is_local(self) -> bool

Whether this source records timestamps in host-local time (rather than UTC).

setupapi.dev.log and Linux kernel logs write local wall-clock with no zone, so their readers convert them naively (local-as-UTC). Registry FILETIME, event-log FILETIME, and LNK/jump-list epochs are true UTC. normalize_local_clocks uses this to correct local timestamps to UTC given the host’s offset.

Trait Implementations

impl Clone for SourceKind

fn clone(&self) -> SourceKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SourceKind

impl Debug for SourceKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SourceKind

impl Hash for SourceKind

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for SourceKind

fn cmp(&self, other: &SourceKind) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for SourceKind

fn eq(&self, other: &SourceKind) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for SourceKind

fn partial_cmp(&self, other: &SourceKind) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for SourceKind

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SourceKind