Enum ArtifactContainer 

#[non_exhaustive]
pub enum ArtifactContainer {
    SystemHive,
    SetupApiLog,
    EventLog,
    LnkFile,
    KernelLog,
    SoftwareHive,
    UserHive,
    DeviceMedia,
    MacosPlist,
}

The physical storage container an artifact lives in — the tamper surface.

Corroboration counts independent sources, and independence is a property of the container, not the recording mechanism: two sources in the same container share one tamper surface, so their agreement is not tamper-independent. Distinct from SourceKind, which is the recording mechanism (guards against parse error and coincidence, a weaker form of independence).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

SystemHive

The SYSTEM registry hive (USBSTOR, MountedDevices, …).

SetupApiLog

The setupapi.dev.log text log.

EventLog

A Windows event log (.evtx).

LnkFile

A Shell Link file (.lnk) or jump list on the filesystem.

KernelLog

A Linux kernel log file (syslog / dmesg).

SoftwareHive

The SOFTWARE registry hive (VolumeInfoCache, WPD, …) — a file distinct from the SYSTEM hive, so a separate tamper surface.

UserHive

A per-user NTUSER.DAT hive (MountPoints2, …) — a distinct per-user tamper surface.

DeviceMedia

The physical device’s own media (MBR/VBR boot sectors) — the strongest surface.

MacosPlist

A macOS preferences/property-list artifact (com.apple.iPod.plist, …).

Trait Implementations

impl Clone for ArtifactContainer

fn clone(&self) -> ArtifactContainer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ArtifactContainer

impl Debug for ArtifactContainer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ArtifactContainer

impl Hash for ArtifactContainer

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for ArtifactContainer

fn cmp(&self, other: &ArtifactContainer) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for ArtifactContainer

fn eq(&self, other: &ArtifactContainer) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for ArtifactContainer

fn partial_cmp(&self, other: &ArtifactContainer) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for ArtifactContainer

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ArtifactContainer