Skip to main content

render_accessed_files

Function render_accessed_files 

Source
pub fn render_accessed_files(histories: &[DeviceHistory]) -> String
Expand description

Render the opened/accessed-files report: for every device with recovered file accesses (LNK/jump-list AccessedFile claims), the files opened from it, each with its source locator. This answers “which files were touched on which stick” — the exfil view. A device with no file accesses is omitted; the whole report is empty when none were found.