Enum SourceKind 

#[non_exhaustive]
pub enum SourceKind {
    ShellHistory,
    PeripheralDevice,
    Srum,
    Registry,
    LnkFile,
    JumpList,
    BiomeMenuItem,
}

Which reader the activity was normalized from.

Extensible: marked #[non_exhaustive] so adding a variant is non-breaking; consumers must use a _ arm when matching.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

ShellHistory

shellhist-core — shell command history.

PeripheralDevice

peripheral-core — external-device connections.

Srum

srum-core / srum-parser — per-user app execution and network bytes, attributed to a user SID (the first by-SID source).

Registry

winreg-artifacts — registry per-user artifacts (UserAssist, TypedURLs, ShellBags).

LnkFile

lnk-core — Windows Shell Link (.lnk) targets, carrying the volume serial that completes the device join.

JumpList

lnk-core Jump Lists (*.automaticDestinations-ms / *.customDestinations-ms) — per-application recent/pinned items, with the DestList MRU last-access time and origin host.

BiomeMenuItem

segb-core — Apple Biome App.MenuItem records (macOS Tahoe 26+).

Each record captures a menu-bar item selection: the application name and the exact text of the item chosen. Stored in SEGB container files under ~/Library/Biome/streams/restricted/App.MenuItem/local.

Validation caveat: the protobuf field numbers in segb-core are inferred from published research; validation against a real macOS Tahoe 26 sample is pending. See segb-core/docs/validation.md.

Trait Implementations

impl Clone for SourceKind

fn clone(&self) -> SourceKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for SourceKind

impl Debug for SourceKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SourceKind

impl Hash for SourceKind

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for SourceKind

fn eq(&self, other: &SourceKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for SourceKind