pub struct RegistrySource<'a> { /* private fields */ }Expand description
A RegistrySource wraps borrowed per-user registry artifacts decoded by
winreg-artifacts from an NTUSER.DAT / USRCLASS.DAT hive.
It normalizes the three published per-user artifacts:
UserAssist → Action::Executed,
TypedURLs → Action::Typed, and
ShellBags → Action::Accessed (folder).
winreg-artifacts v0.1 publishes exactly these three per-user decoders; it has
no separate RecentDocs / RunMRU / MountPoints2 / TypedPaths modules, so the
adapter maps the artifacts that actually exist.
Implementations§
Source§impl<'a> RegistrySource<'a>
impl<'a> RegistrySource<'a>
Sourcepub fn new(
userassist: &'a [UserAssistEntry],
typed_urls: &'a [TypedUrl],
shellbags: &'a [ShellbagEntry],
actor: Option<&str>,
) -> Self
pub fn new( userassist: &'a [UserAssistEntry], typed_urls: &'a [TypedUrl], shellbags: &'a [ShellbagEntry], actor: Option<&str>, ) -> Self
Wrap decoded registry artifacts, attributing them to a user when known (the
hive owner — the SID/account the NTUSER.DAT belongs to).
Trait Implementations§
Source§impl ActivitySource for RegistrySource<'_>
impl ActivitySource for RegistrySource<'_>
Source§fn activities(&self) -> Vec<UserActivity>
fn activities(&self) -> Vec<UserActivity>
The activities this source contributes to the timeline.
Auto Trait Implementations§
impl<'a> Freeze for RegistrySource<'a>
impl<'a> RefUnwindSafe for RegistrySource<'a>
impl<'a> Send for RegistrySource<'a>
impl<'a> Sync for RegistrySource<'a>
impl<'a> Unpin for RegistrySource<'a>
impl<'a> UnsafeUnpin for RegistrySource<'a>
impl<'a> UnwindSafe for RegistrySource<'a>
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more