Crate veracrypt_forensic 

veracrypt-forensic — VeraCrypt/TrueCrypt volume anomaly auditor

Emits severity-graded forensicnomicon::report::Findings over an unlocked volume’s recovered facts: flavor (VeraCrypt vs legacy TrueCrypt), the PRF/cipher in use, and whether the header advertises a hidden volume. Findings are observations, never verdicts — the examiner draws conclusions.

• VC-LEGACY-TRUECRYPT — a legacy TrueCrypt (not VeraCrypt) container (Low).
• VC-HIDDEN-VOLUME-DECLARED — the outer header declares a hidden volume (Medium).
• VC-CIPHER-INVENTORY — the PRF, cipher, and data offset in use (Info).

Structs

Anomaly

A VeraCrypt forensic anomaly: an observation graded by severity, with a stable code and note derived from its AnomalyKind so they cannot drift.

Enums

AnomalyKind

A classified VeraCrypt observation.

Constants

ANALYZER

The producing analyzer name embedded in emitted findings’ Source.

Functions

audit

Audit an unlocked volume’s VolumeInfo plus its declared hidden-volume size, returning classified anomalies. Pure.

audit_findings

Audit a volume and map each anomaly to a canonical Finding, tagged with the producing Source (scope names the evidence).