Crate vsc_forensic 

vsc-forensic — Volume Shadow Copy anomaly auditor

Walks the shadow-copy stores decoded by vsc and emits severity-graded forensicnomicon::report::Findings. Findings are OBSERVATIONS, never verdicts: an absence of shadow copies is reported as consistent with MITRE T1490 deletion or a volume that simply never had snapshots — the analyzer does not assert deletion.

As the [P^H] disk-history layer, each enumerated store is a point-in-time materialization of the volume; the analyzer surfaces their presence, catalog sequence gaps (consistent with a deleted intermediate store), and notable store attributes.

use std::fs::File;
use vsc::VssVolume;

let mut vol = VssVolume::open(File::open("volume.raw")?)?;
for anomaly in vsc_forensic::audit(&mut vol) {
    println!("{}: {}", anomaly.code, anomaly.note);
}

Structs

Anomaly

A VSS forensic anomaly: an observation graded by severity, with a stable code and note derived from its AnomalyKind so they cannot drift.

Enums

AnomalyKind

A classified VSS forensic anomaly.

Constants

ANALYZER

The producing analyzer name embedded in emitted findings’ Source.

Functions

audit

Audit the shadow copies of a VSS volume, returning classified anomalies.

audit_findings

Audit a VSS volume and map each anomaly to a canonical Finding, tagged with the producing Source (scope names the evidence, e.g. the volume).

filetime_to_rfc3339

Convert a raw Windows FILETIME to an RFC 3339 string, or None when the value is zero or predates the Unix epoch.