Enum AnomalyKind 

pub enum AnomalyKind {
    NoShadowCopies,
    StorePresent {
        store_id: String,
        sequence: u64,
        volume_size: u64,
        creation_time: u64,
    },
    SequenceGap {
        previous: u64,
        next: u64,
    },
    StoreNonPersistent {
        store_id: String,
        attribute_flags: u32,
    },
}

A classified VSS forensic anomaly.

Variants

NoShadowCopies

The volume carries a VSS volume header but the catalog enumerated zero stores — consistent with shadow-copy deletion (T1490) OR a volume that never had snapshots. Not a determination of deletion.

StorePresent

A shadow-copy store is present.

Fields

store_id: String

Store identifier GUID (canonical string).

sequence: u64

Catalog sequence number.

volume_size: u64

Shadow-copy volume size at snapshot time.

creation_time: u64

Raw creation-time FILETIME.

SequenceGap

Catalog sequence numbers are non-contiguous — consistent with a deleted intermediate shadow copy.

Fields

previous: u64

The lower sequence number bracketing the gap.

next: u64

The next present sequence number.

StoreNonPersistent

A store lacks the persistent attribute — a non-persistent shadow copy does not survive a reboot, which is unusual for on-disk VSS.

Fields

store_id: String

Store identifier GUID (canonical string).

attribute_flags: u32

The store’s attribute flags.

Implementations

impl AnomalyKind

pub fn severity(&self) -> Severity

Severity — the single source of truth for this kind.

pub fn code(&self) -> &'static str

Stable, scheme-prefixed machine code (published contract).

pub fn category(&self) -> Category

Analytical lens.

pub fn note(&self) -> String

Human-readable, “consistent with” note including the offending values.

pub fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with.

Trait Implementations

impl Clone for AnomalyKind

fn clone(&self) -> AnomalyKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AnomalyKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for AnomalyKind

impl PartialEq for AnomalyKind

fn eq(&self, other: &AnomalyKind) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for AnomalyKind