Struct MemoryCarvedRecord 

pub struct MemoryCarvedRecord {
    pub offset: usize,
    pub raw: Vec<u8>,
    pub binxml_valid: bool,
}

A record found by scanning a raw memory buffer for EVTX record magic.

Fields

offset: usize

Byte offset of the record magic within the input buffer.

raw: Vec<u8>

Raw bytes of the candidate record (from magic through trailing size field).

binxml_valid: bool

True when the BinXML payload starts with a valid FragmentHeader token (0x0F).

Trait Implementations

impl Clone for MemoryCarvedRecord

fn clone(&self) -> MemoryCarvedRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MemoryCarvedRecord

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for MemoryCarvedRecord

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.