Struct MemoryRecoveredChunk 

pub struct MemoryRecoveredChunk {
    pub vaddr: u64,
    pub header: EvtxChunkHeader,
    pub record_count: u32,
    pub first_timestamp: u64,
    pub last_timestamp: u64,
    pub channel: String,
    pub source_process: Option<String>,
    pub source_pid: Option<u32>,
    pub anti_forensic: Vec<IntegrityAnomaly>,
}

A chunk recovered from process memory (Event Log service VAD scan).

Fields

vaddr: u64

header: EvtxChunkHeader

record_count: u32

first_timestamp: u64

last_timestamp: u64

channel: String

source_process: Option<String>

source_pid: Option<u32>

anti_forensic: Vec<IntegrityAnomaly>

Trait Implementations

impl Clone for MemoryRecoveredChunk

fn clone(&self) -> MemoryRecoveredChunk

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MemoryRecoveredChunk

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for MemoryRecoveredChunk

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.