Crate wire_desktop_core 

Wire desktop (Electron) messenger reader.

Wire desktop is an Electron wrapper over the Wire web client; all of its evidence lives in the Chromium IndexedDB store (IndexedDB/https_app.wire.com_0.indexeddb.leveldb), organised as Dexie object stores. This crate sits on top of the Wave-2 reader chromium_storage_indexeddb: it takes the generic decoded IndexedDB records and interprets them into typed Wire records (WireRecord) and a chronological timeline.

It is a reader, not an analyzer — it exposes structure and records and emits no findings (those live in wire-desktop-forensic).

Where the bytes are

The profile path and the app’s encryption posture come from the fleet KNOWLEDGE leaf forensicnomicon_core::messenger_desktop (spec "Wire") — this crate never re-hardcodes them. read_profile resolves the IndexedDB store under a Wire profile base directory using that spec.

Encrypted content — fail loud, never fabricate

Wire encrypts message content client-side (Proteus). That key is not in the Chromium OS Safe Storage, so it is not recoverable from this artifact. Encrypted message bodies are surfaced as PayloadState::Encrypted with their cleartext metadata (conversation, sender, time) intact; asking for the plaintext returns a typed WireError::EncryptedPayloadUnrecoverable rather than plausible-but-wrong bytes.

References: hunjison, Forensic Analysis of Wire Messenger in Windows OS (the https_app.wire.com_0.indexeddb.leveldb store + the otr_key).

Structs

ObjectStoreSummary

A per-object-store roll-up.

TimelineEntry

One entry in the reconstructed Wire timeline.

WireRecord

One interpreted Wire record.

WireStore

The interpreted Wire store: a per-object-store summary plus every record.

Enums

PayloadState

The recoverability state of a record’s content.

WireError

An error interpreting a Wire desktop IndexedDB store.

WireRecordKind

Which Wire object store a record came from — the Dexie store name mapped to a forensic role.

Functions

interpret_records

Interpret a slice of decoded IndexedDB records into a typed WireStore.

read_profile

Read a Wire IndexedDB store from a profile base directory by resolving the store’s relative path from the forensicnomicon Wire spec (never a hardcoded path here).

read_store

Read and interpret a Wire IndexedDB store directory (…/https_app.wire.com_0.indexeddb.leveldb).

timeline

Build the chronological timeline of event records from an interpreted store.

wire_spec

The Wire desktop artifact spec from the fleet KNOWLEDGE leaf.