Crate xfs_forensic 

xfs-forensic — anomaly auditor for XFS filesystems.

Emits graded forensicnomicon::report::Findings for XFS-specific forensic signals: deleted-inode recovery (extent records surviving in inode slack), directory-slack residue (freed dirents keeping their inode number), and v5 self-describing-metadata integrity (CRC / owner / blkno mismatches).

Built on xfs-core for valid-path reading; where the audit must see slack and malformed structure the reader normalizes away, it parses the raw bytes directly (the reader/analyzer-split principle).

Each finding is an observation (“consistent with …”); the examiner draws the conclusions. Mirrors the fleet producer pattern (typed AnomalyKind + impl Observation + audit_* → Vec<Anomaly> + audit_findings → Vec<Finding>), as in ntfs-forensic.

Structs

Anomaly

An XFS structural-integrity anomaly: an observation graded by severity, with a stable code and note derived from its AnomalyKind so they cannot drift.

DeletedInode

A recovered deleted inode: a freed (di_mode == 0) inode whose residual extent records survived the delete, so its content is carvable.

Enums

AnomalyKind

Classification of an XFS structural-integrity anomaly (F3). Each variant carries the evidence needed to reproduce the observation.

Severity

Severity of a forensic finding (Info < Low < Medium < High < Critical).

Functions

audit_findings

Audit an image and convert each F3 anomaly to a canonical Finding tagged with scope.

audit_image

Audit a whole XFS image for structural-integrity anomalies (F3): parse the primary superblock, walk every AG, and check each of CRC validity, secondary superblock divergence, orphaned inodes, and impossible geometry.

recover_deleted

Scan the inode space for deleted inodes with residual extent records (F1).