Exhume ExtFS as a library
This document provides guidance on how to use the exhume_extfs
crate as a library in your Rust projects. You will learn how to integrate the library, its basic usage, and a sample minimalist main code example. Exhume ExtFS is also part of Exhume FileSystem.
Install
Create a project:
cargo new extfs_test
cd extfs_test/src
📦 Adding Exhume ExtFS as a Dependency
To use the extfs_test
library in your Rust project, you need to add it as a dependency in your Cargo.toml
file. Below is the sections you need to include:
[dependencies]
exhume_body = "=0.1.1"
exhume_extfs= "=0.1.1"
# Required crates to log events
log = "0.4.25"
env_logger = "0.11.6"
🛠️ Basic Usage
Below is a sample code illustrating how to use extfs_test
as a library in a Rust project. This example demonstrates initializing the library, scanning for file records, and accessing file metadata.
use exhume_body::{Body, BodySlice};
use exhume_extfs::ExtFS;
fn main() {
// Connect our log env
env_logger::Builder::new().filter_level(log::LevelFilter::Info).init();
// We create an exhume body object to fetch our image.
let mut body = Body::new("/path/to/evidence.E01".to_string(), "auto");
// We discovered these values with exhume partitions
let offset= 0x100000;
let partition_size = 0x9c00000 * body.get_sector_size() as u64;
let mut slice = match BodySlice::new(&mut body, offset, partition_size) {
Ok(sl) => sl,
Err(e) => {
println!("Could not create BodySlice: {}", e);
return;
}
};
let mut filesystem = match ExtFS::new(&mut slice) {
Ok(fs) => fs,
Err(e) => {
println!("Couldn't open ExtFS: {}", e);
return;
}
};
let inode = match filesystem.get_inode(2) {
Ok(inode_val) => inode_val,
Err(e) => {
println!("Cannot read inode 2: {}", e);
return;
}
};
println!("{}", inode.to_string());
}