Exhume FileSystem as a library

This document provides guidance on how to use the exhume_filesystem crate as a library in your Rust projects. You will learn how to integrate the library, its basic usage, and a sample minimalist main code example.

Install

Create a project:

cargo new filesystem_test
cd filesystem_test/src

📦 Adding Exhume FileSystem as a Dependency

To use the exhume_filesystem library in your Rust project, you need to add it as a dependency in your Cargo.toml file. Below is the sections you need to include:

[dependencies]
exhume_body = "=0.2.0"
exhume_filesystem = "=0.2.0"

# Required crates to log events
log = "0.4.25"
env_logger = "0.11.6"

🛠️ Basic Usage

Below is a sample code illustrating how to use exhume_filesystem as a library in a Rust project. This example demonstrates initializing the library, scanning for file records, and accessing file metadata.

use exhume_body::Body;
use exhume_filesystem::Filesystem;
use exhume_filesystem::detected_fs::detect_filesystem;


fn main() {
    // Connect our log env
    env_logger::Builder::new().filter_level(log::LevelFilter::Info).init();
    // We create an exhume body object to fetch our image.
    let body = Body::new("/path/to/evidence.E01".to_string(), "auto");

    // We discovered these values with exhume partitions (see the documentation)
    let offset= 0x100000;
    let partition_size = 0x9c00000 * body.get_sector_size() as u64;

    let mut filesystem = match detect_filesystem(&body, offset, partition_size) {
        Ok(fs) => fs,
        Err(err) => {
            println!("Could not detect the provided filesystem: {:?}", err);
            return;
        }
    };

    let file = match filesystem.get_file(2) {
        Ok(file) => file,
        Err(err) => {
                println!("Could not fetch the requested file: {:?}", err);
                return;
        }
    };

    println!("{}", file.to_string());
}