Documentation
¶
Overview ¶
Copyright (c) 2025 Stefano Scafiti
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Copyright (c) 2025 Stefano Scafiti ¶
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Copyright (c) 2025 Stefano Scafiti ¶
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Index ¶
Constants ¶
const XmlOutputVersion = "1.0"
Variables ¶
var DefaultMetadata = Metadata{
Xmlns: "http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML",
XmlnsXsi: "http://www.w3.org/2001/XMLSchema-instance",
XmlnsDC: "http://purl.org/dc/elements/1.1/",
Type: "Carve Report",
}
Functions ¶
This section is empty.
Types ¶
type ByteRun ¶
type ByteRun struct {
Offset uint64 `xml:"offset,attr"` // Logical offset within the file object.
ImgOffset uint64 `xml:"img_offset,attr"` // Physical offset within the disk image.
Length uint64 `xml:"len,attr"` // Length of the byte run.
}
ByteRun describes a contiguous block of data within the image.
type ByteRuns ¶
type ByteRuns struct {
Runs []ByteRun `xml:"byte_run"` // A slice of ByteRun structs, representing data extents.
}
ByteRuns is a collection of ByteRun entries.
type Creator ¶
type Creator struct {
Package string `xml:"package"` // The name of the software package.
Version string `xml:"version"` // The version of the software package.
ExecutionEnvironment ExecEnv `xml:"execution_environment"` // Details about the execution environment.
}
Creator describes the software and environment used to generate the DFXML.
type DFXMLHeader ¶
type DFXMLHeader struct {
XMLName xml.Name `xml:"dfxml"` // Specifies the XML element name as "dfxml".
XmlOutput string `xml:"xmloutputversion,attr,omitempty"` // The version of the DFXML XML schema, an attribute. "omitempty" means it will be omitted if empty.
Metadata Metadata `xml:"metadata"` // Contains metadata about the DFXML document.
Creator Creator `xml:"creator"` // Describes the software that created the DFXML.
Source Source `xml:"source"` // Describes the source of the forensic image.
}
DFXMLHeader represents the root element of a DFXML document.
type DFXMLWriter ¶
type DFXMLWriter struct {
// contains filtered or unexported fields
}
DFXMLWriter provides methods for writing DFXML elements to an io.Writer.
func NewDFXMLWriter ¶
func NewDFXMLWriter(w io.Writer) *DFXMLWriter
NewDFXMLWriter creates and initializes a new DFXMLWriter. It sets up the XML encoder to indent output with two spaces for readability.
func (*DFXMLWriter) Close ¶
func (w *DFXMLWriter) Close() error
Close closes the DFXML document by writing the closing </dfxml> tag and flushing the encoder.
func (*DFXMLWriter) WriteFileObject ¶
func (w *DFXMLWriter) WriteFileObject(obj FileObject) error
WriteFileObject encodes and writes a FileObject struct as an XML element.
func (*DFXMLWriter) WriteHeader ¶
func (w *DFXMLWriter) WriteHeader(hdr DFXMLHeader) error
WriteHeader writes the DFXML header, including the XML declaration and the root <dfxml> tag.
type ExecEnv ¶
type ExecEnv struct {
OS string `xml:"os_sysname"` // Operating system name (e.g., "Linux", "Windows").
Release string `xml:"os_release"` // Operating system release version.
Version string `xml:"os_version"` // Operating system kernel version.
Host string `xml:"host"` // Hostname of the machine.
Arch string `xml:"arch"` // Architecture of the machine (e.g., "x86_64").
UID int `xml:"uid"` // User ID under which the process ran.
Start string `xml:"start_time"` // Start time of the DFXML generation.
}
ExecEnv provides information about the operating system and host where the DFXML was created.
func GetExecEnv ¶
func GetExecEnv() ExecEnv
GetExecEnv retrieves runtime information to populate the ExecEnv struct.
type FileObject ¶
type FileObject struct {
XMLName xml.Name `xml:"fileobject"` // Specifies the XML element name as "fileobject".
Filename string `xml:"filename"` // The name of the file.
FileSize uint64 `xml:"filesize"` // The size of the file in bytes.
ByteRuns ByteRuns `xml:"byte_runs"` // Contains information about the physical location of file data.
}
FileObject represents a single file or directory within the forensic image.
func ReadFileObjects ¶
func ReadFileObjects(r io.Reader) ([]FileObject, error)
ReadFileObjects parses and returns all <fileobject> elements from the reader.
type Metadata ¶
type Metadata struct {
Xmlns string `xml:"xmlns,attr"` // XML Namespace for the DFXML schema.
XmlnsXsi string `xml:"xmlns:xsi,attr"` // XML Namespace for XML Schema Instance.
XmlnsDC string `xml:"xmlns:dc,attr"` // XML Namespace for Dublin Core.
Type string `xml:"dc:type"` // The type of the DFXML document, e.g., "forensic_disk_image".
}
Metadata contains various metadata attributes for the DFXML document.
type Source ¶
type Source struct {
ImageFilename string `xml:"image_filename"` // The filename of the forensic image.
SectorSize int `xml:"sectorsize"` // The size of a sector in bytes.
ImageSize uint64 `xml:"image_size"` // The total size of the image in bytes.
}
Source describes the original forensic image or data source.
Source Files