Usage of pure rust SCCA library

[SecSamDev]

I have developed a pure rust prefetch parser, it is still in development and is designed to work with the Forensic-RS framework, but it can work in this project so as not to use bindings to C code.

https://crates.io/crates/frnsc-prefetch

It does not use the Windows-exclusive RtlDecompressBuffer function that other implementations use, which allows it to be used on any platform compatible with the standard Rust library.
It also gives you accurate traces and metrics, such as which blocks were loaded into runtime memory, as a resource, or fetched from disk without going through the prefetch.

The logs generated during processing can be accessed through Rust code by initializing the logger. They are not sent directly to stdout or stderr. logger

You can also check for anomalies detected during processing through the notification system and create hooks when certain anomalies occur. notifications

[janstarke]

I tried to use your library and, guess what, it is working pretty well. Is this something you had in mind?

[SecSamDev]

I'm glad to hear it works.
It was one of the Windows artifacts that I wanted to know more about. I am also working on other parsers and in parallel improving the usability of the framework.
So the feedback is appreciated.

[janstarke]

I see a lot of crates flying around which all implement the same or similar windows data types, such as several time stamp format. There are implementations in my crates, in yours as well, in the ones by @omerbenamram and so on. I think we should concentrate them in special crates in order improve code reuse. What do you think about it?

[SecSamDev]

I added the filetime type at the last minute so that the field wasn't just a u64.
Actually the type is defined in the framework and not in the parser, although integration with third packages could be facilitated using "From" and "Into".

The idea of the framework is precisely that, to reuse common structures. The file system allows, for example, to access the files of a triage ZIP extracted with KAPE without the person implementing the parser having to implement said part; it is the tool that uses the parser that must provide the file system. The same thing happens with the Windows registry, the parsing library does not have to select the registry reader, it is the person who uses it who must supply it. Thus the tool can be applied to both live systems and extracted artifacts.

In any case, any improvement, change or suggestion is welcome.