Feature flags of dfir-toolkit crate // Lib.rs

Cargo Features

[dependencies]
dfir-toolkit = { version = "0.10.3", default-features = false, features = ["mactime2", "gzip", "elastic", "evtxtools", "pol_export", "evtxscan", "evtxcat", "evtxls", "evtxanalyze", "evtx2bodyfile", "ipgrep", "ts2date", "lnk2bodyfile", "pf2bodyfile", "regdump", "hivescan", "cleanhive", "phf"] }

default = cleanhive, evtxtools, hivescan, ipgrep, lnk2bodyfile, mactime2, pf2bodyfile, pol_export, regdump, ts2date

These default features are set whenever dfir-toolkit is added without default-features = false somewhere in the dependency tree.

mactime2 default = bitflags, chrono-tz, elastic, encoding_rs_io, gzip, thiserror

Required by the mactime2 binary

gzip mactime2 = flate2

elastic mactime2 = base64, elasticsearch, futures, num-derive, num-traits, serde_json, sha2, strum, strum_macros, tokio, tokio-async-drop

Affects dfir-toolkit::es4forensics…

Required by the es4forensics binary

evtxtools default = evtx2bodyfile, evtxanalyze, evtxcat, evtxls, evtxscan

pol_export default

Required by the pol_export binary

evtxscan evtxtools = evtx

Required by the evtxscan binary

evtxcat evtxtools = colored_json, evtx, term-table, termsize

Required by the evtxcat binary

evtxls evtxtools = colored, dfirtk-eventdata, evtx, lazy-regex, regex, sigpipe

Required by the evtxls binary

evtxanalyze evtxtools = dfirtk-eventdata, dfirtk-sessionevent-derive, evtx

Required by the evtxanalyze binary

evtx2bodyfile evtxtools = evtx, getset, indicatif, ouroboros

Required by the evtx2bodyfile binary

ipgrep default

Required by the ipgrep binary

ts2date default = regex

Required by the ts2date binary

lnk2bodyfile default = lnk

Required by the lnk2bodyfile binary

pf2bodyfile default = forensic-rs, frnsc-prefetch, libc, num

Required by the pf2bodyfile binary

regdump default = nt_hive2

Required by the regdump binary

hivescan default = nt_hive2

Required by the hivescan binary

cleanhive default = nt_hive2

Required by the cleanhive binary

Features from optional dependencies

In crates that don't use the dep: syntax, optional dependencies automatically become Cargo features. These features may have been created by mistake, and this functionality may be removed in the future.

regex evtxls? ts2date

chrono-tz mactime2

Enables chrono-tz ^0.8