rust-libesedb

Safe Rust bindings to libyal/libesedb (via libesedb-sys).

use libesedb::EseDb;

fn main() {
    let filename = std::env::args()
        .nth(1)
        .unwrap_or("Catalog1.edb".to_string());
    let db = EseDb::open(filename).unwrap();
    println!("Db load finished!");
    let string = db.table_by_name("string").unwrap();
    for rec in string.iter_records().unwrap() {
        let rec = rec.unwrap();
        let vals = rec.iter_values().unwrap().map(|v| v.unwrap_or_default().to_string()).collect::<Vec<_>>();
        println!("{}", vals.join("\t"));
    }
}

Test Data

• https://github.com/janstarke/ntdsextract2/blob/10-include-deleted-entries-in-timeline/tests/data/ntds_plain.dit

Future Changes

• v0.3.0
  • Remove close() methods in favour of drop!()
  • Lazy-load Values (store some sort of record reference, similar to current LongValue and MultiValue internally)
  • Values come in either FlatValue, LongValue, MultiValue variants, with a defined ValueType

Publishing Process

1. git pull any changes from main
2. Update version in Cargo.toml
   • Any changes to libesedb-sys will require updating the dependency version and a bump in the main crate version too
3. git add / git commit the version change (and push); e.g. release: libesedb-v0.2.7
4. Create a git tag / GitHub release
   • e.g. libesedb-v0.2.7
5. Packaging dry-run
   • cargo publish --dry-run
   • cargo package --list
6. Publish
   • cargo publish

License and Acknowledgement

This project is made available under the LGPL-3.0-or-later.

The time crate (used in FILETIME/OLETIME conversions) is available under the MIT License.

The core functionality that this library binds to is the hard work of Joachim Metz (~joachimmetz).