rust-libesedb

Safe Rust bindings to libyal/libesedb (via libesedb-sys).

use libesedb::EseDb;

fn main() {
    let filename = std::env::args()
        .nth(1)
        .unwrap_or("Catalog1.edb".to_string());
    let db = EseDb::open(filename).unwrap();
    println!("Db load finished!");
    let string = db.table_by_name("string").unwrap();
    for rec in string.iter_records().unwrap() {
        let rec = rec.unwrap();
        let vals = rec.iter_values().unwrap().map(|v| v.unwrap_or_default().to_string()).collect::<Vec<_>>();
        println!("{}", vals.join("\t"));
    }
}

Test Data

• https://github.com/janstarke/ntdsextract2/blob/10-include-deleted-entries-in-timeline/tests/data/ntds_plain.dit

Future Changes

• v0.3.0
  • Remove close() methods in favour of drop!()
  • Lazy-load Values (store some sort of record reference, similar to current LongValue and MultiValue internally)
  • Values come in either FlatValue, LongValue, MultiValue variants, with a defined ValueType

License and Acknowledgement

This project is made available under the LGPL-3.0-or-later.

The time crate (used in FILETIME/OLETIME conversions) is available under the MIT License.

The core functionality that this library binds to is the hard work of Joachim Metz (~joachimmetz).