infrastructure-registry-forensics

Thin bounded wrapper around hivex: parses Windows registry hive exports into the RegistryRecord type infrastructure-host-forensics' rule engine already consumes, so rules that were written and tested but never had an input source can run against a real hive

What it is for

infrastructure-registry-forensics — the input infrastructure-host-forensics never had.

That crate calls itself a pure rule engine over already-parsed registry records and puts the parser out of scope. Nothing in the workspace filled the gap, so usbstor_history, ifeo_debugger_present and credential_enrollment were written, tested, and unreachable on a real machine. This crate parses what hivex emits into the RegistryRecord those rules consume.

Same shape as infrastructure-memory-forensics around Volatility3 and infrastructure-firmware-forensics around CHIPSEC: a pure parser that carries the whole contract and is unit-tested against captured output, plus a thin bounded subprocess edge. Nothing here interprets. A record is a fact and a citation; whether it means anything is a question for a human reading it.

Works against a mounted image, not a running machine — the hives are files, so analysis happens offline against a verified capture and the subject is never booted.

Capabilities

RegistryForensicsError

infrastructure-registry-forensics — the input infrastructure-host-forensics never had.

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

No pub use re-exports: every item above is declared in this crate.

Boundary

Reaches into foundation.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_infrastructure["infrastructure"] --> n_foundation["foundation"]

Dependencies

Runtime, in this workspace.

Runtime, from outside the workspace.

Development. None.

Build. None.

Depended on by. 1 workspace crate.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  n_tools_ir_triage["tools-ir-triage"] -->|uses| SELF
  SELF["infrastructure-registry-forensics"]
  SELF -->|runtime| n_foundation_bounded_io["foundation-bounded-io"]
  SELF -->|runtime| n_infrastructure_host_forensics["infrastructure-host-forensics"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Error model

Operational characteristics

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.

Related capabilities

1 workspace crate depends on this one: tools-ir-triage.

Verification

Evidence by module. How often each public module is named by something executable.

What the tests establish, by name:

• a_malformed_timestamp_fails_rather_than_defaulting_to_the_epoch — tests/evtx_export.rs
• an_event_missing_a_logon_type_is_recorded_as_unknown_not_invented — tests/evtx_export.rs
• events_the_rule_does_not_want_are_still_parsed_not_pre_filtered — tests/evtx_export.rs
• logon_records_carry_the_fields_the_rule_cites — tests/evtx_export.rs
• the_parsed_records_drive_the_rule_that_had_no_input — tests/evtx_export.rs
• a_binary_value_keeps_its_bytes_and_survives_continuation_lines — tests/reg_export.rs
• a_dword_is_parsed_as_a_number_not_as_the_text_of_one — tests/reg_export.rs
• a_key_with_no_values_still_becomes_a_record — tests/reg_export.rs
• a_multi_string_splits_on_its_nul_separators — tests/reg_export.rs
• a_string_value_becomes_a_record_carrying_its_key_and_data — tests/reg_export.rs
• a_value_outside_any_key_is_refused_rather_than_silently_dropped — tests/reg_export.rs
• the_default_value_has_no_name — tests/reg_export.rs
• the_parsed_records_actually_drive_the_rules_that_had_no_input — tests/reg_export.rs

Documentation coverage

pie showData
    title Public items with rustdoc
    "Documented" : 3
    "No rustdoc detected" : 0

Metrics

pie showData
    title Public API by kind
    "enum" : 1
    "function" : 2

pie showData
    title Rust source composition
    "Code" : 245
    "Blank or comment" : 103

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.