search

puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
59 stars 6 forks source link

ESE parsing improvements #140

Closed puffyCid closed 1 month ago

puffyCid commented 1 month ago

This PR overhauls the ESE parser. It should support larger ESE databases while keeping memory usage low. Also makes parsing ESE files more flexible when using the JS runtime

codecov[bot] commented 1 month ago

Codecov Report

Attention: Patch coverage is 58.92634% with 658 lines in your changes are missing coverage. Please review.

Project coverage is 83.73%. Comparing base (e4c91e9) to head (9b1f5ae).

Files Patch % Lines
core/src/artifacts/os/windows/search/ese.rs 9.72% 362 Missing :warning:
core/src/artifacts/os/windows/ese/helper.rs 83.31% 124 Missing :warning:
...rc/artifacts/os/windows/search/tables/indexgthr.rs 0.00% 74 Missing :warning:
core/src/artifacts/os/windows/search/properties.rs 0.00% 44 Missing :warning:
core/src/artifacts/os/windows/srum/resource.rs 83.56% 12 Missing :warning:
...rc/artifacts/os/windows/srum/tables/application.rs 62.50% 9 Missing :warning:
core/src/artifacts/os/windows/ese/catalog.rs 42.85% 8 Missing :warning:
core/src/artifacts/os/windows/ese/pages/branch.rs 58.82% 7 Missing :warning:
core/src/artifacts/os/windows/bits/background.rs 82.85% 6 Missing :warning:
core/src/artifacts/os/windows/search/parser.rs 14.28% 6 Missing :warning:
... and 4 more
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #140 +/- ## ========================================== - Coverage 84.25% 83.73% -0.52% ========================================== Files 486 486 Lines 53056 53695 +639 ========================================== + Hits 44702 44963 +261 - Misses 8354 8732 +378 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.