Same recipe as in check_syscall.cpp — kept private so each check can vary the policy without affecting siblings.

Same address-index helper used by check_syscall + integrity_checks.

An address-sorted index into ks.symbols, built once. (kallsyms is typically address-sorted at extraction time, but we don't depend on that.)

xarray traversal — depth-first; collect every leaf (folio pointer + implied index reconstructed from path-in-tree).

Build a YR_RULES* from the default ruleset + any user .yar files discoverable via env vars / default dirs. Cached at first use.

Collect every counter we display, so txt and json share one computation pass. Doing the work twice would be wasteful given that some of these checks (

One decoded BTF entry. Variable-length data is captured as needed.

In-memory directory: holds a fixed list of children with UNIQUE names. Name uniqueness is a hard invariant, not a nicety: WinFsp enumerates a directo

Parse a dmesg line "[<sec>.<usec>] <text>" into numeric boot-relative time + the message text. `ok` is false when there's no leading timestamp.

Top-level façade. Owns every layer and exposes the assembled VFS root.

Aggregate via fd_table walks across every process. Dedupe by file_va since a single UNIX socket may be shared across multiple processes (parent + fork

A single field inside a user_type (struct).

Static descriptor of a file's cost profile, set at its registration site. Tags DESCRIBE the file; the warm policy (in ForensicWarmer) DECIDES what to

MemProcFS-style normalized indicator row. Detailed raw plugins remain available, but triage and exports use this common model.

Iterative DFS with depth tracking — DFS keeps siblings adjacent and children indented under their parent (matches /proc/iomem output).

Keep user_pt alive by capturing it alongside.