Module raw 

Thin, panic-free raw decode of the parts of an OLE Compound File the cfb crate hides: the header, the FAT and mini-FAT sector chains, and the full 128-byte directory-entry array (including entries the live red-black tree no longer reaches). Offsets and sentinels come from forensicnomicon::olecf — never hardcoded here.

This is not a second CFB reader: live navigation, clean metadata, and stream extraction stay with cfb. This module exists only so the analyzer can see deleted/orphaned residue that a spec-faithful reader skips.

Structs

DirEntry

A decoded 128-byte directory entry. Every field is read with bounds checks; a truncated entry yields zeroed / empty fields rather than a panic.

RawCfb

The decoded shape of a compound file, carrying everything the analyzer needs that cfb does not surface.

Functions

decode

Decode a compound file’s header, FAT, mini-FAT, and directory array.

reachable_sids

Walk the live red-black directory tree from the root entry, returning the set of SIDs reachable through child/left/right pointers. Mirrors what the cfb crate exposes; everything allocated-but-unreached is an orphan.

sector_offset

Byte offset of regular sector sid: (sid + 1) << sector_shift (forensicnomicon::olecf formula). Returns None on overflow.