archive-forensic

Pure-Rust, forbid(unsafe), read-only archive-layer reader and auditor. An archive is a transparent optional archive layer: evidence.E01.gz resolves identically to evidence.E01. archive-core peels gzip/bzip2/xz/zip/7z/tar layers (reusing zip-forensic-core and sevenzip-core), determining the format by content magic (authority for the codec) with the file name as a secondary hint for aliases (.tgz/.tbz2) and the magic-absent formats.

• archive-core — the peel/archive-layer reader + format detection.
• archive-forensic — the analyzer: extension-vs-content masquerade, declared-size lies, path-traversal names, decompression-bomb findings.

Status: under active TDD construction (gzip peel wired; more codecs follow).

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd