blazehash 0.2.0

Forensic file hasher — hashdeep for the modern era, BLAKE3 by default
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

use anyhow::Result;
use ewf::EwfReader;
use std::path::Path;

use super::{ImageFormat, ImageMetadata, ImageVerification};

fn hex(bytes: &[u8]) -> String {
    bytes.iter().map(|b| format!("{b:02x}")).collect()
}

pub fn verify_ewf(path: &Path) -> Result<ImageVerification> {
    let mut reader = EwfReader::open(path)?;

    let media_size = reader.total_size();
    let stored = reader.stored_hashes();
    let meta = reader.metadata().clone();

    let result = reader.verify()?;

    let metadata = {
        let has_any = meta.case_number.is_some()
            || meta.examiner.is_some()
            || meta.description.is_some()
            || meta.acquiry_software.is_some();

        if has_any {
            Some(ImageMetadata {
                case_number: meta.case_number,
                examiner: meta.examiner,
                description: meta.description,
                acquiry_software: meta.acquiry_software,
            })
        } else {
            None
        }
    };

    Ok(ImageVerification {
        format: ImageFormat::Ewf,
        path: path.display().to_string(),
        media_size,
        stored_md5: stored.md5.as_ref().map(|h| hex(h)),
        stored_sha1: stored.sha1.as_ref().map(|h| hex(h)),
        computed_md5: Some(hex(&result.computed_md5)),
        computed_sha1: result.computed_sha1.as_ref().map(|h| hex(h)),
        md5_match: result.md5_match,
        sha1_match: result.sha1_match,
        metadata,
    })
}