blazehash 0.2.0

Forensic file hasher — hashdeep for the modern era, BLAKE3 by default
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

#[cfg(feature = "forensic-image")]
mod ewf_backend;

use anyhow::{bail, Result};
use std::fmt;
use std::path::Path;

/// Supported forensic image formats.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ImageFormat {
    Ewf,
}

impl ImageFormat {
    /// Detect format from file extension and magic bytes.
    pub fn detect(path: &Path) -> Result<Self> {
        let ext = path
            .extension()
            .and_then(|e| e.to_str())
            .unwrap_or("")
            .to_ascii_lowercase();

        match ext.as_str() {
            "e01" | "ex01" | "l01" | "lx01" => Ok(ImageFormat::Ewf),
            _ => bail!("unsupported forensic image format: {}", path.display()),
        }
    }
}

impl fmt::Display for ImageFormat {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            ImageFormat::Ewf => write!(f, "EWF (E01)"),
        }
    }
}

/// Metadata extracted from the forensic image.
#[derive(Debug, Clone)]
pub struct ImageMetadata {
    pub case_number: Option<String>,
    pub examiner: Option<String>,
    pub description: Option<String>,
    pub acquiry_software: Option<String>,
}

/// Result of verifying a forensic disk image.
#[derive(Debug, Clone)]
pub struct ImageVerification {
    pub format: ImageFormat,
    pub path: String,
    pub media_size: u64,
    pub stored_md5: Option<String>,
    pub stored_sha1: Option<String>,
    pub computed_md5: Option<String>,
    pub computed_sha1: Option<String>,
    pub md5_match: Option<bool>,
    pub sha1_match: Option<bool>,
    pub metadata: Option<ImageMetadata>,
}

impl fmt::Display for ImageVerification {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        writeln!(f, "Image:         {}", self.path)?;
        writeln!(f, "Format:        {}", self.format)?;

        let size = self.media_size;
        if size >= 1024 * 1024 * 1024 {
            writeln!(f, "Media size:    {size} bytes ({:.1} GiB)", size as f64 / (1024.0 * 1024.0 * 1024.0))?;
        } else if size >= 1024 * 1024 {
            writeln!(f, "Media size:    {size} bytes ({:.1} MiB)", size as f64 / (1024.0 * 1024.0))?;
        } else {
            writeln!(f, "Media size:    {size} bytes")?;
        }

        if let Some(ref md5) = self.stored_md5 {
            writeln!(f, "Stored MD5:    {md5}")?;
        }
        if let Some(ref sha1) = self.stored_sha1 {
            writeln!(f, "Stored SHA1:   {sha1}")?;
        }
        if let Some(ref md5) = self.computed_md5 {
            writeln!(f, "Computed MD5:  {md5}")?;
        }
        if let Some(ref sha1) = self.computed_sha1 {
            writeln!(f, "Computed SHA1: {sha1}")?;
        }

        match self.md5_match {
            Some(true) => writeln!(f, "MD5 match:     PASS")?,
            Some(false) => writeln!(f, "MD5 match:     FAIL")?,
            None => writeln!(f, "MD5 match:     n/a (no stored hash)")?,
        }
        match self.sha1_match {
            Some(true) => writeln!(f, "SHA1 match:    PASS")?,
            Some(false) => writeln!(f, "SHA1 match:    FAIL")?,
            None => {}
        }

        if let Some(ref meta) = self.metadata {
            if let Some(ref v) = meta.case_number {
                writeln!(f, "Case:          {v}")?;
            }
            if let Some(ref v) = meta.examiner {
                writeln!(f, "Examiner:      {v}")?;
            }
            if let Some(ref v) = meta.description {
                writeln!(f, "Description:   {v}")?;
            }
            if let Some(ref v) = meta.acquiry_software {
                writeln!(f, "Software:      {v}")?;
            }
        }

        Ok(())
    }
}

/// Verify a forensic disk image, auto-detecting format from the file extension.
pub fn verify_image(path: &Path) -> Result<ImageVerification> {
    let format = ImageFormat::detect(path)?;

    match format {
        #[cfg(feature = "forensic-image")]
        ImageFormat::Ewf => ewf_backend::verify_ewf(path),
        #[cfg(not(feature = "forensic-image"))]
        _ => bail!("forensic image support not compiled (enable 'forensic-image' feature)"),
    }
}