dar-core

Pure-Rust, read-only parser for Denis Corbin DAR (Disk ARchiver) archives — the backup/extraction format mobile-forensics tools (Passware Kit Mobile, Cellebrite) write for full-filesystem dumps. Enumerate the catalogue, seek straight to any file for random-access extraction, and verify per-file CRCs — transparently decompressing gzip, bzip2, xz, zstd, lz4 and lzo, across single-file and multi-volume (sliced) archives. Zero unsafe, no GPL, no C bindings.

30 seconds

[dependencies]
dar-core = "0.7"

use std::fs::File;
use dar::DarReader; // package is `dar-core`; the crate imports as `dar`

let mut reader = DarReader::open(File::open("userdata.1.dar")?)?;

// List the catalogue — one seek, no full-archive scan.
for entry in reader.entries() {
    println!("{} ({} bytes)", entry.path_lossy(), entry.size);
}

// Extract one file — direct seek to its catalog offset.
let data = reader.extract("root/etc/hostname")?;

// Integrity check — recompute libdar's per-file CRC over the decoded data.
println!("{}", reader.verify("root/etc/hostname")?); // CRC match | CRC mismatch: …
# Ok::<(), dar::DarError>(())

Multi-volume archives open the same way via DarReader::open_slices(&[path0, path1, …]) (or open_slices from a basename); file data that spans slices is stitched together transparently.

What it reads

All six decompression codecs are always compiled in — a forensic reader must read every variant it encounters, so they are not optional features. The only optional feature is serde (derives Serialize on the public entry types). Encrypted entries are listed but extract() returns a clear error rather than wrong bytes — decryption is out of scope.

Trust but verify

dar-core is built to be pointed at untrusted evidence:

• No panics on malicious input — every attacker-controlled length and offset is bounds- or overflow-checked through bounds-checked readers (no unwrap/expect in production code, enforced by the workspace lints).
• No allocation bombs — a forged stored_size is validated against the real archive length before any allocation.
• No backward seeks — a length that would cast to a negative i64 seek is rejected.
• Zero unsafe (unsafe_code = "deny") and continuously fuzz-tested (fuzz_open, fuzz_read).
• 187 tests at 100% library line coverage, CI-enforced — the committed real-archive fixtures are written by the upstream dar reference CLI (dar 2.3.12 → 2.8.5) and dar_xform across formats 7–11, all six codecs, and multi-volume slices: the reader must list, seek-extract, and CRC-verify each back to the exact content dar archived. A real dar-1.0.0 archive, a large Passware Kit Mobile archive, and a large Android extraction were exercised during development but are not committed. See docs/validation.md for which oracle backs each capability and the recommended dar -x differential and env-gated large-corpus tests.

The forensic layer

dar-core is the reader. For severity-graded anomaly auditing (path-traversal, incomplete catalogue, future timestamps, …) and Sleuth Kit bodyfile timeline export, add dar-forensic, which re-exports this reader and layers the audit() / write_bodyfile() analyzer on top.

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd