ewf-forensic 0.5.0

Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

//! RED phase — `--progress` CLI flag for ewf-check.
//!
//! Tests fail until --progress is implemented in the binary.

mod builder;
use builder::E01Builder;
use std::io::Write as _;
use std::process::Command;
use tempfile::NamedTempFile;

fn write_temp(data: &[u8], suffix: &str) -> NamedTempFile {
    let f = tempfile::Builder::new()
        .suffix(suffix)
        .tempfile()
        .unwrap();
    let mut f = f;
    f.write_all(data).unwrap();
    f.flush().unwrap();
    f
}

fn ewf_check() -> Command {
    let bin = env!("CARGO_BIN_EXE_ewf-check");
    Command::new(bin)
}

// ── --progress flag is recognised (exit 0 or 1, not 2) ───────────────────────

#[test]
fn progress_flag_accepted() {
    let data = E01Builder::new(512 * 64).build();
    let f = write_temp(&data, ".E01");
    let out = ewf_check()
        .arg("--progress")
        .arg(f.path())
        .output()
        .unwrap();
    let code = out.status.code().unwrap_or(99);
    assert!(
        code == 0 || code == 1,
        "--progress must not cause usage error (exit 2); got exit {code}; stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
}

// ── --progress stdout must not be corrupted by progress bar ─────────────────
// Progress bar goes to stderr; stdout must still contain the result text.

#[test]
fn progress_stdout_not_corrupted() {
    let data = E01Builder::new(512 * 64).build();
    let f = write_temp(&data, ".E01");
    let out = ewf_check()
        .arg("--progress")
        .arg(f.path())
        .output()
        .unwrap();
    let stdout = String::from_utf8_lossy(&out.stdout);
    // A clean image must print the clean message to stdout (not stderr).
    assert!(
        stdout.contains("clean") || stdout.contains("CLEAN") || stdout.contains("0 anomalies"),
        "--progress must not corrupt stdout; got stdout: {stdout}; stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
}

// ── --progress combined with --min-severity ───────────────────────────────────

#[test]
fn progress_combined_with_min_severity() {
    let data = E01Builder::new(512 * 64).build();
    let f = write_temp(&data, ".E01");
    let out = ewf_check()
        .arg("--progress")
        .arg("--min-severity=info")
        .arg(f.path())
        .output()
        .unwrap();
    let code = out.status.code().unwrap_or(99);
    assert_eq!(
        code, 0,
        "--progress + --min-severity=info on clean image must exit 0; stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
}