ewf-forensic 0.7.0

Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

#![allow(clippy::unwrap_used, clippy::expect_used)]

//! RED phase — per-chunk Adler-32 detection (ewfverify parity).
//!
//! ewfverify verifies individual chunk checksums in addition to the overall
//! MD5. EWF v1 appends a 4-byte Adler-32 after each chunk's raw (possibly
//! compressed) bytes. A corrupt checksum must surface as `ChunkChecksumMismatch`.
mod builder;

use builder::E01Builder;
use ewf_forensic::{EwfIntegrity, EwfIntegrityAnomaly};

// ── Corrupt chunk checksum is detected ────────────────────────────────────────

#[test]
fn corrupt_chunk_checksum_detected() {
    let image = E01Builder::new(512 * 64)
        .with_chunk_checksums()
        .with_corrupt_chunk_checksum(0)
        .build();
    let findings = EwfIntegrity::new(&image).analyse();
    assert!(
        findings
            .iter()
            .any(|a| matches!(a, EwfIntegrityAnomaly::ChunkChecksumMismatch { .. })),
        "corrupt chunk Adler-32 must produce ChunkChecksumMismatch; got: {findings:#?}"
    );
}

// ── Clean image with checksums produces no false positives ────────────────────

#[test]
fn clean_chunk_checksums_no_anomaly() {
    let image = E01Builder::new(512 * 64).with_chunk_checksums().build();
    let findings = EwfIntegrity::new(&image).analyse();
    assert!(
        !findings
            .iter()
            .any(|a| matches!(a, EwfIntegrityAnomaly::ChunkChecksumMismatch { .. })),
        "correct chunk checksums must not produce ChunkChecksumMismatch; got: {findings:#?}"
    );
}

// ── ChunkChecksumMismatch severity is Error ───────────────────────────────────

#[test]
fn chunk_checksum_mismatch_is_error_severity() {
    use ewf_forensic::Severity;
    let image = E01Builder::new(512 * 64)
        .with_chunk_checksums()
        .with_corrupt_chunk_checksum(0)
        .build();
    let findings = EwfIntegrity::new(&image).analyse();
    let a = findings
        .iter()
        .find(|a| matches!(a, EwfIntegrityAnomaly::ChunkChecksumMismatch { .. }))
        .expect("ChunkChecksumMismatch must be present on corrupt image");
    assert_eq!(a.severity(), Severity::High);
}

// ── Images without per-chunk checksums (no-checksum builder) are unaffected ──

#[test]
fn no_checksum_image_no_false_positive() {
    let image = E01Builder::new(512 * 64).build();
    let findings = EwfIntegrity::new(&image).analyse();
    assert!(
        !findings
            .iter()
            .any(|a| matches!(a, EwfIntegrityAnomaly::ChunkChecksumMismatch { .. })),
        "image without per-chunk checksums must not produce ChunkChecksumMismatch; got: {findings:#?}"
    );
}