forensic-mount 0.5.0

#![forbid(unsafe_code)]

use clap::Parser;

#[derive(Parser)]
#[command(
    name = "4n6mount",
    about = "Universal forensic FUSE mount — auto-detects ext4, NTFS, exFAT, HFS+, APFS, \
             ISO9660, EWF/VMDK containers, and zip/7z/tar(.gz/.bz2) archives",
    version
)]
struct Cli {
    /// Image file to mount (positional, required unless exporting/importing)
    image: Option<String>,

    /// Mount point directory (positional)
    mountpoint: Option<String>,

    /// Force filesystem type (auto-detected if omitted)
    #[arg(long)]
    fs: Option<String>,

    /// Symbol file (ISF JSON or PDB) for memory-dump analysis. Optional for a
    /// Windows crash dump whose header carries CR3 + kernel list heads.
    #[arg(long)]
    symbols: Option<String>,

    /// Session directory for COW overlay persistence
    #[arg(long)]
    session: Option<String>,

    /// Resume a previous session
    #[arg(long)]
    resume: bool,

    /// Run as a background daemon
    #[arg(long)]
    daemon: bool,

    /// Known-good hash database for evidence/ filtering
    #[arg(long = "filter-db")]
    filter_dbs: Vec<String>,

    /// Export a session to a tarball
    #[arg(long = "export-session")]
    export_session: Option<String>,

    /// Output path for session export
    #[arg(long)]
    output: Option<String>,

    /// Import a session from a tarball
    #[arg(long = "import-session")]
    import_session: Option<String>,
}

fn main() {
    let cli = Cli::parse();

    // Handle export-session
    if let Some(session_dir) = &cli.export_session {
        let output = cli.output.as_deref().unwrap_or_else(|| {
            eprintln!("--output required with --export-session");
            std::process::exit(1);
        });
        forensic_mount::session::export_session(
            std::path::Path::new(session_dir),
            std::path::Path::new(output),
        )
        .unwrap_or_else(|e| {
            eprintln!("Export failed: {e}");
            std::process::exit(1);
        });
        eprintln!("Session exported to {output}");
        return;
    }

    // Handle import-session
    if let Some(tarball) = &cli.import_session {
        let session_dir = cli.session.as_deref().unwrap_or_else(|| {
            eprintln!("--session required with --import-session");
            std::process::exit(1);
        });
        forensic_mount::session::import_session(
            std::path::Path::new(tarball),
            std::path::Path::new(session_dir),
        )
        .unwrap_or_else(|e| {
            eprintln!("Import failed: {e}");
            std::process::exit(1);
        });
        eprintln!("Session imported to {session_dir}");
        return;
    }

    // Mount mode — image and mountpoint required
    let image = cli.image.unwrap_or_else(|| {
        eprintln!("Usage: 4n6mount <image> <mountpoint>");
        std::process::exit(1);
    });
    let mountpoint = cli.mountpoint.unwrap_or_else(|| {
        eprintln!("Usage: 4n6mount <image> <mountpoint>");
        std::process::exit(1);
    });

    // Open image and detect filesystem
    let mut file = std::fs::File::open(&image).unwrap_or_else(|e| {
        eprintln!("Cannot open {image}: {e}");
        std::process::exit(1);
    });

    // Memory-dump path: explicit `--fs memory`, or a recognized dump signature.
    // A memory dump mounts read-only with the Raw layout (its own top level),
    // bypassing the disk overlay entirely.
    let force_memory = matches!(cli.fs.as_deref(), Some("memory" | "mem"));
    let detected_memory = forensic_mount::detect::detect_memory_dump(&mut file)
        .ok()
        .flatten();
    if force_memory || detected_memory.is_some() {
        route_memory_mount(&image, &mountpoint, cli.symbols.as_deref(), cli.daemon);
        return;
    }

    let fs_type = if let Some(fs_str) = &cli.fs {
        fs_str
            .parse::<forensic_mount::detect::FsType>()
            .unwrap_or_else(|e| {
                eprintln!("{e}");
                std::process::exit(1);
            })
    } else {
        forensic_mount::detect::detect_filesystem(&mut file).unwrap_or_else(|e| {
            eprintln!("Detection failed: {e}");
            std::process::exit(1);
        })
    };

    // AFF4 containers are ZIP archives with no magic bytes, so a byte probe
    // classifies them as Zip; refine an auto-detected Zip by reading the AFF4
    // information.turtle. A forced `--fs` is respected as-is.
    #[cfg(feature = "aff4")]
    let fs_type = if cli.fs.is_none() && fs_type == forensic_mount::detect::FsType::Zip {
        forensic_mount::detect::detect_aff4(std::path::Path::new(&image)).unwrap_or(fs_type)
    } else {
        fs_type
    };

    eprintln!("Detected filesystem: {fs_type}");

    // Compute a fallback name for raw (Unknown) mounts from the image basename.
    let image_name = std::path::Path::new(&image).file_name().map_or_else(
        || "evidence.bin".to_string(),
        |n| n.to_string_lossy().to_string(),
    );

    // Create the ForensicFs. Container formats (EWF/VMDK) are opened here, then
    // their inner filesystem is detected and built; every other type — disk
    // filesystems and archives alike — is built directly from the image file.
    // Seekable-stream formats funnel through `build_filesystem` (the `other`
    // arm). Containers (EWF/VMDK) re-detect and mount their inner filesystem;
    // AD1 is a logical tree opened by path, so it builds its ForensicFs directly.
    let forensic_fs: Box<dyn forensic_mount::ForensicFs + Send> = match fs_type {
        #[cfg(feature = "vmdk")]
        forensic_mount::detect::FsType::Vmdk => {
            let mut vmdk_reader = vmdk::VmdkFileReader::open_path(std::path::Path::new(&image))
                .unwrap_or_else(|e| {
                    eprintln!("Cannot open VMDK image: {e}");
                    std::process::exit(1);
                });
            let inner = forensic_mount::detect::detect_filesystem(&mut vmdk_reader)
                .unwrap_or(forensic_mount::detect::FsType::Unknown);
            eprintln!("VMDK container detected, inner filesystem: {inner}");
            forensic_mount::build_filesystem(vmdk_reader, inner, &image_name).unwrap_or_else(|e| {
                eprintln!("Cannot mount filesystem inside VMDK: {e}");
                std::process::exit(1);
            })
        }
        #[cfg(feature = "ewf")]
        forensic_mount::detect::FsType::Ewf => {
            let mut ewf_reader = ewf::EwfReader::open(&image).unwrap_or_else(|e| {
                eprintln!("Cannot open EWF image: {e}");
                std::process::exit(1);
            });
            let inner = forensic_mount::detect::detect_filesystem(&mut ewf_reader)
                .unwrap_or(forensic_mount::detect::FsType::Unknown);
            eprintln!("EWF container detected, inner filesystem: {inner}");
            forensic_mount::build_filesystem(ewf_reader, inner, &image_name).unwrap_or_else(|e| {
                eprintln!("Cannot mount filesystem inside EWF: {e}");
                std::process::exit(1);
            })
        }
        #[cfg(feature = "ad1")]
        forensic_mount::detect::FsType::Ad1 => {
            // AD1 is a logical file tree, not a seekable disk stream, and it
            // opens by path to discover sibling `.ad2…` segments — so it builds
            // the ForensicFs directly instead of funnelling through
            // `build_filesystem`. Encrypted (ADCRYPT) images surface here as a
            // NotSupported error and are refused, not mounted.
            let fs = forensic_mount::fs_ad1::Ad1ForensicFs::open(std::path::Path::new(&image))
                .unwrap_or_else(|e| {
                    eprintln!("Cannot open AD1 image: {e}");
                    std::process::exit(1);
                });
            Box::new(fs)
        }
        #[cfg(feature = "aff4")]
        forensic_mount::detect::FsType::Aff4Logical => {
            // AFF4-Logical is a file collection (like AD1) opened by path.
            let fs = forensic_mount::fs_aff4::Aff4ForensicFs::open(std::path::Path::new(&image))
                .unwrap_or_else(|e| {
                    eprintln!("Cannot open AFF4-Logical container: {e}");
                    std::process::exit(1);
                });
            Box::new(fs)
        }
        #[cfg(feature = "aff4")]
        forensic_mount::detect::FsType::Aff4Disk => {
            // An AFF4 disk image is a Read+Seek stream (like EWF/VMDK): open it,
            // re-detect the inner filesystem, and mount that. Encrypted images
            // are refused here with a clear error.
            let mut reader =
                aff4::Aff4Reader::open(std::path::Path::new(&image)).unwrap_or_else(|e| {
                    eprintln!("Cannot open AFF4 disk image: {e}");
                    std::process::exit(1);
                });
            let inner = forensic_mount::detect::detect_filesystem(&mut reader)
                .unwrap_or(forensic_mount::detect::FsType::Unknown);
            eprintln!("AFF4 disk image detected, inner filesystem: {inner}");
            forensic_mount::build_filesystem(reader, inner, &image_name).unwrap_or_else(|e| {
                eprintln!("Cannot mount filesystem inside AFF4: {e}");
                std::process::exit(1);
            })
        }
        other => forensic_mount::build_filesystem(file, other, &image_name).unwrap_or_else(|e| {
            eprintln!("{e}");
            std::process::exit(1);
        }),
    };

    // Build session if requested
    let session_mgr = cli.session.map(|dir| {
        let session_path = std::path::Path::new(&dir);
        if cli.resume {
            forensic_mount::session::Session::resume(session_path, std::path::Path::new(&image))
                .unwrap_or_else(|e| {
                    eprintln!("Cannot resume session: {e}");
                    std::process::exit(1);
                })
        } else {
            forensic_mount::session::Session::create(session_path, std::path::Path::new(&image))
                .unwrap_or_else(|e| {
                    eprintln!("Cannot create session: {e}");
                    std::process::exit(1);
                })
        }
    });

    let options = forensic_mount::MountOptions {
        read_only: session_mgr.is_none(),
        daemon: cli.daemon,
        fs_name: format!("4n6mount-{fs_type}"),
        layout: forensic_mount::MountLayout::DiskOverlay,
    };

    eprintln!("Mounting {image} at {mountpoint}");
    forensic_mount::mount(
        forensic_fs,
        std::path::Path::new(&mountpoint),
        session_mgr,
        &options,
    )
    .unwrap_or_else(|e| {
        eprintln!("Mount failed: {e}");
        std::process::exit(1);
    });
}

/// Build and mount a memory dump as a read-only `Raw`-layout filesystem.
#[cfg(feature = "memory")]
fn route_memory_mount(image: &str, mountpoint: &str, symbols: Option<&str>, daemon: bool) {
    let fs = forensic_mount::build_memory_fs(
        std::path::Path::new(image),
        symbols.map(std::path::Path::new),
    )
    .unwrap_or_else(|e| {
        eprintln!("{e}");
        std::process::exit(1);
    });
    let options = forensic_mount::MountOptions {
        read_only: true,
        daemon,
        fs_name: "4n6mount-memory".to_string(),
        layout: forensic_mount::MountLayout::Raw,
    };
    eprintln!("Mounting memory dump {image} at {mountpoint}");
    forensic_mount::mount(fs, std::path::Path::new(mountpoint), None, &options).unwrap_or_else(
        |e| {
            eprintln!("Mount failed: {e}");
            std::process::exit(1);
        },
    );
}

/// Memory support was not compiled in: fail loud rather than silently misroute.
#[cfg(not(feature = "memory"))]
fn route_memory_mount(_image: &str, _mountpoint: &str, _symbols: Option<&str>, _daemon: bool) {
    eprintln!(
        "This build has no memory-dump support (the `memory` feature was not enabled). \
         Rebuild with `--features memory`."
    );
    std::process::exit(1);
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn parse_mount_args() {
        let cli = Cli::parse_from(["4n6mount", "image.dd", "/mnt/evidence"]);
        assert_eq!(cli.image.unwrap(), "image.dd");
        assert_eq!(cli.mountpoint.unwrap(), "/mnt/evidence");
        assert!(cli.fs.is_none());
        assert!(!cli.daemon);
        assert!(!cli.resume);
    }

    #[test]
    fn parse_mount_with_fs_override() {
        let cli = Cli::parse_from(["4n6mount", "image.dd", "/mnt", "--fs", "ntfs"]);
        assert_eq!(cli.fs.unwrap(), "ntfs");
    }

    #[test]
    fn parse_mount_with_session() {
        let cli = Cli::parse_from(["4n6mount", "image.dd", "/mnt", "--session", "./case-001"]);
        assert_eq!(cli.session.unwrap(), "./case-001");
    }

    #[test]
    fn parse_mount_with_daemon() {
        let cli = Cli::parse_from(["4n6mount", "image.dd", "/mnt", "--daemon"]);
        assert!(cli.daemon);
    }

    #[test]
    fn parse_mount_with_resume() {
        let cli = Cli::parse_from([
            "4n6mount",
            "image.dd",
            "/mnt",
            "--session",
            "./case",
            "--resume",
        ]);
        assert!(cli.resume);
    }

    #[test]
    fn parse_mount_with_symbols() {
        let cli = Cli::parse_from([
            "4n6mount",
            "memory.lime",
            "/mnt",
            "--fs",
            "memory",
            "--symbols",
            "linux.json",
        ]);
        assert_eq!(cli.fs.unwrap(), "memory");
        assert_eq!(cli.symbols.unwrap(), "linux.json");
    }

    #[test]
    fn parse_mount_with_filter_dbs() {
        let cli = Cli::parse_from([
            "4n6mount",
            "image.dd",
            "/mnt",
            "--filter-db",
            "/path/nsrl.db",
            "--filter-db",
            "/path/custom.txt",
        ]);
        assert_eq!(cli.filter_dbs.len(), 2);
    }

    #[test]
    fn parse_export_session() {
        let cli = Cli::parse_from([
            "4n6mount",
            "--export-session",
            "./case-001",
            "--output",
            "case.tar.gz",
        ]);
        assert_eq!(cli.export_session.unwrap(), "./case-001");
        assert_eq!(cli.output.unwrap(), "case.tar.gz");
        assert!(cli.image.is_none());
    }

    #[test]
    fn parse_import_session() {
        let cli = Cli::parse_from([
            "4n6mount",
            "--import-session",
            "case.tar.gz",
            "--session",
            "./case-002",
        ]);
        assert_eq!(cli.import_session.unwrap(), "case.tar.gz");
        assert_eq!(cli.session.unwrap(), "./case-002");
    }

    #[test]
    fn parse_all_options() {
        let cli = Cli::parse_from([
            "4n6mount",
            "image.E01",
            "/mnt/evidence",
            "--fs",
            "ext4",
            "--session",
            "./case",
            "--resume",
            "--daemon",
            "--filter-db",
            "nsrl.db",
        ]);
        assert_eq!(cli.image.unwrap(), "image.E01");
        assert_eq!(cli.mountpoint.unwrap(), "/mnt/evidence");
        assert_eq!(cli.fs.unwrap(), "ext4");
        assert_eq!(cli.session.unwrap(), "./case");
        assert!(cli.resume);
        assert!(cli.daemon);
        assert_eq!(cli.filter_dbs.len(), 1);
    }
}