mbr-partition-core

A pure, read-only Master Boot Record parser — decode the boot sector, partition table, and EBR chain from a 512-byte buffer or any Read + Seek, with no I/O of its own and no panics on hostile input.

cargo add mbr-partition-core

use mbr::parse_mbr_sector;

let sector = std::fs::read("disk.img")?;
let mbr = parse_mbr_sector(&sector[..512])?;

println!("Disk serial: {:#010X}", mbr.disk_serial);
for (i, entry) in mbr.entries.iter().enumerate() {
    if !entry.is_empty() {
        println!("  [{i}] {} lba={} count={}", entry.type_code.name(), entry.lba_start, entry.lba_count);
    }
}
# Ok::<(), mbr::Error>(())

The crate is published as mbr-partition-core but imported as mbr ([lib] name = "mbr").

What it decodes

This is the structure-decode layer. It deliberately contains no anomaly findings — the analyzer that grades these structures lives in the sibling mbr-partition-forensic crate, which re-exports every type here.

The only error type is Error (TooShort, BadSignature, Io).

Trust but verify

Built to run on untrusted disk images:

• Panic-free — bounds-checked reads and checked/saturating arithmetic; no unwrap/expect/panic! in production code (enforced by clippy::unwrap_used/expect_used = deny).
• EBR hardening — walk_ebr_chain uses a visited-LBA set against cycles, checked_add against overflow, and a depth cap against runaway chains; read errors on truncated images terminate traversal gracefully.
• Fuzzed — the fuzz_parse cargo-fuzz target drives the sector parser; the invariant is "must not panic".

Features

For graded forensic findings, gap analysis, slack-space carving, and wipe / bootkit detection, use mbr-partition-forensic.

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd