mbr-partition-forensic

Every other MBR crate tells you what partitions exist. This one tells you what someone did to the disk — structural anomalies, gap and slack-space carving, wipe and bootkit indicators, and CHS/LBA/GPT/VBR cross-checks, each returned as a graded, machine-readable finding.

cargo add mbr-partition-forensic

use mbr_partition_forensic::analyse;
use std::fs::File;

let mut f = File::open("disk.img")?;
let size = f.metadata()?.len();
let analysis = analyse(&mut f, size)?;

for a in &analysis.anomalies {
    println!("[{:?}] {} @ {:#x}  {}", a.severity, a.kind.code(), a.offset, a.note);
}
# Ok::<(), mbr_partition_forensic::Error>(())

[INFO]     MBR-BOOT-PROTECTIVE-EMPTY @ 0x0    Empty boot code on a GPT/UEFI disk (expected)
[CRITICAL] MBR-PART-OVERLAP          @ 0x1ce  LBA ranges of partitions 0 and 1 intersect
[HIGH]     MBR-SLACK-ENTROPY         @ 0x200  High-entropy slack (7.91 bits/byte) — possible hidden data

When a protective MBR is found, the real GPT is parsed automatically (default gpt feature, backed by gpt-partition-forensic) and cross-checked.

Reader + analyzer

This crate is the analyzer: it layers anomaly detection on top of the mbr-partition-core reader and emits graded forensicnomicon::report::Finding values. It re-exports every reader type (parse_mbr_sector, MbrSector, PartitionEntry, EbrChain, BootCodeId, DetectedFs, Error, …), so a single dependency gives you both the raw decode and the findings.

[dependencies]
mbr-partition-forensic = "0.4"

Entry points: analyse(reader, disk_size_bytes) and analyse_with_options(reader, disk_size_bytes, AnalyseOptions) return an MbrAnalysis { boot_code_id, partitions, gaps, anomalies, .. }. Each anomaly is an Anomaly { severity, kind, offset, note }; kind.code() is the stable machine-readable code.

Anomaly codes

Stable, scheme-prefixed codes (a published contract — they do not change once shipped) with a graded Severity (Info < Low < Medium < High < Critical):

Findings are observations, never legal conclusions — the examiner or tribunal draws the conclusion. Bootkit and high-entropy findings are reported as "consistent with", not as a verdict.

Trust but verify

Built to run on untrusted disk images from potentially compromised systems:

• Panic-free on malicious input — bounds-checked reads, checked/saturating arithmetic; no unwrap/expect/panic! in production code (enforced by clippy::unwrap_used/expect_used = deny).
• EBR hardening — a visited-LBA set prevents infinite loops (MBR-EBR-CYCLE), checked_add terminates on overflow, and a 64-level depth cap stops runaway chains (MBR-EBR-DEPTH); reads on truncated images terminate traversal gracefully.
• Fuzzed — cargo fuzz targets fuzz_parse (the pure parser) and fuzz_forensic (the full pipeline); the invariant is "must not panic".
• Validated against real artifacts, not only synthetic fixtures, with the full suite verified in CI.

cargo +nightly fuzz run fuzz_parse
cargo +nightly fuzz run fuzz_forensic

Features

For a ready-made command line that auto-detects MBR/GPT/APM and prints findings for any disk, install the unified disk4n6 tool (cargo install disk-forensic).

Privacy Policy · Terms of Service · © 2026 Security Ronin Ltd