sqlite-forensic 0.10.2

Forensic anomaly auditor for SQLite databases — header-integrity findings as graded report::Finding, built on sqlite-core (WS-C spike skeleton; WS-E expands carving/WAL/freelist).
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

//! Blob typing + content hashing (roadmap §4.5): a recovered BLOB is made
//! addressable in a case by a magic-based media type and a SHA-256 content hash.

#![allow(clippy::unwrap_used, clippy::expect_used)]

use sqlite_forensic::blob::{identify_media_type, sha256_hex};

#[test]
fn identifies_common_media_types_from_magic() {
    // Magic numbers are documented file-format facts (see each format spec).
    let png = b"\x89PNG\r\n\x1a\n\x00\x00\x00\rIHDR";
    let jpeg = b"\xFF\xD8\xFF\xE0\x00\x10JFIF";
    let gif = b"GIF89a\x01\x00";
    let pdf = b"%PDF-1.7\n";
    let gzip = b"\x1f\x8b\x08\x00";
    let zip = b"PK\x03\x04\x14\x00";

    assert_eq!(identify_media_type(png), Some("image/png"));
    assert_eq!(identify_media_type(jpeg), Some("image/jpeg"));
    assert_eq!(identify_media_type(gif), Some("image/gif"));
    assert_eq!(identify_media_type(pdf), Some("application/pdf"));
    assert_eq!(identify_media_type(gzip), Some("application/gzip"));
    assert_eq!(identify_media_type(zip), Some("application/zip"));

    // RIFF containers carry the concrete type at bytes 8..12.
    let webp = b"RIFF\x24\x00\x00\x00WEBPVP8 ";
    let wav = b"RIFF\x24\x00\x00\x00WAVEfmt ";
    assert_eq!(identify_media_type(webp), Some("image/webp"));
    assert_eq!(identify_media_type(wav), Some("audio/wav"));
    // ISO base-media: `....ftyp` at offset 4.
    let mp4 = b"\x00\x00\x00\x18ftypmp42";
    assert_eq!(identify_media_type(mp4), Some("video/mp4"));
    // A recovered SQLite database blob (nested db) types too.
    let sqlite = b"SQLite format 3\x00rest";
    assert_eq!(identify_media_type(sqlite), Some("application/vnd.sqlite3"));
    let bmp = b"BM\x8a\x00\x00\x00";
    assert_eq!(identify_media_type(bmp), Some("image/bmp"));
}

#[test]
fn unknown_or_short_blobs_return_none() {
    assert_eq!(identify_media_type(b"not a known magic"), None);
    assert_eq!(identify_media_type(b""), None);
    assert_eq!(identify_media_type(b"\x89P"), None); // too short for the PNG magic
}

#[test]
fn sha256_matches_the_nist_test_vector() {
    // FIPS 180-2 test vector: SHA-256("abc").
    assert_eq!(
        sha256_hex(b"abc"),
        "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
    );
    // Empty input has a well-known digest too.
    assert_eq!(
        sha256_hex(b""),
        "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    );
}