udf-forensic 0.1.0

Pure-Rust forensic UDF (ECMA-167 / OSTA) reader — volume recognition, partition-map classification, File Entry and directory traversal, and file data over any Read + Seek.

Reads the UDF filesystem on DVD, Blu-ray, and packet-written optical media, with no unsafe. Type-2 partitions (Virtual/VAT, Sparable, Metadata) are detected and reported rather than silently mis-read.

Install

[dependencies]
udf-forensic = "0.1"

Quick start

use std::fs::File;

let mut f = File::open("disc.udf")?;
if udf_forensic::detect_udf(&mut f) {
    if let Some(st) = udf_forensic::parse_udf_state(&mut f) {
        println!("{:?}, {} partition map(s)", st.partition_kind, st.partition_map_count);
        if let Some(entries) =
            udf_forensic::read_dir_at_lba(&mut f, st.partition_start, st.root_fe_lba)
        {
            for e in entries {
                println!("  {}  {}  {} bytes", if e.is_dir { "dir " } else { "file" }, e.name, e.size);
            }
        }
    }
}

What it parses

Capability	Notes
Volume recognition	NSR02 / NSR03 sequence detection
Partition maps	Physical (Type 1); Virtual / Sparable / Metadata (Type 2) classified + reported
Directory traversal	File Entry + File Identifier Descriptors, OSTA CS0 names
File data	short/long extent reading from the File Entry

Validation

Partition-map classification is checked against real mkudffs-authored images (VAT and Sparable); those tests skip when the 32 MB fixtures are absent.

Features

serde — derive Serialize/Deserialize for partition-kind and entry types.