Skip to main content

Crate dar_forensic

Crate dar_forensic 

Source
Expand description

Pure-Rust reader for Denis Corbin DAR (Disk ARchiver) archives.

Supports DAR formats 7–11 (produced by dar 2.3–2.8) and the legacy ≤7 grammar. Passware Kit Mobile produces format-9 archives; dar 2.8.5 produces 11.3. Entries and the catalogue compressed with gzip, bzip2 or xz are transparently decompressed (pure-Rust); lzo, zstd, lz4 and encryption are not decoded.

§Format sketch

Slice header:
  [4]  magic = 00 00 00 7b  (SAUV_MAGIC_NUMBER = 123, big-endian u32)
  [10] internal_name label
  [1]  flag  [1]  ext_char
  TLV list:  infinint(count) + count × (u16 type + infinint len + data)
  ← archive_origin: all catalog archive_offset values are relative to here

Archive body:
  escaped sequences (seqt_file, seqt_saved, …) + raw file bytes

Catalog  (located by seqt_catalogue escape: AD FD EA 77 21 43):
  [10] label  +  (NUL working-dir path, format 11.1+ only)  +  entries

  Each entry: cat_sig byte where (cat_sig & 0x1f | 0x60) gives type
    'd' directory  → NUL-name + inode [+ FSA]  (push to dir stack)
    'f' file       → NUL-name + inode [+ FSA] + file-specific fields
    'z' EOD        → pop dir stack; depth=0 → done

§Key non-obvious invariants

  • Infinint: variable-length. The common form is 5 bytes (0x80 XX XX XX XX, a big-endian u32); timestamps past 2^32 use the 9-byte 0x40 form (big-endian u64). Encodings wider than 64 bits are rejected as corrupt — this reader decodes to u64 or errors, never truncates.
  • Permissions: 2-byte big-endian u16, not an infinint.
  • Timestamps: format 8 stores a bare seconds infinint; format 9+ prefix a unit byte ('s'/'u'/'n') and add a sub-second infinint for 'u'/'n'.
  • FSA (format 9+ only): inode flag bit 0x10 (FSA-full) adds inode infinints and an FSA block; format 8 has no FSA.
  • archive_offset: points directly to the raw file bytes, not to the data-section header that precedes them in the body stream. seek(archive_origin + archive_offset) then read(stored_size).

Full format notes: docs/implementation-notes.md.

Structs§

DarEntry
Metadata about one archived file.
DarReader
Read-only DAR archive reader.

Enums§

DarError
Errors returned by DarReader.