Crate iso9660_forensic 

Pure-Rust forensic ISO 9660 reader.

Handles multi-session discs, Rock Ridge (RRIP), Joliet (UCS-2 filenames), El Torito boot images, and 2352-byte raw CD sectors.

Re-exports

pub use error::IsoError;

pub use file_reader::IsoFileReader;

pub use pvd::IsoDateTime;

pub use sector::SectorMode;

pub use audit::BothEndianMismatch;

pub use audit::GapHit;

pub use audit::PreSysHit;

pub use audit::SlackHit;

pub use audit::SymlinkIssue;

pub use dir::DirRecord;

pub use dir::FILE_FLAG_MULTI_EXTENT;

Modules

audit

Forensic audit types for ISO 9660 structural integrity checks.

bw5

BlindWrite 5/6/7 (.b5t/.b6t) TOC image detection.

ccd

CloneCD .ccd control-file parser.

cdi

DiscJuggler (CDI) image detection and track-table decoding.

cdtext

CD-Text decoding (MMC-3 Annex J).

cdtoc

CD Table of Contents and disc identification.

cue

CUE sheet parser for BIN/CUE disc images.

dir

ISO 9660 Directory Record parsing and iteration.

el_torito

El Torito boot specification — CD bootable images.

error

file_reader

Streaming file reader (IsoFileReader) implementing std::io::Read.

findings

ISO 9660 forensic findings: severity, anomaly classification, and the analysis result.

mds

Alcohol 120% MDS/MDF image parser.

nrg

Nero NRG image parser.

offset

A windowing adapter that presents a byte sub-range of a Read + Seek as a standalone stream starting at offset 0.

path_table

ISO 9660 Path Table parsing and Type-L ↔ Type-M cross-validation.

pvd

ISO 9660 Volume Descriptor parsing.

rock_ridge

Rock Ridge Interchange Protocol (RRIP) — IEEE P1282 System Use extensions.

sector

Sector abstraction: 2048-byte ISO mode and 2352-byte raw CD mode.

session

Multi-session ISO support.

subq

CD subchannel Q decoding (ECMA-130 §22).

toc

CDRDAO .toc parser for TOC/BIN optical images.

Structs

AnalyseOptions

Options controlling analyse_with_options. Currently empty; reserved for future toggles (slack carving, full directory-record redundancy walk, …).

BootRecord

One El Torito boot entry, summarised for the provenance report.

FileHash

SHA-256 hash of a file in the ISO.

IsoAnalysis

Result of a forensic analysis of an ISO 9660 volume.

IsoReader

Forensic ISO 9660 reader.

IsoVolumeInfo

Volume provenance summary — the authoring/context “breadcrumbs” a forensic report leads with. All fields are observations from the active session’s PVD.

LostFile

A file found inside an orphaned directory extent — present on the disc but not reachable from the active directory tree (a recovered “lost” file).

PathTableAudit

Result of comparing the L-path table against the directory tree.

TimelineEntry

A directory entry with its modification timestamp for timeline analysis.

ToolFingerprint

Mastering-tool identification based on PVD metadata patterns.

WalkEntry

A single entry produced by IsoReader::walk.

Constants

MAX_DIR_SIZE

Maximum bytes that read_dir will allocate for a single directory.

MAX_WALK_DEPTH

Maximum directory nesting depth for IsoReader::walk.

Traits

ReadSeek

A seekable byte source, type-erased so the different container resolutions (plain file, offset-windowed track) unify behind one return type.

Functions

analyse

Forensically analyse an ISO 9660 image.

analyse_with_options

Like analyse, with explicit AnalyseOptions.

open

Open an optical image by path, resolving its container to a Read + Seek over the ISO 9660 data track.