mbr_forensic/
lib.rs

1//! # mbr-forensic
2//!
3//! Forensic-grade Master Boot Record (MBR) parser. Goes beyond partition
4//! enumeration to surface structural anomalies, slack-space content,
5//! anti-forensic indicators, and cross-field inconsistencies that other
6//! MBR crates silently ignore.
7//!
8//! ## Entry points
9//!
10//! ```no_run
11//! use mbr_forensic::{parse_mbr_sector, analyse};
12//! use std::fs::File;
13//!
14//! // Pure parsing from a 512-byte buffer (no I/O required):
15//! let buf = [0u8; 512];
16//! let sector = parse_mbr_sector(&buf)?;
17//!
18//! // Full forensic analysis from a seekable reader:
19//! let mut f = File::open("disk.img")?;
20//! let analysis = analyse(&mut f, 1 << 30)?;
21//! for anomaly in &analysis.anomalies {
22//!     println!("[{:?}] {}", anomaly.severity, anomaly.note);
23//! }
24//! # Ok::<(), mbr_forensic::Error>(())
25//! ```
26
27pub mod boot_code;
28pub mod bootkit;
29pub mod carve;
30pub mod disk_signature;
31pub mod ebr;
32pub mod entropy;
33pub mod findings;
34pub mod gap;
35pub mod gpt;
36pub mod mbr;
37pub mod partition;
38pub mod provenance;
39pub mod report;
40pub mod signature;
41pub mod vbr;
42pub mod wipe;
43
44mod analyse;
45mod diag;
46
47pub use analyse::{analyse, analyse_with_options, AnalyseOptions};
48pub use boot_code::BootCodeId;
49pub use disk_signature::{find_signature_collisions, SignatureCollision};
50pub use ebr::{EbrChain, EbrEntry};
51pub use findings::{Anomaly, AnomalyKind, MbrAnalysis, PartitionSummary, Severity};
52pub use gap::Gap;
53pub use mbr::{parse_mbr_sector, MbrSector};
54pub use partition::{Chs, PartitionEntry, PartitionFamily, TypeCode};
55pub use provenance::{Alignment, PartitioningEra};
56pub use signature::DetectedFs;
57
58/// Crate-level error type.
59#[derive(Debug, thiserror::Error)]
60pub enum Error {
61    #[error("sector too short: expected 512 bytes, got {0}")]
62    TooShort(usize),
63    #[error("invalid MBR boot signature: expected 0x55AA, got 0x{0:04X}")]
64    BadSignature(u16),
65    #[error("I/O error: {0}")]
66    Io(#[from] std::io::Error),
67}
mbr_forensic/lib.rs

mbr_forensic/
lib.rs
