mbr_forensic/
lib.rs

1//! # mbr-forensic
2//!
3//! Forensic-grade Master Boot Record (MBR) parser. Goes beyond partition
4//! enumeration to surface structural anomalies, slack-space content,
5//! anti-forensic indicators, and cross-field inconsistencies that other
6//! MBR crates silently ignore.
7//!
8//! ## Entry points
9//!
10//! ```no_run
11//! use mbr_forensic::{parse_mbr_sector, analyse};
12//! use std::fs::File;
13//!
14//! // Pure parsing from a 512-byte buffer (no I/O required):
15//! let buf = [0u8; 512];
16//! let sector = parse_mbr_sector(&buf)?;
17//!
18//! // Full forensic analysis from a seekable reader:
19//! let mut f = File::open("disk.img")?;
20//! let analysis = analyse(&mut f, 1 << 30)?;
21//! for anomaly in &analysis.anomalies {
22//!     println!("[{:?}] {}", anomaly.severity, anomaly.note);
23//! }
24//! # Ok::<(), mbr_forensic::Error>(())
25//! ```
26
27pub mod boot_code;
28pub mod bootkit;
29pub mod carve;
30pub mod disk_signature;
31pub mod ebr;
32pub mod entropy;
33pub mod findings;
34pub mod gap;
35pub mod gpt;
36pub mod mbr;
37pub mod partition;
38pub mod provenance;
39pub mod signature;
40pub mod vbr;
41pub mod wipe;
42
43mod analyse;
44mod diag;
45
46pub use analyse::{analyse, analyse_with_options, AnalyseOptions};
47pub use boot_code::BootCodeId;
48pub use disk_signature::{find_signature_collisions, SignatureCollision};
49pub use ebr::{EbrChain, EbrEntry};
50pub use findings::{Anomaly, AnomalyKind, MbrAnalysis, PartitionSummary, Severity};
51pub use gap::Gap;
52pub use mbr::{parse_mbr_sector, MbrSector};
53pub use partition::{Chs, PartitionEntry, PartitionFamily, TypeCode};
54pub use provenance::{Alignment, PartitioningEra};
55pub use signature::DetectedFs;
56
57/// Crate-level error type.
58#[derive(Debug, thiserror::Error)]
59pub enum Error {
60    #[error("sector too short: expected 512 bytes, got {0}")]
61    TooShort(usize),
62    #[error("invalid MBR boot signature: expected 0x55AA, got 0x{0:04X}")]
63    BadSignature(u16),
64    #[error("I/O error: {0}")]
65    Io(#[from] std::io::Error),
66}
mbr_forensic/lib.rs

mbr_forensic/
lib.rs
