Crate udf_forensic 

UDF (Universal Disk Format) — detection and file-entry traversal.

UDF bridge discs carry both ISO 9660 and UDF structures on the same sectors. The UDF recognition sequence starts at sector 16: each Volume Structure Descriptor is 2048 bytes with a 5-byte identifier at bytes 1-5.

Identifiers: “BEA01” (Extended Area Descriptor), “NSR02” or “NSR03” (OSTA CS0 UDF mark), “TEA01” (Terminating Extended Area Descriptor). NSR02/NSR03 presence is the definitive UDF indicator.

Full UDF traversal

Descriptor chain: AVDP (LBA 256) → VDS → Partition Descriptor (partition start LBA) + Logical Volume Descriptor (FSD location) → File Set Descriptor (root dir FE LBA) → File Entry → File Identifier Descriptors.

All physical LBAs satisfy: phys_lba = partition_start + logical_block_num.

Modules

findings

UDF forensic findings: graded anomaly classification over the parsed ECMA-167 / OSTA structures.

Structs

UdfFileEntry

A single entry returned by UDF directory traversal.

UdfState

Enums

Severity

The canonical 5-level severity scale, re-exported at the crate root for convenience (the analyzer grades every finding on it). Severity of a forensic finding (Info < Low < Medium < High < Critical).

UdfPartitionKind

The kind of partition referenced by the UDF logical volume’s file set.

Functions

detect_udf

True if the image has a UDF recognition sequence (NSR02 or NSR03).

parse_udf_state

Try to parse the AVDP → VDS → FSD chain, returning state needed for directory traversal. Returns None if the image lacks a valid UDF structure.

parse_udf_state_checked

Parse the AVDP → VDS → FSD bootstrap chain, distinguishing a real read failure from a structural negative.

read_dir_at_lba

Read all non-parent File Identifier Descriptors from the directory whose File Entry resides at dir_fe_lba, returning one UdfFileEntry per child.

read_fe_data

Read the data extent of the File Entry at fe_lba.