Skip to main content

parse_udf_state_checked

udf_forensic

Function parse_udf_state_checked 

Source 
pub fn parse_udf_state_checked<R: Read + Seek>(
    reader: &mut R,
) -> Result<Option<UdfState>, Error>
Expand description

Parse the AVDP → VDS → FSD bootstrap chain, distinguishing a real read failure from a structural negative.

  • Err(io) — a seek/read I/O error reading the anchor (LBA 256), the Volume Descriptor Sequence, or the File Set Descriptor. This includes io::ErrorKind::UnexpectedEof when the image is truncated before the anchor, which is itself forensically suspicious and must surface rather than masquerade as “not UDF”.
  • Ok(None) — every read succeeded but the structure is not valid UDF (the anchor tag is not an AVDP, or the descriptor chain is absent/incoherent). This is the legitimate “not UDF” case.
  • Ok(Some(state)) — a valid UDF structure.