Crate ufs_forensic 

ufs-forensic — anomaly auditor + deleted-file recovery for UFS/FFS.

UFS (the Unix File System / Berkeley FFS) leaves rich forensic residue on delete: an rm clears the directory entry’s d_ino and the cylinder-group inode-used bit but leaves the dinode’s di_size/di_db and the data blocks intact until they are re-allocated. That residue is the lever this crate pulls:

• F-INTEGRITY (audit_image / audit_findings) emits graded forensicnomicon::report::Findings for structural anomalies: an invalid superblock magic (UFS-SUPERBLOCK-MAGIC-INVALID), a per-cylinder-group backup superblock whose geometry diverges from the primary (UFS-BACKUP-SUPERBLOCK-DIVERGENCE), a cylinder-group header with a bad magic (UFS-CG-MAGIC-INVALID), an allocated inode reachable by no directory entry (UFS-ORPHANED-INODE), and geometry beyond the image (UFS-IMPOSSIBLE-GEOMETRY).
• F-CARVE (recover_deleted) recovers deleted files and directory entries: d_ino == 0 dirent slots whose residual d_name survives, and inodes free in the cg bitmap that still carry a valid di_mode/di_size/ di_db (UFS-DELETED-FILE-CARVED / UFS-DELETED-DIRENT). Recovery is state-dependent: it succeeds while the freed dinode and data blocks are un-reallocated, and returns nothing rather than fabricate once the residue is gone.

Built on ufs-core for valid-path reading; where the audit must see slack and freed structure the reader normalizes away (a d_ino == 0 slot, a bitmap-free-but-intact dinode, the raw backup-superblock bytes), it parses the raw bytes directly (the reader/analyzer-split principle).

Each finding is an observation (“consistent with …”); the examiner draws the conclusion. Mirrors the fleet producer pattern (typed AnomalyKind + impl Observation + audit_image → Vec<Anomaly> + audit_findings → Vec<Finding>), as in xfs-forensic / zfs-forensic / btrfs-forensic.

Structs

Anomaly

A UFS structural-integrity anomaly: an observation graded by severity, with a stable code and note derived from its AnomalyKind so they cannot drift.

ReaderCylinderGroup

Parsed cylinder-group header — the per-group allocation map.

ReaderSuperblock

Parsed UFS superblock — geometry and addressing fields the cylinder-group and inode decode (P1) need.

Enums

AnomalyKind

Classification of a UFS structural-integrity anomaly (F-INTEGRITY). Each variant carries the evidence needed to reproduce the observation.

RecoveredItem

One recovered item from the deleted-residue sweep (F-CARVE).

Severity

Severity of a forensic finding (Info < Low < Medium < High < Critical).

UfsVersion

The on-disk UFS version, resolved from the superblock magic.

Functions

audit_findings

Audit an image and convert each F-INTEGRITY anomaly to a canonical Finding tagged with scope.

audit_image

Audit a whole UFS/FFS filesystem partition (filesystem byte 0 — a caller holding a whole disk image slices past the BSD-disklabel partition base first) for structural-integrity anomalies (F-INTEGRITY): parse the primary superblock, walk every cylinder group (backup-superblock divergence + header magic), diff the allocated-inode set against the reachable-inode set (orphans), and guard against impossible geometry.

recover_deleted

Recover deleted files and directory entries from a UFS/FFS filesystem partition (F-CARVE).