Crate zfs_forensic 

zfs-forensic — anomaly auditor + CoW deleted-file recovery for ZFS.

ZFS is a copy-on-write pool with a self-checksumming Merkle block tree and a ring of recent pool roots (uberblocks). That structure is the forensic lever this crate pulls:

• F-INTEGRITY (audit_image / audit_findings) emits graded forensicnomicon::report::Findings for structural anomalies: the active uberblock’s ub_rootbp checksum failing against the MOS block it points at (ZFS-UBERBLOCK-CHECKSUM-MISMATCH), the four vdev labels’ nvlist configs disagreeing on pool_guid/txg/ashift (ZFS-LABEL-DIVERGENCE), a reachable metadata block whose blkptr checksum does not verify (ZFS-BLKPTR-CHECKSUM-MISMATCH), and geometry beyond the image (ZFS-IMPOSSIBLE-GEOMETRY).
• F-CARVE (recover_deleted) recovers deleted files from snapshots: it enumerates the datasets by walking the DSL snapshot chain, reads each snapshot’s ZPL root directory, and diffs it against the live filesystem’s root — a file present in the snapshot but absent live was deleted, and its content is carved from the snapshot’s (pinned, un-overwritten) blocks (ZFS-DELETED-FILE-CARVED).

Built on zfs-core for valid-path reading; where the audit must see the raw uberblock ring / DSL bonus the reader does not surface, it uses the low-level accessors (active_uberblock, dsl_dataset_prev_snap) directly (the reader/analyzer-split principle).

Each finding is an observation (“consistent with …”); the examiner draws the conclusions. Mirrors the fleet producer pattern (typed AnomalyKind + impl Observation + audit_* → Vec<Anomaly> + audit_findings → Vec<Finding>), as in xfs-forensic / btrfs-forensic.

Structs

Anomaly

A ZFS structural-integrity anomaly: an observation graded by severity, with a stable code and note derived from its AnomalyKind so they cannot drift.

RecoveredFile

A file recovered from a ZFS snapshot: present in a snapshot’s ZPL root directory but absent from the live filesystem, so it was deleted. Its content was carved from the snapshot’s (pinned, un-overwritten) blocks.

Enums

AnomalyKind

Classification of a ZFS structural-integrity anomaly (F-INTEGRITY). Each variant carries the evidence needed to reproduce the observation.

Severity

Severity of a forensic finding (Info < Low < Medium < High < Critical).

Functions

audit_findings

Audit an image and convert each F-INTEGRITY anomaly to a canonical Finding tagged with scope.

audit_image

Audit a whole ZFS image for structural-integrity anomalies (F-INTEGRITY): parse the L0 vdev label, verify the active uberblock’s rootbp checksum against the MOS block, check the four vdev labels’ configs for divergence, sweep the reachable MOS/objset tree for blkptr checksum mismatches, and guard against impossible geometry.

recover_deleted

Recover deleted files from ZFS snapshots over a whole image (F-CARVE).