Disk-Forensic Umbrella — Test-Fixture & Validation Inventory

A single index of test-data provenance and validation across every reader under the disk-forensic umbrella — containers, partition schemes, filesystems, and full-disk encryption. Each row links out to that repo's own docs/validation.md (the correctness evidence) and tests/data/README.md (per-fixture provenance). This page does not duplicate those; it is the map.

Architecture

Evidence enters by one of two parallel paths that converge at the engine: a physical disk stack (container → partition → optional full-disk encryption → filesystem) and a logical-archive path (.zip/.iso/.ad1/.dar/.tar/.7z opened directly as a file tree, bypassing partition + encryption). Both resolve to the same forensic-vfs object contracts (ImageSource · VolumeSystem · EncryptionLayer · FileSystem), peeled by the five *Open opener traits, which the issen, disk-forensic, and 4n6mount consumers navigate. The layer model and the full reader roster are canonical in forensic-vfs — its README reader fleet and docs/architecture.md. Every reader ships a -core reader plus a -forensic graded auditor; the tables below index each one's validation.

VFS contract wiring status

Per-contract wiring is canonical in forensic-vfs and is not duplicated here — see PRD §6 (coverage matrix, grep-verified) and the reader fleet roster (per-reader status by layer). At last verification (2026-07): 5 ImageSource (container) impls + vmdk/dmg via disk-forensic; all 3 VolumeSystem schemes (MBR/GPT/APM) wired; 13 FileSystem impls (10 filesystems + zip/ad1/dar archives); EncryptionLayer (BitLocker/LUKS/FileVault/VeraCrypt) not yet wired.

disk-forensic-specific gap. tar / tar.gz / tar.bz2 / 7z reach the logical path only through the engine's archive layer, not a standalone *-core reader crate; compression codecs (gz, bz2, xz, zstd, lz4) ride inside those archives, not as standalone readers (shown dashed-amber in the diagram above). This inventory tracks the test-data provenance behind each reader; the wiring roster is forensic-vfs's.

The two-path validation model (binding)

Every reader separates two validation paths:

• CI coverage path — runs on every push using only committed, redistributable, small fixtures; enforces the 100%-line coverage gate. Green without any large or license-restricted oracle.
• Tier-1 correctness path — env-gated large / real-world oracles, run locally or nightly; deep correctness. Never gates coverage.

Re-mint is never Tier-1. A mkfs/zpool/qemu-img/newfs image you run yourself is self-authored — Tier-2 by definition, even if byte-identical. The only clone-and-reproduce path to a Tier-1 claim is downloading the same third-party / real-world artifact. A repo with no downloadable third-party oracle has no Tier-1 path and is capped at Tier-2 (stated plainly, never dressed up).

Provenance must be clone-reproducible. For every Tier-1 oracle the repo's docs/validation.md records all six of: what it is + who authored it, a hotlinked download URL, md5/sha256, license/redistribution, the env var, and the exact ENV=/path cargo test … command — so a stranger with a clean clone can rebuild the full validation.

Legend. Tier column: T1 = downloadable third-party / real-world oracle · T2 = self-mint or crafted · T1(committed) = a third-party image small enough to commit (in-repo, excluded from the crate tarball). Status: ✅ = clone-reproducible provenance verified · ⏳ = pending the umbrella provenance sweep.

Filesystems

Repo	Tier	Primary oracle	validation	fixtures	Status
xfs-forensic	T1(committed) + T1	dfvfs xfs_dfvfs.raw (Apache-2.0) + bigtime image	validation.md	tests/data	✅
btrfs-forensic	T1 + T2	Fedora Cloud Base 41 (download) + self-mint del oracle	validation.md	tests/data	✅
zfs-forensic	T1 ×2	FreeBSD 14.3 ZFS-root + ZoL 0.6.1 (both download)	validation.md	tests/data	✅
ufs-forensic	T1(committed)	dfvfs ufs2.raw (Apache-2.0)	validation.md	tests/data	✅
refs-forensic	no T1 (T2 only)	reverse-engineered; no public ReFS corpus exists	validation.md	tests/data	✅ (honest T2 cap)
ntfs-forensic	⏳	5 env-gated oracles	validation.md	tests/data	⏳ sweep
ext4fs-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep
apfs-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep
hfsplus-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep
iso9660-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep
udf-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep
fat-forensic	⏳	committed fixtures	(local-only, not yet pushed)	—	⏳ sweep

Full-disk encryption (crypto / FDE)

Repo	Tier	Primary oracle	validation	fixtures	Status
bitlocker-forensic	⏳	dfvfs bdetogo.raw (T1) + self-mint XTS	validation.md	tests/data	⏳ sweep
filevault-forensic	⏳	dfvfs fvdetest.qcow2 (T1)	validation.md	tests/data	⏳ sweep
luks-forensic	⏳	self-mint cryptsetup oracle (T2)	validation.md	tests/data	⏳ sweep
veracrypt-forensic	⏳	4 env-gated oracles	validation.md	tests/data	⏳ sweep

Partition schemes

Repo	Tier	Primary oracle	validation	fixtures	Status
gpt-partition-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep
apm-partition-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep
mbr-partition-forensic	⏳	committed fixtures	validation.md	tests/data	⏳ sweep

Containers

Repo	Tier	Primary oracle	validation	fixtures	Status
ewf	⏳	real EnCase E01 (via disk-forensic)	(reader; see disk-forensic)	—	⏳ sweep
ewf-forensic	⏳	E01 structural fixtures	validation.md	—	⏳ sweep
vmdk-forensic	⏳	qemu-img VMDK (T2) + real-artifact CI	validation.md	tests/data	⏳ sweep
vhdx-forensic	⏳	qemu-img VHDX (T2)	validation.md	tests/data	⏳ sweep
vhd-forensic	⏳	qemu-img VHD (T2)	validation.md	—	⏳ sweep
qcow2-forensic	⏳	qemu-img qcow2 + CirrOS (T1)	validation.md	tests/data	⏳ sweep
aff4-forensic	⏳	spec-faithful builder	validation.md	—	⏳ sweep
dmg-forensic	⏳	hdiutil DMG (T2)	validation.md	—	⏳ sweep
ad1-forensic	⏳	spec-faithful builder	validation.md	tests/data	⏳ sweep
zip-forensic	⏳	archive/logical (FileSystem)	validation.md	—	⏳ sweep
dar-forensic	⏳	Disk ARchiver, archive/logical (FileSystem)	validation.md	—	⏳ sweep

Orchestrator

Repo	Role	validation
disk-forensic	wires container → partition → filesystem fingerprinting; real EnCase E01 + real NTFS boot (DEF CON DFIR CTF)	VALIDATION.md

Sweep status. The five filesystem repos (xfs, btrfs, zfs, ufs, refs) are ✅ clone-reproducible. The ⏳ rows carry validation but have not yet been leveled to the full six-field clone-reproducible standard; the Tier shown for them is a best-known summary pending that pass, not a verified claim. This inventory is updated as each repo is swept.

Maintenance — a disk-forensic pre-publish action

This inventory + the architecture diagram are the map every downstream reader and consumer trusts, so they must reflect true wiring at release time. Regenerate them before publishing disk-forensic (treat a stale map as a publish blocker — a diagram that claims a reader is integrated when it is not is the dangling-link failure applied to architecture):

1. Re-run the wiring audit — adapter presence per object contract, per repo and branch (an adapter on an unmerged feat/* branch is not "wired to main"):

   for r in <umbrella repos>; do
     git -C "$r" grep -lE 'impl (ImageSource|VolumeSystem|EncryptionLayer|FileSystem) for' \
       $(git -C "$r" branch --format='%(refname:short)') -- '*.rs'
   done
   

2. Reconcile the wiring status in forensic-vfs, not here — the per-contract coverage matrix is canonical in forensic-vfs PRD §6 and the reader fleet roster; this page links to them rather than keeping a second copy.
3. Regenerate docs/assets/umbrella-architecture.svg via the architecture-diagram skill and render-verify it (no overlaps, legend outside boxes, text within boxes), keeping its trait labels in step with the forensic-vfs *Open / object-contract model.
4. mkdocs build --strict must pass (no broken image/nav links).