Documentação: inglês como versão principal e português em *.pt-BR.md

README, ROADMAP, CHANGELOG, CONTRIBUTING, SECURITY e docs/ passam a ter a versão principal em inglês. As versões em português ficam em *.pt-BR.md e docs/pt-BR/, com seletor de idioma no topo de cada arquivo. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RRZm8uTVN3WLTwcbrDQAUM
2026-10-20 09:48:51 -03:00
1 parent 3755fc7d2a
commit b93ad02a0e
@@ -0,0 +1,104 @@
+# What Guará supports
+
+[English](support.md) · [Português](pt-BR/suporte.md)
+
+Matrix of what exists today (version 1.0.0). For what comes next, see the [ROADMAP](../ROADMAP.md).
+
+## Partition tables
+
+MBR and GPT. When the table fails, Guará searches for volumes by signature (NTFS, FAT, exFAT, ext, APFS, HFS+, BitLocker, LUKS) and also examines the **unpartitioned space**.
+
+## File systems
+
+"Metadata" means Guará reads the file system structure and returns **name, folder and dates**. Without it, recovery depends only on carving, which returns the content without a name.
+
+| File system | Metadata | What is used | Limits |
+|---|---|---|---|
+| NTFS | ✅ | MFT, deleted records, creation, modification and access dates | Compressed and EFS files are skipped or marked as incomplete; attribute list handled partially |
+| FAT12/16/32 | ✅ | Deleted entries, long names, dates | |
+| exFAT | ✅ | Deleted entries, dates | Covered by a synthetic image; needs validation on more real media |
+| ext2/3/4 | ✅ | Deleted inodes, old copies in the journal (ext4), free block map | |
+| HFS+ | ✅ | Leftovers of catalog tree nodes, journal | |
+| Btrfs | ✅ | Old versions of the trees; zlib, zstd and lzo extents | |
+| XFS | ✅ | Freed inodes, names of freed entries, free space per group | Deletion tested only in simulation |
+| APFS | 🟡 | Container, object map, file tree, snapshots, old nodes | No free-space map; deletion tested only in simulation |
+| ReFS | ❌ | Only detected | Recovery through carving |
+| Storage Spaces | ❌ | Not supported | |
+
+In every case carving keeps running on the free space and the result is merged without duplicates.
+
+## Encrypted volumes
+
+Guará opens the volume with the **password or key you provide**, mounts a virtual disk and scans inside it. It does not crack passwords.
+
+| Format | Accepted credentials |
+|---|---|
+| BitLocker | Password, recovery key (8 groups of 6 digits), `.BEK` file, clear key |
+| LUKS1 and LUKS2 | Password, key file, volume key |
+| FileVault 2 (Core Storage) | Password, recovery key, volume key |
+
+Passwords are **never** written to the session file. With `--remember-keys` the session stores the already derived volume key, not the password. In the terminal, prefer `--ask-password` or the `GUARA_PASSWORD` variable over `--password`, which stays in the shell history.
+
+## RAID and LVM
+
+| Item | Support |
+|---|---|
+| RAID 0, 1, 4, 5, 6, 10 and linear from mdadm superblocks | ✅ including degraded (use `-` in `--member` for a missing disk) |
+| RAID without metadata | ✅ `--raid` discovers level, stripe size, layout and order; `--raid-level`, `--raid-chunk-kb`, `--raid-layout` and `--raid-order` fix what you already know |
+| LVM2 | ✅ linear, striped, mirrored and RAID |
+| Storage Spaces | ❌ |
+
+## Forensic images
+
+| Format | Read | Write |
+|---|---|---|
+| Raw (dd, `.img`) | ✅ | ✅ with a bad sector error map |
+| E01 and Ex01 (Expert Witness) | ✅ | ✅ with case metadata and segmentation |
+| AFF4 | ✅ | ✅ |
+
+`guara verify` recomputes the MD5 of an E01 or Ex01 image and compares it with the one stored in it.
+
+## Carving: formats recognized by structure
+
+The detectors read headers, blocks and internal sizes to return the **exact size** and a **confidence**, instead of cutting at a fixed number of bytes.
+
+| Family | Formats |
+|---|---|
+| Image | JPEG, PNG, GIF, BMP, TIFF, ICO, HEIC, WebP |
+| Document | PDF, DOC/XLS/PPT (OLE), DOCX/XLSX/PPTX/ODF/EPUB (ZIP), RTF |
+| Video and audio | MP4/MOV, AVI, WAV, MP3, Matroska/WebM, Ogg, MPEG-TS, FLV, ASF/WMV, MIDI |
+| Compressed | ZIP, 7z, RAR, gzip, zstd, ar |
+| Database and system | SQLite, Windows registry (regf), EVTX, PST, pcap/pcapng, EXE/DLL (PE), ELF, SWF |
+
+### Fragmented files
+
+- **JPEG:** reassembled from up to three fragments (`jpegscan.rs`, `defrag.rs`).
+- **MP4/MOV without an index (`moov`):** the index is rebuilt from an intact video from the **same camera or drone**, passed with `--reference`. Works with H.264 and HEVC. Audio is not reconstructed.
+- Other formats only come out whole if they are contiguous; otherwise they come out truncated with low confidence.
+
+## Metadata and preview
+
+| Type | What is read |
+|---|---|
+| Photos | EXIF: camera, lens, serial number, date, GPS |
+| PDF | Author, program, dates |
+| Office and OpenDocument | Author, last modified by, company |
+| MP4/MOV | Recording date, duration, resolution |
+| SQLite | Schema, tables, blobs, dates, deleted rows from the free space of pages |
+
+The preview is read straight from the disk, without writing anything: image, video, audio, PDF, text, Office, ZIP and hex.
+
+## Platforms
+
+| | CLI | Interface | Tests with real images |
+|---|---|---|---|
+| Linux | ✅ | ✅ AppImage and deb | ✅ |
+| Windows | ✅ | ✅ msi and exe | build and synthetic tests only |
+| macOS | ✅ | ✅ dmg | build and synthetic tests only |
+
+## What Guará does not do
+
+- Recover **overwritten** data. On an SSD with TRIM the disk itself may zero deleted blocks.
+- Unlock phones or bypass passwords and security locks.
+- Replace a mobile device extraction tool.
+- Produce a report with forensic validity by itself: it has not been through external validation (NIST CFTT) yet. See the [ROADMAP](../ROADMAP.md).