Formatação (cargo fmt) e ajustes do clippy para o CI da 1.0.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Versão 1.0.0: interface com senha, RAID, referência de vídeo e formatos de imagem; changelog
2026-10-19 11:41:58 -03:00 · 2026-10-19 01:37:07 -03:00 · 2026-10-19 01:33:14 -03:00 · 2026-10-19 00:23:47 -03:00 · 2026-10-19 00:19:47 -03:00 · 2026-10-19 00:15:04 -03:00
131 changed files with 18885 additions and 399 deletions
@@ -2,6 +2,33 @@

 Formato baseado em [Keep a Changelog](https://keepachangelog.com/pt-BR/1.1.0/); versões seguem SemVer.

+## [1.0.0] - 2026-10-19
+
+### Adicionado
+- **Sistemas de arquivos com metadados:** ext4 (inodes apagados e cópias antigas no diário), HFS+ (sobras de nós e diário), Btrfs (versões antigas das árvores; extensões zlib, zstd e lzo), XFS (inodes liberados e nomes de entradas liberadas) e APFS (instantâneos e nós antigos). ReFS ainda é só detectado.
+- **Volumes cifrados:** BitLocker (senha, chave de recuperação, .BEK, chave limpa), LUKS1/LUKS2 e FileVault 2 (Core Storage) abrem com a senha ou a chave e são varridos por dentro. As senhas nunca vão para o arquivo de sessão.
+- **RAID e LVM:** RAID 0, 1, 4, 5, 6, 10 e linear a partir de superblocos do mdadm, inclusive degradado; descoberta automática de nível, faixa, layout e ordem quando não há metadados; LVM2 (linear, em faixas, espelhado e RAID).
+- **Imagens forenses:** leitura de E01/Ex01 e AFF4; gravação de E01 e AFF4; comando `guara verify`.
+- **Carving:** JPEG fragmentado remontado (até três fragmentos), reconstrução do índice de MP4/MOV sem moov (H.264/HEVC, com vídeo de referência) e 24 formatos reconhecidos pela estrutura.
+- **Interface:** campos de senha, RAID, vídeo de referência e formato da imagem.
+
+### Corrigido
+- Abrir de novo uma sessão recente já aberta não cria mais cópias iguais na aba de sessões.
+
+### Limitações
+- Storage Spaces e ReFS (metadados) não suportados; XFS e APFS testados com exclusões simuladas; áudio não é reconstruído em MP4 sem moov.
+
+## [0.6.0] - 2026-10-18
+
+### Adicionado
+- **Saúde do disco no estilo do CrystalDiskInfo:** a tela do dispositivo mostra o estado (Bom, Atenção, Ruim) com a % de vida útil restante em SSD, temperatura, horas ligado, vezes ligado, total lido e total gravado. Também traz a ficha do dispositivo (modelo, firmware, nº de série, interface, modo de transferência, capacidade, rotação, formato e recursos como TRIM) e a tabela completa de atributos SMART, com ID, valor atual, pior, limite e bruto, e um indicador por atributo. Funciona com discos ATA/SATA e NVMe (nos NVMe, os campos do log de saúde viram a tabela).
+- **Partições:** ao abrir uma partição (`/dev/sda1`, `/dev/nvme0n1p2`, `/dev/disk2s1`), o SMART é lido do disco que a contém, e a tela avisa isso.
+- **Comando `guara health`** no terminal, com saída legível ou `--json`.
+
+### Alterado
+- Um atributo SMART com valor normalizado no limite de falha (ou abaixo dele) agora marca o disco como "Ruim", mesmo que a autoavaliação geral ainda passe.
+- **Nova logo:** a cabeça do lobo-guará recortada das trilhas de um disco, inteiras de um lado (recuperado) e quebradas do outro (perdido), nas cores do app. Na interface ela acompanha o tema escolhido (claro ou escuro).
+
 ## [0.5.0] - 2026-10-18

 ### Adicionado
@@ -8,6 +8,17 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"

+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -58,6 +69,27 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "arbitrary"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"
+dependencies = [
+ "derive_arbitrary",
+]
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+]
+
 [[package]]
 name = "ascii"
 version = "1.1.0"
@@ -70,12 +102,27 @@ version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"

+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bitflags"
 version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"

+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -94,18 +141,45 @@ dependencies = [
 "objc2",
 ]

+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
 [[package]]
 name = "bytemuck"
 version = "1.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"

+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "byteorder-lite"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"

+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "bzip2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c"
+dependencies = [
+ "libbz2-rs-sys",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.5"
@@ -124,6 +198,16 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e4de3bc4ea267985becf712dc6d9eed8b04c953b3fcfb339ebc87acd9804901"

+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
 [[package]]
 name = "clap"
 version = "4.6.7"
@@ -155,7 +239,7 @@ dependencies = [
 "heck",
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.9",
 ]

 [[package]]
@@ -194,6 +278,12 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -215,6 +305,17 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "derive_arbitrary"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b034bd7d5f032402a2479444dcc6f74e36a03f31854d41680fb240ef682a1ac"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -223,6 +324,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
 "block-buffer",
 "crypto-common",
+ "subtle",
 ]

 [[package]]
@@ -237,6 +339,12 @@ dependencies = [
 "objc2",
 ]

+[[package]]
+name = "equivalent"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00d174d5400e5e8fd687ad1049e2f578285fa914201b1af7e8b112a4546bd826"
+
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -317,42 +425,69 @@ dependencies = [

 [[package]]
 name = "guara-cli"
-version = "0.5.0"
+version = "1.0.0"
 dependencies = [
 "clap",
 "ctrlc",
 "getrandom 0.2.17",
 "guara-core",
+ "rpassword",
 "serde_json",
 "tiny_http",
 ]

 [[package]]
 name = "guara-core"
-version = "0.5.0"
+version = "1.0.0"
 dependencies = [
+ "aes",
+ "argon2",
+ "bzip2",
 "flate2",
+ "hmac",
 "image",
 "jpeg-decoder",
 "jpeg-encoder",
 "libc",
+ "lz4_flex",
 "md-5",
+ "mp4",
+ "pbkdf2",
+ "ripemd",
+ "ruzstd",
 "serde",
 "serde_json",
 "sha1",
 "sha2",
+ "snap",
 "tempfile",
- "thiserror",
+ "thiserror 2.0.21",
 "tiny_http",
 "windows-sys 0.59.0",
+ "zip",
 ]

+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
 [[package]]
 name = "heck"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"

+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "httpdate"
 version = "1.0.3"
@@ -385,6 +520,25 @@ dependencies = [
 "quick-error",
 ]

+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -409,6 +563,12 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b454d911ac55068f53495488d8ccd0646eaa540c033a28ee15b07838afafb01f"

+[[package]]
+name = "libbz2-rs-sys"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"
+
 [[package]]
 name = "libc"
 version = "0.2.191"
@@ -427,6 +587,12 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"

+[[package]]
+name = "lz4_flex"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
+
 [[package]]
 name = "md-5"
 version = "0.10.6"
@@ -473,6 +639,20 @@ dependencies = [
 "pxfm",
 ]

+[[package]]
+name = "mp4"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9ef834d5ed55e494a2ae350220314dc4aacd1c43a9498b00e320e0ea352a5c3"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "num-rational",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "nix"
 version = "0.31.3"
@@ -485,6 +665,37 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -521,6 +732,27 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"

+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core",
+ "subtle",
+]
+
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest",
+ "hmac",
+]
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -570,6 +802,42 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"

+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "ripemd"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "rpassword"
+version = "7.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
+dependencies = [
+ "libc",
+ "rtoolbox",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rtoolbox"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a1efe12a1469752d0e6ff5ebec0b6ef4924cc5c4c71046b0ec730040535819d"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.5"
@@ -583,6 +851,15 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "ruzstd"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fad02996bfc73da3e301efe90b1837be9ed8f4a462b6ed410aa35d00381de89f"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "serde"
 version = "1.0.229"
@@ -610,7 +887,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.9",
 ]

 [[package]]
@@ -654,12 +931,41 @@ version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"

+[[package]]
+name = "snap"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "199905e6153d6405f9728fe44daace35f8f837bbf830bb6e85fbd5828709a886"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"

+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn"
 version = "3.0.9"
@@ -684,13 +990,33 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.21",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -701,7 +1027,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn",
+ "syn 3.0.9",
 ]

 [[package]]
@@ -716,6 +1042,16 @@ dependencies = [
 "log",
 ]

+[[package]]
+name = "twox-hash"
+version = "1.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
+dependencies = [
+ "cfg-if",
+ "static_assertions",
+]
+
 [[package]]
 name = "typenum"
 version = "1.20.1"
@@ -840,6 +1176,21 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

+[[package]]
+name = "zip"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dcb24d0152526ae49b9b96c1dcf71850ca1e0b882e4e28ed898a93c41334744"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "crossbeam-utils",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"
@@ -851,3 +1202,15 @@ name = "zmij"
 version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zopfli"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaf7fc5d30c28483d93805c4a5e12b05bbb52407fa67c5f8bd552374cd01fb11"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/guara-core", "crates/guara-cli"]

 [workspace.package]
-version = "0.5.0"
+version = "1.0.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lucasrguerra/guara"
@@ -16,3 +16,7 @@ codegen-units = 1
 opt-level = 3
 strip = true
 panic = "abort"
+
+# Dependências otimizadas também em debug: os testes de cifra fazem milhões de SHA-256.
+[profile.dev.package."*"]
+opt-level = 3
@@ -41,6 +41,7 @@ Ler discos brutos exige privilégios: **administrador** (Windows), `sudo` (Linux
 ```bash
 sudo guara devices                       # discos e pendrives (avisa TRIM e volumes montados)
 sudo guara inspect /dev/sdb              # partições, espaço não particionado, cifragem
+sudo guara health /dev/sdb               # saúde do disco (SMART), requer smartmontools
 sudo guara scan /dev/sdb --session s.json --list      # varredura profunda
 sudo guara scan /dev/sdb --quick         # só metadados (segundos)
 guara scan disco.img --category image,document --min-confidence medium
@@ -117,6 +118,16 @@ Veja [CONTRIBUTING.md](CONTRIBUTING.md). Versões seguem [SemVer](https://semver

 [MIT](LICENSE-MIT) ou [Apache-2.0](LICENSE-APACHE), à sua escolha.

+## Novidades da 1.0.0
+
+Metadados de ext4, HFS+, Btrfs, XFS e APFS; abertura de volumes BitLocker, LUKS e FileVault 2 com senha ou chave; RAID (0/1/4/5/6/10) e LVM remontados, com parâmetros descobertos sozinhos; imagens E01, Ex01 e AFF4; JPEG fragmentado e MP4 sem índice. Detalhes e limitações no [CHANGELOG](CHANGELOG.md).
+
+## Novidades da 0.6.0
+
+- Saúde do disco completa, no estilo do CrystalDiskInfo: estado com % de vida útil, temperatura, horas e vezes ligado, total lido e gravado, ficha do dispositivo (modelo, firmware, interface, modo de transferência, rotação, recursos) e a tabela inteira de atributos SMART (ATA e NVMe).
+- Novo comando `guara health` no terminal.
+- Nova logo: a cabeça do guará recortada das trilhas de um disco.
+
 ## Novidades da 0.5.0

 - Visualizador de bancos SQLite com recuperação de linhas apagadas.
@@ -3,7 +3,7 @@
 [package]
 name = "guara-gui"
 description = "Guará: interface gráfica de recuperação de arquivos"
-version = "0.5.0"
+version = "1.0.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/lucasrguerra/guara"
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+  <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+  <background android:drawable="@color/ic_launcher_background"/>
+</adaptive-icon>
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+  <color name="ic_launcher_background">#FFFFFF</color>
+</resources>
@@ -1,7 +1,7 @@
 {
  "$schema": "https://schema.tauri.app/config/2",
  "productName": "Guara",
-  "version": "0.5.0",
+  "version": "1.0.0",
  "identifier": "dev.guara.app",
  "build": {
    "frontendDist": "../ui"
@@ -494,3 +494,25 @@ dialog.lightbox[open] { display: grid; }
 .xp-tiles { display: grid; grid-template-columns: repeat(3, 1fr); width: 100%; height: 100%; }
 .xp-tiles img { width: 100%; height: 100%; display: block; }
 .xp-pin { position: absolute; width: 14px; height: 14px; margin: -7px 0 0 -7px; border-radius: 50%; background: #0f8f8f; border: 3px solid #fff; box-shadow: 0 1px 4px rgba(0,0,0,.4); }
+
+/* saúde do disco (SMART) */
+.h-tiles { display: grid; grid-template-columns: repeat(auto-fill, minmax(130px, 1fr)); gap: 10px; }
+.h-tile { background: var(--surface); border-radius: 14px; box-shadow: var(--shadow); padding: 12px 14px; display: flex; flex-direction: column; gap: 2px; }
+.h-tile small { color: var(--text-3); font-size: 12px; }
+.h-tile b { font-size: 18px; font-variant-numeric: tabular-nums; }
+.h-tile.warning b { color: var(--warn); } .h-tile.failing b { color: var(--bad); }
+.h-status.ok { background: var(--ok-soft); } .h-status.ok b { color: var(--ok); }
+.h-status.warning { background: var(--warn-soft); } .h-status.failing { background: var(--bad-soft); }
+.h-status b span { font-weight: 500; opacity: .8; }
+.h-info { margin-top: 14px; background: var(--surface); border-radius: 14px; box-shadow: var(--shadow); padding: 14px 16px; }
+.h-scroll { overflow-x: auto; background: var(--surface); border-radius: 14px; box-shadow: var(--shadow); }
+.h-table { width: 100%; border-collapse: collapse; font-size: 13px; font-variant-numeric: tabular-nums; }
+.h-table th { text-align: left; color: var(--text-3); font-weight: 500; padding: 8px 10px; border-bottom: 1px solid var(--line, rgba(127,127,127,.2)); white-space: nowrap; }
+.h-table td { padding: 6px 10px; border-bottom: 1px solid var(--line, rgba(127,127,127,.12)); white-space: nowrap; }
+.h-table tr:last-child td { border-bottom: 0; }
+.h-table .dim { color: var(--text-3); }
+.h-dot { display: inline-block; width: 9px; height: 9px; border-radius: 50%; background: var(--ok); }
+.h-dot.warning { background: var(--warn); } .h-dot.failing { background: var(--bad); }
+
+/* logo inline: segue o tema escolhido no app, não o do sistema */
+.logo .a { stroke: var(--accent); } .logo .b { stroke: var(--accent-2); } .logo .t { fill: var(--text); }
@@ -215,8 +215,11 @@ async function openRecent(r) {
  try {
    const { job } = await rpc('session_load', { path: r.path });
    const st = await rpc('status', { job });
-    const s = { job, target: st.target, label: 'Sessão: ' + st.target.split(/[\\/]/).pop() };
-    S.sessions.unshift(s);
+    let s = S.sessions.find((x) => x.job === job);
+    if (!s) {
+      s = { job, target: st.target, label: 'Sessão: ' + st.target.split(/[\\/]/).pop() };
+      S.sessions.unshift(s);
+    }
    openJob(s);
  } catch (e) { info({ title: 'Não foi possível abrir a sessão', html: `<p>${esc(e.message)}</p>` }); }
 }
@@ -246,8 +249,11 @@ $('#loadSessionBtn').onclick = async () => {
  try {
    const { job } = await rpc('session_load', { path });
    const st = await rpc('status', { job });
-    const s = { job, target: st.target, label: 'Sessão: ' + st.target.split(/[\\/]/).pop() };
-    S.sessions.unshift(s);
+    let s = S.sessions.find((x) => x.job === job);
+    if (!s) {
+      s = { job, target: st.target, label: 'Sessão: ' + st.target.split(/[\\/]/).pop() };
+      S.sessions.unshift(s);
+    }
    openJob(s);
  } catch (e) { info({ title: 'Não foi possível abrir a sessão', html: `<p>${esc(e.message)}</p>` }); }
 };
@@ -287,15 +293,46 @@ async function openDevice(d) {
  rpc('health', { path: d.path }).then((h) => { if (S.device === d) { S.health = h; paintHealth(); } }).catch(() => {});
 }

+const HEALTH_WORD = { ok: 'Bom', warning: 'Atenção', failing: 'Ruim' };
+
 function paintHealth() {
  const el = $('#healthArea');
  const h = S.health;
-  if (!el || !h || !h.available) { if (el) el.innerHTML = ''; return; }
+  if (!el || !h) { if (el) el.innerHTML = ''; return; }
+  if (!h.available) {
+    el.innerHTML = `<div class="section"><h2>Saúde do disco</h2><p class="sub">${esc(h.summary)}</p></div>`;
+    return;
+  }
  const bad = h.status === 'failing' || h.status === 'warning';
-  const rows = (h.details || []).filter(([k]) => bad || ['Modelo', 'Horas ligado', 'Temperatura'].includes(k)).map(([k, v]) => `<dt>${esc(k)}</dt><dd>${esc(v)}</dd>`).join('');
-  el.innerHTML = `<div class="notice ${h.status === 'failing' ? 'bad' : h.status === 'warning' ? '' : 'info'}">${warnSvg}<div><b>${esc(h.summary)}</b>
-    ${rows ? `<dl class="kv" style="margin-top:6px">${rows}</dl>` : ''}${(h.advice || []).map((a) => `<div style="margin-top:6px">${esc(a)}</div>`).join('')}
-    ${bad ? '<div class="row" style="margin-top:8px"><button class="btn sm primary" id="healthImg">Criar a imagem primeiro</button></div>' : ''}</div></div>`;
+  const fmtN = (n) => Number(n).toLocaleString(LOC());
+  const tile = (label, value, cls = '') => value == null ? '' : `<div class="h-tile ${cls}"><small>${label}</small><b>${value}</b></div>`;
+  const temp = h.temperature_c;
+  const tiles = [
+    `<div class="h-tile h-status ${esc(h.status)}"><small>Estado</small><b>${HEALTH_WORD[h.status] || '?'}${h.health_pct != null ? ` <span>${h.health_pct}%</span>` : ''}</b></div>`,
+    tile('Temperatura', temp == null ? null : `${temp} °C`, temp >= 60 ? 'failing' : temp >= 50 ? 'warning' : ''),
+    tile('Horas ligado', h.power_on_hours == null ? null : `${fmtN(h.power_on_hours)} h`),
+    tile('Vezes ligado', h.power_cycles == null ? null : fmtN(h.power_cycles)),
+    tile('Total lido', h.host_reads == null ? null : human(h.host_reads)),
+    tile('Total gravado', h.host_writes == null ? null : human(h.host_writes)),
+  ].join('');
+  const info = (h.info || []).map(([k, v]) => `<dt>${esc(k)}</dt><dd>${esc(v)}</dd>`).join('');
+  const dash = (x) => x == null ? '<span class="dim">-</span>' : x;
+  const attrs = h.attributes || [];
+  const table = attrs.length ? `<details class="adv h-attrs"${bad ? ' open' : ''}><summary>Atributos SMART (${attrs.length})</summary>
+    <div class="h-scroll"><table class="h-table"><thead><tr><th></th><th>ID</th><th>Atributo</th><th>Atual</th><th>Pior</th><th>Limite</th><th>Bruto</th></tr></thead><tbody>
+    ${attrs.map((a) => `<tr><td><span class="h-dot ${esc(a.status)}" title="${HEALTH_WORD[a.status] || ''}"></span></td><td class="mono">${esc(a.id)}</td><td class="mono">${esc(a.name)}</td><td>${dash(a.value)}</td><td>${dash(a.worst)}</td><td>${dash(a.thresh)}</td><td class="mono">${esc(a.raw)}</td></tr>`).join('')}
+    </tbody></table></div></details>` : '';
+  const scope = h.partition ? `<p class="sub">O SMART é do disco inteiro: os dados abaixo são de <span class="mono">${esc(h.disk)}</span>, que contém <span class="mono">${esc(h.partition)}</span>.</p>` : '';
+  // o que motivou o alerta (os campos da ficha já aparecem abaixo)
+  const known = new Set(['Modelo', 'Nº de série', 'Horas ligado', 'Temperatura', 'Autoavaliação SMART', 'Vida útil usada']);
+  const why = (h.details || []).filter(([k]) => !known.has(k)).map(([k, v]) => `<dt>${esc(k)}</dt><dd>${esc(v)}</dd>`).join('');
+  el.innerHTML = `${bad ? `<div class="notice ${h.status === 'failing' ? 'bad' : ''}">${warnSvg}<div><b>${esc(h.summary)}</b>
+    ${why ? `<dl class="kv" style="margin-top:6px">${why}</dl>` : ''}
+    ${(h.advice || []).map((a) => `<div style="margin-top:6px">${esc(a)}</div>`).join('')}
+    <div class="row" style="margin-top:8px"><button class="btn sm primary" id="healthImg">Criar a imagem primeiro</button></div></div></div>` : ''}
+    <div class="section"><h2>Saúde do disco</h2>${scope}
+    <div class="h-tiles">${tiles}</div>
+    ${info ? `<dl class="kv h-info">${info}</dl>` : ''}${table}</div>`;
  $('#healthImg')?.addEventListener('click', startImage);
 }

@@ -372,10 +409,33 @@ function renderDevice(err) {
        <div class="row" id="optCats">${CATS.map(([k, n]) => `<label class="check"><input type="checkbox" value="${k}"> ${n}</label>`).join('')}</div>
        <div class="sub">Sem nenhuma categoria marcada, todos os tipos são procurados.</div>
      </details>
+      <details class="adv"><summary>Volumes cifrados, RAID e vídeos</summary>
+        <label class="fld"><span>Senha do volume (BitLocker, LUKS, FileVault 2)</span><input class="input" id="optPw" type="password" autocomplete="off"></label>
+        <label class="fld"><span>Chave de recuperação do BitLocker</span><input class="input" id="optRk" placeholder="000000-000000-... (8 grupos)" autocomplete="off"></label>
+        <label class="fld"><span>Arquivo de chave (.BEK ou keyfile)</span><input class="input" id="optKf" placeholder="/caminho/chave.BEK"></label>
+        <label class="fld"><span>Outros discos do mesmo conjunto (RAID/LVM), um caminho por linha</span><textarea class="input" id="optMembers" rows="3"></textarea></label>
+        <label class="check"><input type="checkbox" id="optRaid"><span><b>Estes discos formam um RAID sem metadados</b><br><span class="sub">O Guará descobre sozinho o nível, a faixa, o layout e a ordem dos discos.</span></span></label>
+        <label class="fld"><span>Vídeo íntegro da mesma câmera/drone (refaz o índice de MP4 sem moov)</span><input class="input" id="optRef" placeholder="/caminho/video-bom.mp4"></label>
+        <label class="check"><input type="checkbox" id="optRemember"><span><b>Lembrar as chaves dos volumes abertos na sessão</b><br><span class="sub">A senha nunca é gravada; só a chave derivada.</span></span></label>
+      </details>
    </div></div>`;
  $('#elevate')?.addEventListener('click', () => tauri.core.invoke('relaunch_elevated').catch((e) => toast(String(e))));
  const opts = (mode) => ({
    mode,
+    assembly: (() => {
+      const v = (id) => ($(id)?.value || '').trim();
+      const secrets = [];
+      if (v('#optPw')) secrets.push({ kind: 'password', value: v('#optPw') });
+      if (v('#optRk')) secrets.push({ kind: 'recovery', value: v('#optRk') });
+      if (v('#optKf')) secrets.push({ kind: 'keyfile', path: v('#optKf') });
+      return {
+        secrets,
+        members: v('#optMembers').split('\n').map((x) => x.trim()).filter(Boolean),
+        raid: $('#optRaid')?.checked ? {} : null,
+        remember_keys: $('#optRemember')?.checked || false,
+      };
+    })(),
+    references: $('#optRef')?.value.trim() ? [$('#optRef').value.trim()] : [],
    include_allocated: $('#optAlloc')?.checked || false,
    categories: [...document.querySelectorAll('#optCats input:checked')].map((i) => i.value),
  });
@@ -405,10 +465,18 @@ async function startScan(options) {

 async function startImage() {
  const base = (S.defaults.home || '') + (S.defaults.sep || '/');
-  const dest = await ask({ title: 'Criar imagem do disco', text: 'Onde salvar o arquivo de imagem? Use <b>outro disco</b> com espaço suficiente e um nome que ainda não exista.', value: base + 'disco-guara.img', ok: 'Criar imagem' });
-  if (!dest) return;
+  const f = await askForm({ title: 'Criar imagem do disco', text: 'Onde salvar o arquivo de imagem? Use <b>outro disco</b> com espaço suficiente e um nome que ainda não exista.', ok: 'Criar imagem', fields: [
+    { name: 'dest', label: 'Arquivo de destino', value: base + 'disco-guara.img' },
+    { name: 'format', label: 'Formato', value: 'raw', options: [['raw', 'Bruta (.img)'], ['e01', 'Expert Witness (.E01, com hash e metadados)'], ['aff4', 'AFF4 (.aff4)']] },
+    { name: 'case', label: 'Número do caso (E01/AFF4)', value: '' },
+    { name: 'examiner', label: 'Examinador (E01/AFF4)', value: '' },
+  ] });
+  if (!f || !f.dest) return;
+  const dest = f.dest;
+  const format = f.format === 'e01' ? { kind: 'e01', case_number: f.case, examiner: f.examiner }
+    : f.format === 'aff4' ? { kind: 'aff4', case_number: f.case, examiner: f.examiner } : { kind: 'raw' };
  try {
-    const { job } = await rpc('image_start', { path: S.device.path, dest });
+    const { job } = await rpc('image_start', { path: S.device.path, dest, format });
    watchAux(job, 'Criando imagem do disco', (st) => {
      const r = st.report || {};
      const bad = (r.bad_ranges || []).length;
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 160 100" role="img" aria-label="Guará"><defs><linearGradient id="wh" gradientUnits="userSpaceOnUse" x1="58" y1="0" x2="160" y2="100"><stop offset="0" stop-color="#3BE3CC"/> <stop offset="0.45" stop-color="#12B5A8"/> <stop offset="1" stop-color="#0B6A86"/></linearGradient><mask id="wm" maskUnits="userSpaceOnUse" x="0" y="0" width="160" height="100"><g shape-rendering="crispEdges"><rect x="80" y="0" width="81" height="100" fill="#fff"/><rect x="72.38" y="34.88" width="2.74" height="2.74" fill="#fff"/><rect x="59.88" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="87.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="64.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="74.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="47.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="72.38" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="64.88" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="52.38" width="5.24" height="5.24" fill="#fff"/><rect x="77.38" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="59.88" y="62.38" width="5.24" height="5.24" fill="#fff"/><rect x="77.38" y="72.38" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="72.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="64.88" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="47.38" width="5.24" height="5.24" fill="#fff"/><rect x="57.38" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="37.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="84.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="44.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="34.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="49.88" width="2.74" height="2.74" fill="#fff"/><rect x="59.88" y="79.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="64.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="37.38" width="2.74" height="2.74" fill="#fff"/><rect x="57.38" y="47.38" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="77.38" width="2.74" height="2.74" fill="#fff"/><rect x="57.38" y="87.38" width="5.24" height="5.24" fill="#fff"/><rect x="74.88" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="57.38" y="82.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="67.38" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="72.38" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="84.88" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="74.88" width="2.74" height="2.74" fill="#fff"/><rect x="57.38" y="54.88" width="5.24" height="5.24" fill="#fff"/><rect x="77.38" y="79.88" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="69.88" width="5.24" height="5.24" fill="#fff"/><rect x="77.38" y="54.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="34.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="59.88" y="69.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="62.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="77.38" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="87.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="47.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="79.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="32.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="87.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="74.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="62.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="44.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="72.38" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="44.88" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="67.38" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="77.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="67.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="39.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="32.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="82.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="Line truncated
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" role="img" aria-label="Guará"><style>.a{stroke:#0f766e}.b{stroke:#14b8a6}.t{fill:#1d1d1f}@media (prefers-color-scheme:dark){.a{stroke:#2dd4bf}.b{stroke:#5eead4}.t{fill:#f5f5f7}}</style><defs><clipPath id="g-head"><path d="M50 95 C46 88 43 80 40 74 C33 70 25 64 22 56 L14 6 L36 30 C40 28 45 27 50 27 C55 27 60 28 64 30 L86 6 L78 56 C75 64 67 70 60 74 C57 80 54 88 50 95 Z"/></clipPath></defs><g clip-path="url(#g-head)" fill="none" stroke-width="4.2"><path class="a" d="M50 93A7 7 0 0 1 50 107"/><path class="b" d="M50 93A7 7 0 0 0 50 107" stroke-dasharray="3 3" stroke-dashoffset="0"/><path class="a" d="M50 86A14 14 0 0 1 50 114"/><path class="b" d="M50 86A14 14 0 0 0 50 114" stroke-dasharray="6 4" stroke-dashoffset="3"/><path class="a" d="M50 79A21 21 0 0 1 50 121"/><path class="b" d="M50 79A21 21 0 0 0 50 121" stroke-dasharray="9 5" stroke-dashoffset="6"/><path class="a" d="M50 72A28 28 0 0 1 50 128"/><path class="b" d="M50 72A28 28 0 0 0 50 128" stroke-dasharray="3 6" stroke-dashoffset="9"/><path class="a" d="M50 65A35 35 0 0 1 50 135"/><path class="b" d="M50 65A35 35 0 0 0 50 135" stroke-dasharray="6 3" stroke-dashoffset="12"/><path class="a" d="M50 58A42 42 0 0 1 50 142"/><path class="b" d="M50 58A42 42 0 0 0 50 142" stroke-dasharray="9 4" stroke-dashoffset="15"/><path class="a" d="M50 51A49 49 0 0 1 50 149"/><path class="b" d="M50 51A49 49 0 0 0 50 149" stroke-dasharray="3 5" stroke-dashoffset="18"/><path class="a" d="M50 44A56 56 0 0 1 50 156"/><path class="b" d="M50 44A56 56 0 0 0 50 156" stroke-dasharray="6 6" stroke-dashoffset="21"/><path class="a" d="M50 37A63 63 0 0 1 50 163"/><path class="b" d="M50 37A63 63 0 0 0 50 163" stroke-dasharray="9 3" stroke-dashoffset="24"/><path class="a" d="M50 30A70 70 0 0 1 50 170"/><path class="b" d="M50 30A70 70 0 0 0 50 170" stroke-dasharray="3 4" stroke-dashoffset="27"/><path class="a" d="M50 23A77 77 0 0 1 50 177"/><path class="b" d="M50 23A77 77 0 0 0 50 177" stroke-dasharray="6 5" stroke-dashoffset="30"/><path class="a" d="M50 16A84 84 0 0 1 50 184"/><path class="b" d="M50 16A84 84 0 0 0 50 184" stroke-dasharray="9 6" stroke-dashoffset="33"/><path class="a" d="M50 9A91 91 0 0 1 50 191"/><path class="b" d="M50 9A91 91 0 0 0 50 191" stroke-dasharray="3 3" stroke-dashoffset="36"/><path class="a" d="M50 2A98 98 0 0 1 50 198"/><path class="b" d="M50 2A98 98 0 0 0 50 198" stroke-dasharray="6 4" stroke-dashoffset="39"/><rect class="t" stroke="none" x="0" y="74" width="100" height="30"/></g><path class="t" d="M37 50Q42 47 46 52Q41 53 37 50ZM63 50Q58 47 54 52Q59 53 63 50Z"/></svg>
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" role="img" aria-label="Guará"><defs><linearGradient id="bg" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="#0f766e"/><stop offset="1" stop-color="#083344"/></linearGradient><clipPath id="ic"><rect width="128" height="128" rx="29"/></clipPath></defs><rect width="128" height="128" rx="29" fill="url(#bg)"/><g clip-path="url(#ic)"><g transform="translate(-13 18) scale(0.86)"><defs><linearGradient id="ih" gradientUnits="userSpaceOnUse" x1="58" y1="0" x2="160" y2="100"><stop offset="0" stop-color="#d9fff7"/> <stop offset="0.5" stop-color="#8df1e0"/> <stop offset="1" stop-color="#3fc8cf"/></linearGradient><mask id="im" maskUnits="userSpaceOnUse" x="0" y="0" width="160" height="100"><g shape-rendering="crispEdges"><rect x="80" y="0" width="81" height="100" fill="#fff"/><rect x="67.38" y="49.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="77.38" width="2.74" height="2.74" fill="#fff"/><rect x="57.38" y="62.38" width="5.24" height="5.24" fill="#fff"/><rect x="67.38" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="57.38" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="79.88" width="5.24" height="5.24" fill="#fff"/><rect x="74.88" y="64.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="84.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="54.88" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="84.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="72.38" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="67.38" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="44.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="62.38" width="2.74" height="2.74" fill="#fff"/><rect x="59.88" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="52.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="37.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="79.88" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="74.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="44.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="84.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="44.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="87.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="47.38" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="39.88" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="62.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="67.38" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="54.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="89.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="74.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="72.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="37.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="57.38" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="49.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="69.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="47.38" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="57.38" width="5.24" height="5.24" fill="#fff"/><rect x="62.38" y="62.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="82.38" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="82.38" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="39.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="74.88" width="2.74" height="2.74" fill="#fff"/><rect x="72.38" y="37.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="34.88" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="79.88" width="2.74" height="2.74" fill="#fff"/><rect x="59.88" y="79.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="74.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="69.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="32.38" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="39.88" width="2.74" height="2.74" fill="#fff"/><rect x="62.38" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="67.38" y="54.88" width="2.74" height="2.74" fill="#fff"/><rect x="59.88" y="44.88" width="2.74" height="2.74" fill="#fff"/><rect x="69.88" y="42.38" width="2.74" height="2.74" fill="#fff"/><rect x="64.88" y="49.88" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="59.88" width="2.74" height="2.74" fill="#fff"/><rect x="77.38" y="62.38" width="2.74" height="2.74" fill="#fff"/><rect x="74.88" y="32.38" width="2.74" height="2.74" fill="#ffLine truncated
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" role="img" aria-label="Guará"><style>.a{stroke:#0f766e}.b{stroke:#14b8a6}.t{fill:#1d1d1f}@media (prefers-color-scheme:dark){.a{stroke:#2dd4bf}.b{stroke:#5eead4}.t{fill:#f5f5f7}}</style><defs><clipPath id="g-head"><path d="M50 95 C46 88 43 80 40 74 C33 70 25 64 22 56 L14 6 L36 30 C40 28 45 27 50 27 C55 27 60 28 64 30 L86 6 L78 56 C75 64 67 70 60 74 C57 80 54 88 50 95 Z"/></clipPath></defs><g clip-path="url(#g-head)" fill="none" stroke-width="4.2"><path class="a" d="M50 93A7 7 0 0 1 50 107"/><path class="b" d="M50 93A7 7 0 0 0 50 107" stroke-dasharray="3 3" stroke-dashoffset="0"/><path class="a" d="M50 86A14 14 0 0 1 50 114"/><path class="b" d="M50 86A14 14 0 0 0 50 114" stroke-dasharray="6 4" stroke-dashoffset="3"/><path class="a" d="M50 79A21 21 0 0 1 50 121"/><path class="b" d="M50 79A21 21 0 0 0 50 121" stroke-dasharray="9 5" stroke-dashoffset="6"/><path class="a" d="M50 72A28 28 0 0 1 50 128"/><path class="b" d="M50 72A28 28 0 0 0 50 128" stroke-dasharray="3 6" stroke-dashoffset="9"/><path class="a" d="M50 65A35 35 0 0 1 50 135"/><path class="b" d="M50 65A35 35 0 0 0 50 135" stroke-dasharray="6 3" stroke-dashoffset="12"/><path class="a" d="M50 58A42 42 0 0 1 50 142"/><path class="b" d="M50 58A42 42 0 0 0 50 142" stroke-dasharray="9 4" stroke-dashoffset="15"/><path class="a" d="M50 51A49 49 0 0 1 50 149"/><path class="b" d="M50 51A49 49 0 0 0 50 149" stroke-dasharray="3 5" stroke-dashoffset="18"/><path class="a" d="M50 44A56 56 0 0 1 50 156"/><path class="b" d="M50 44A56 56 0 0 0 50 156" stroke-dasharray="6 6" stroke-dashoffset="21"/><path class="a" d="M50 37A63 63 0 0 1 50 163"/><path class="b" d="M50 37A63 63 0 0 0 50 163" stroke-dasharray="9 3" stroke-dashoffset="24"/><path class="a" d="M50 30A70 70 0 0 1 50 170"/><path class="b" d="M50 30A70 70 0 0 0 50 170" stroke-dasharray="3 4" stroke-dashoffset="27"/><path class="a" d="M50 23A77 77 0 0 1 50 177"/><path class="b" d="M50 23A77 77 0 0 0 50 177" stroke-dasharray="6 5" stroke-dashoffset="30"/><path class="a" d="M50 16A84 84 0 0 1 50 184"/><path class="b" d="M50 16A84 84 0 0 0 50 184" stroke-dasharray="9 6" stroke-dashoffset="33"/><path class="a" d="M50 9A91 91 0 0 1 50 191"/><path class="b" d="M50 9A91 91 0 0 0 50 191" stroke-dasharray="3 3" stroke-dashoffset="36"/><path class="a" d="M50 2A98 98 0 0 1 50 198"/><path class="b" d="M50 2A98 98 0 0 0 50 198" stroke-dasharray="6 4" stroke-dashoffset="39"/><rect class="t" stroke="none" x="0" y="74" width="100" height="30"/></g><path class="t" d="M37 50Q42 47 46 52Q41 53 37 50ZM63 50Q58 47 54 52Q59 53 63 50Z"/></svg>
@@ -1,5 +1,48 @@
 // Dicionário português -> inglês da interface. {n} marca um valor variável.
 export const EN = {
+  // saúde do disco (SMART)
+  'Saúde do disco': 'Disk health',
+  'O SMART não pôde ser lido. Instale o pacote smartmontools (comando smartctl) e rode como administrador para ver a saúde do disco.': 'SMART could not be read. Install the smartmontools package (smartctl command) and run as administrator to see the disk health.',
+  'Setores realocados': 'Reallocated sectors',
+  'Setores pendentes de realocação': 'Pending sectors',
+  'Setores incorrigíveis offline': 'Offline uncorrectable sectors',
+  'Erros incorrigíveis reportados': 'Reported uncorrectable errors',
+  'Erros de CRC na interface (cabo ou porta)': 'Interface CRC errors (cable or port)',
+  'Erros registrados no log do disco': 'Errors in the disk log',
+  'Aviso crítico NVMe': 'NVMe critical warning',
+  'Erros de mídia': 'Media errors',
+  'Reserva de blocos abaixo do limite': 'Spare blocks below threshold',
+  'Erros de leitura/gravação vistos pelo sistema': 'Read/write errors seen by the system',
+  'O sistema já registrou erros de E/S neste disco.': 'The system has already logged I/O errors on this disk.',
+  'Estado': 'Status',
+  'Bom': 'Good',
+  'Atenção': 'Caution',
+  'Ruim': 'Bad',
+  'Temperatura': 'Temperature',
+  'Horas ligado': 'Power on hours',
+  'Vezes ligado': 'Power on count',
+  'Total lido': 'Host reads',
+  'Total gravado': 'Host writes',
+  'Atributos SMART ({n})': 'SMART attributes ({n})',
+  'Atributo': 'Attribute',
+  'Atual': 'Current',
+  'Pior': 'Worst',
+  'Limite': 'Threshold',
+  'Bruto': 'Raw',
+  'Modelo': 'Model',
+  'Nº de série': 'Serial number',
+  'Família': 'Family',
+  'Modo de transferência': 'Transfer mode',
+  'Capacidade': 'Capacity',
+  'Rotação': 'Rotation rate',
+  'Formato': 'Form factor',
+  'Recursos': 'Features',
+  'O SMART é do disco inteiro: os dados abaixo são de': 'SMART belongs to the whole disk: the data below is for',
+  ', que contém': ', which contains',
+  'Imagem de disco: não há SMART para avaliar.': 'Disk image: there is no SMART to check.',
+  'Nenhum sinal de defeito encontrado pelo SMART.': 'SMART found no signs of failure.',
+  'Este disco mostra sinais sérios de defeito.': 'This disk shows serious signs of failure.',
+  'Este disco mostra sinais de desgaste ou erros.': 'This disk shows signs of wear or errors.',
  // barra lateral e estrutura
  'Recuperação de arquivos': 'File recovery',
  'Dispositivos': 'Devices',
@@ -14,10 +14,10 @@
      <button class="icon-btn" id="menuBtn" aria-label="Abrir menu" aria-expanded="false">
        <svg viewBox="0 0 24 24" width="22" height="22"><path d="M4 7h16M4 12h16M4 17h16" stroke="currentColor" stroke-width="2" stroke-linecap="round" fill="none"/></svg>
      </button>
-      <img src="guara.svg" alt="" width="24" height="24"><strong>Guará</strong>
+      <svg class="logo" width="24" height="24" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><clipPath id="g-head-top"><path d="M50 95 C46 88 43 80 40 74 C33 70 25 64 22 56 L14 6 L36 30 C40 28 45 27 50 27 C55 27 60 28 64 30 L86 6 L78 56 C75 64 67 70 60 74 C57 80 54 88 50 95 Z"/></clipPath></defs><g clip-path="url(#g-head-top)" fill="none" stroke-width="4.2"><path class="a" d="M50 93A7 7 0 0 1 50 107"/><path class="b" d="M50 93A7 7 0 0 0 50 107" stroke-dasharray="3 3" stroke-dashoffset="0"/><path class="a" d="M50 86A14 14 0 0 1 50 114"/><path class="b" d="M50 86A14 14 0 0 0 50 114" stroke-dasharray="6 4" stroke-dashoffset="3"/><path class="a" d="M50 79A21 21 0 0 1 50 121"/><path class="b" d="M50 79A21 21 0 0 0 50 121" stroke-dasharray="9 5" stroke-dashoffset="6"/><path class="a" d="M50 72A28 28 0 0 1 50 128"/><path class="b" d="M50 72A28 28 0 0 0 50 128" stroke-dasharray="3 6" stroke-dashoffset="9"/><path class="a" d="M50 65A35 35 0 0 1 50 135"/><path class="b" d="M50 65A35 35 0 0 0 50 135" stroke-dasharray="6 3" stroke-dashoffset="12"/><path class="a" d="M50 58A42 42 0 0 1 50 142"/><path class="b" d="M50 58A42 42 0 0 0 50 142" stroke-dasharray="9 4" stroke-dashoffset="15"/><path class="a" d="M50 51A49 49 0 0 1 50 149"/><path class="b" d="M50 51A49 49 0 0 0 50 149" stroke-dasharray="3 5" stroke-dashoffset="18"/><path class="a" d="M50 44A56 56 0 0 1 50 156"/><path class="b" d="M50 44A56 56 0 0 0 50 156" stroke-dasharray="6 6" stroke-dashoffset="21"/><path class="a" d="M50 37A63 63 0 0 1 50 163"/><path class="b" d="M50 37A63 63 0 0 0 50 163" stroke-dasharray="9 3" stroke-dashoffset="24"/><path class="a" d="M50 30A70 70 0 0 1 50 170"/><path class="b" d="M50 30A70 70 0 0 0 50 170" stroke-dasharray="3 4" stroke-dashoffset="27"/><path class="a" d="M50 23A77 77 0 0 1 50 177"/><path class="b" d="M50 23A77 77 0 0 0 50 177" stroke-dasharray="6 5" stroke-dashoffset="30"/><path class="a" d="M50 16A84 84 0 0 1 50 184"/><path class="b" d="M50 16A84 84 0 0 0 50 184" stroke-dasharray="9 6" stroke-dashoffset="33"/><path class="a" d="M50 9A91 91 0 0 1 50 191"/><path class="b" d="M50 9A91 91 0 0 0 50 191" stroke-dasharray="3 3" stroke-dashoffset="36"/><path class="a" d="M50 2A98 98 0 0 1 50 198"/><path class="b" d="M50 2A98 98 0 0 0 50 198" stroke-dasharray="6 4" stroke-dashoffset="39"/><rect class="t" stroke="none" x="0" y="74" width="100" height="30"/></g><path class="t" d="M37 50Q42 47 46 52Q41 53 37 50ZM63 50Q58 47 54 52Q59 53 63 50Z"/></svg><strong>Guará</strong>
    </header>
    <aside class="sidebar" id="sidebar" aria-label="Dispositivos e sessões">
-      <div class="brand"><img src="guara.svg" alt="" width="30" height="30"><div><strong>Guará</strong><small>Recuperação de arquivos</small></div></div>
+      <div class="brand"><svg class="logo" width="30" height="30" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100"><defs><clipPath id="g-head-side"><path d="M50 95 C46 88 43 80 40 74 C33 70 25 64 22 56 L14 6 L36 30 C40 28 45 27 50 27 C55 27 60 28 64 30 L86 6 L78 56 C75 64 67 70 60 74 C57 80 54 88 50 95 Z"/></clipPath></defs><g clip-path="url(#g-head-side)" fill="none" stroke-width="4.2"><path class="a" d="M50 93A7 7 0 0 1 50 107"/><path class="b" d="M50 93A7 7 0 0 0 50 107" stroke-dasharray="3 3" stroke-dashoffset="0"/><path class="a" d="M50 86A14 14 0 0 1 50 114"/><path class="b" d="M50 86A14 14 0 0 0 50 114" stroke-dasharray="6 4" stroke-dashoffset="3"/><path class="a" d="M50 79A21 21 0 0 1 50 121"/><path class="b" d="M50 79A21 21 0 0 0 50 121" stroke-dasharray="9 5" stroke-dashoffset="6"/><path class="a" d="M50 72A28 28 0 0 1 50 128"/><path class="b" d="M50 72A28 28 0 0 0 50 128" stroke-dasharray="3 6" stroke-dashoffset="9"/><path class="a" d="M50 65A35 35 0 0 1 50 135"/><path class="b" d="M50 65A35 35 0 0 0 50 135" stroke-dasharray="6 3" stroke-dashoffset="12"/><path class="a" d="M50 58A42 42 0 0 1 50 142"/><path class="b" d="M50 58A42 42 0 0 0 50 142" stroke-dasharray="9 4" stroke-dashoffset="15"/><path class="a" d="M50 51A49 49 0 0 1 50 149"/><path class="b" d="M50 51A49 49 0 0 0 50 149" stroke-dasharray="3 5" stroke-dashoffset="18"/><path class="a" d="M50 44A56 56 0 0 1 50 156"/><path class="b" d="M50 44A56 56 0 0 0 50 156" stroke-dasharray="6 6" stroke-dashoffset="21"/><path class="a" d="M50 37A63 63 0 0 1 50 163"/><path class="b" d="M50 37A63 63 0 0 0 50 163" stroke-dasharray="9 3" stroke-dashoffset="24"/><path class="a" d="M50 30A70 70 0 0 1 50 170"/><path class="b" d="M50 30A70 70 0 0 0 50 170" stroke-dasharray="3 4" stroke-dashoffset="27"/><path class="a" d="M50 23A77 77 0 0 1 50 177"/><path class="b" d="M50 23A77 77 0 0 0 50 177" stroke-dasharray="6 5" stroke-dashoffset="30"/><path class="a" d="M50 16A84 84 0 0 1 50 184"/><path class="b" d="M50 16A84 84 0 0 0 50 184" stroke-dasharray="9 6" stroke-dashoffset="33"/><path class="a" d="M50 9A91 91 0 0 1 50 191"/><path class="b" d="M50 9A91 91 0 0 0 50 191" stroke-dasharray="3 3" stroke-dashoffset="36"/><path class="a" d="M50 2A98 98 0 0 1 50 198"/><path class="b" d="M50 2A98 98 0 0 0 50 198" stroke-dasharray="6 4" stroke-dashoffset="39"/><rect class="t" stroke="none" x="0" y="74" width="100" height="30"/></g><path class="t" d="M37 50Q42 47 46 52Q41 53 37 50ZM63 50Q58 47 54 52Q59 53 63 50Z"/></svg><div><strong>Guará</strong><small>Recuperação de arquivos</small></div></div>
      <nav>
        <div class="side-title">Dispositivos <button class="icon-btn small" id="refreshBtn" title="Atualizar lista" aria-label="Atualizar lista"><svg viewBox="0 0 24 24" width="16" height="16"><path d="M20 12a8 8 0 1 1-2.5-5.8M20 4v5h-5" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round"/></svg></button></div>
        <ul id="deviceList" class="list"></ul>
@@ -18,3 +18,4 @@ serde_json = "1"
 tiny_http = "0.12"
 getrandom = "0.2"
 ctrlc = "3"
+rpassword = "7"
@@ -31,6 +31,15 @@ enum Cmd {
        path: String,
        #[arg(long)]
        json: bool,
+        #[command(flatten)]
+        asm: AsmArgs,
+    },
+    /// Saúde do disco (SMART): estado, temperatura, uso e tabela de atributos
+    Health {
+        /// Dispositivo ou partição (o SMART lido é o do disco que a contém)
+        path: String,
+        #[arg(long)]
+        json: bool,
    },
    /// Procura arquivos apagados/perdidos (metadados + assinatura)
    Scan(ScanArgs),
@@ -49,7 +58,36 @@ enum Cmd {
        filter: FilterArgs,
    },
    /// Cria uma imagem do disco (tolerante a setores ruins) para trabalhar na cópia
-    Image { path: String, dest: String },
+    Image {
+        path: String,
+        dest: String,
+        /// Formato da imagem: raw (padrão), e01 (Expert Witness) ou aff4 (AFF4 v1.0), com hash e metadados
+        #[arg(long, default_value = "raw")]
+        format: String,
+        /// E01: número do caso
+        #[arg(long, default_value = "")]
+        case: String,
+        /// E01: examinador
+        #[arg(long, default_value = "")]
+        examiner: String,
+        /// E01: descrição da evidência
+        #[arg(long, default_value = "")]
+        description: String,
+        /// E01: número da evidência
+        #[arg(long, default_value = "")]
+        evidence: String,
+        /// E01: observações
+        #[arg(long, default_value = "")]
+        notes: String,
+        /// E01: tamanho máximo de cada segmento em MiB (0 = um arquivo só)
+        #[arg(long, default_value_t = 1500)]
+        segment_mib: u64,
+        /// E01: compressão 0 (nenhuma) a 9
+        #[arg(long, default_value_t = 1)]
+        compression: u32,
+    },
+    /// Confere uma imagem E01/Ex01: recalcula o MD5 e compara com o gravado na própria imagem
+    Verify { path: String },
    /// Exporta os achados de uma sessão para CSV (abre no Excel)
    Export {
        session: String,
@@ -133,6 +171,120 @@ struct OutArgs {
    json: bool,
 }

+/// Montagem do disco: volumes cifrados, RAID e LVM.
+#[derive(clap::Args, Clone, Default)]
+struct AsmArgs {
+    /// Senha de volume cifrado (BitLocker, LUKS, FileVault 2). Prefira --ask-password ou GUARA_PASSWORD
+    #[arg(long = "password")]
+    passwords: Vec<String>,
+    /// Pergunta a senha no terminal, sem mostrar o que é digitado
+    #[arg(long)]
+    ask_password: bool,
+    /// Chave de recuperação numérica do BitLocker (8 grupos de 6 dígitos)
+    #[arg(long = "recovery-key")]
+    recovery_keys: Vec<String>,
+    /// Arquivo de chave (.BEK do BitLocker ou keyfile do LUKS)
+    #[arg(long = "key-file")]
+    key_files: Vec<String>,
+    /// Chave do volume em hexadecimal (a que o Guará mostra ao abrir um volume)
+    #[arg(long = "volume-key")]
+    volume_keys: Vec<String>,
+    /// Outro disco ou imagem do mesmo conjunto (RAID/LVM). Pode repetir; "-" marca um disco ausente
+    #[arg(long = "member")]
+    members: Vec<String>,
+    /// Os discos (alvo + --member, nesta ordem) formam um RAID sem metadados: descobre sozinho nível, faixa e layout
+    #[arg(long)]
+    raid: bool,
+    /// Fixa o nível do RAID: 0, 5, 6, 1
+    #[arg(long)]
+    raid_level: Option<String>,
+    /// Fixa o tamanho da faixa do RAID em KiB
+    #[arg(long)]
+    raid_chunk_kb: Option<u64>,
+    /// Fixa o layout: left-symmetric, left-asymmetric, right-symmetric, right-asymmetric
+    #[arg(long)]
+    raid_layout: Option<String>,
+    /// Ordem dos discos no RAID (índices; 0 = alvo)
+    #[arg(long, value_delimiter = ',')]
+    raid_order: Vec<usize>,
+    /// Guarda na sessão as chaves dos volumes abertos (a senha nunca é guardada)
+    #[arg(long)]
+    remember_keys: bool,
+    /// Vídeo íntegro da mesma câmera/drone para refazer o índice de MP4 sem moov (pode repetir)
+    #[arg(long = "reference")]
+    references: Vec<String>,
+}
+
+impl AsmArgs {
+    fn assembly(&self) -> Result<guara_core::assemble::Assembly, String> {
+        use guara_core::assemble::{Assembly, RaidSpec, SecretInput};
+        let mut secrets = vec![];
+        for p in &self.passwords {
+            secrets.push(SecretInput::Password { value: p.clone() });
+        }
+        if let Ok(p) = std::env::var("GUARA_PASSWORD") {
+            if !p.is_empty() {
+                secrets.push(SecretInput::Password { value: p });
+            }
+        }
+        if self.ask_password {
+            let p = rpassword::prompt_password("Senha do volume: ").map_err(s)?;
+            secrets.push(SecretInput::Password { value: p });
+        }
+        for r in &self.recovery_keys {
+            secrets.push(SecretInput::Recovery { value: r.clone() });
+        }
+        for k in &self.key_files {
+            secrets.push(SecretInput::Keyfile { path: k.clone() });
+        }
+        for k in &self.volume_keys {
+            secrets.push(SecretInput::Key { hex: k.clone() });
+        }
+        let raid = if self.raid
+            || self.raid_level.is_some()
+            || self.raid_chunk_kb.is_some()
+            || self.raid_layout.is_some()
+            || !self.raid_order.is_empty()
+        {
+            let level = match self.raid_level.as_deref() {
+                None => None,
+                Some("0") => Some(guara_core::raid::Level::R0),
+                Some("1") => Some(guara_core::raid::Level::R1),
+                Some("5") => Some(guara_core::raid::Level::R5),
+                Some("6") => Some(guara_core::raid::Level::R6),
+                Some(x) => {
+                    return Err(format!(
+                        "nível de RAID não suportado: {x} (use 0, 1, 5 ou 6)"
+                    ))
+                }
+            };
+            let layout = match self.raid_layout.as_deref() {
+                None => None,
+                Some("left-symmetric") => Some(guara_core::raid::Layout::LeftSymmetric),
+                Some("left-asymmetric") => Some(guara_core::raid::Layout::LeftAsymmetric),
+                Some("right-symmetric") => Some(guara_core::raid::Layout::RightSymmetric),
+                Some("right-asymmetric") => Some(guara_core::raid::Layout::RightAsymmetric),
+                Some(x) => return Err(format!("layout desconhecido: {x}")),
+            };
+            Some(RaidSpec {
+                level,
+                chunk_kb: self.raid_chunk_kb,
+                layout,
+                order: (!self.raid_order.is_empty()).then(|| self.raid_order.clone()),
+            })
+        } else {
+            None
+        };
+        Ok(Assembly {
+            raid,
+            members: self.members.iter().filter(|m| *m != "-").cloned().collect(),
+            secrets,
+            remember_keys: self.remember_keys,
+            keys: vec![],
+        })
+    }
+}
+
 #[derive(clap::Args)]
 struct ScanArgs {
    /// Dispositivo ou imagem
@@ -147,6 +299,8 @@ struct ScanArgs {
    #[arg(long)]
    recover: Option<String>,
    #[command(flatten)]
+    asm: AsmArgs,
+    #[command(flatten)]
    filter: FilterArgs,
    #[command(flatten)]
    out: OutArgs,
@@ -197,8 +351,14 @@ fn run(cli: Cli) -> Result<(), String> {
            }
            Ok(())
        }
-        Cmd::Inspect { path, json } => {
-            let v = eng.rpc("inspect", json!({ "path": path })).map_err(s)?;
+        Cmd::Inspect { path, json, asm } => {
+            let a = asm.assembly()?;
+            let v = eng
+                .rpc(
+                    "inspect",
+                    json!({ "path": path, "assembly": serde_json::to_value(&a).map_err(s)?}),
+                )
+                .map_err(s)?;
            if json {
                println!("{}", serde_json::to_string_pretty(&v).unwrap());
            } else {
@@ -206,6 +366,15 @@ fn run(cli: Cli) -> Result<(), String> {
            }
            Ok(())
        }
+        Cmd::Health { path, json } => {
+            let v = eng.rpc("health", json!({ "path": path })).map_err(s)?;
+            if json {
+                println!("{}", serde_json::to_string_pretty(&v).unwrap());
+            } else {
+                print_health(&v);
+            }
+            Ok(())
+        }
        Cmd::Scan(a) => {
            let opts = ScanOptions {
                mode: if a.quick {
@@ -215,6 +384,8 @@ fn run(cli: Cli) -> Result<(), String> {
                },
                include_allocated: a.include_allocated,
                categories: parse_cats(&a.filter.category)?,
+                assembly: a.asm.assembly()?,
+                references: a.asm.references.clone(),
                ..Default::default()
            };
            let job = eng.start_scan(&a.path, opts).map_err(s)?;
@@ -256,8 +427,88 @@ fn run(cli: Cli) -> Result<(), String> {
            eng.save_session(&job, &session).map_err(s)?;
            Ok(())
        }
-        Cmd::Image { path, dest } => {
-            let job = eng.start_image(&path, &dest).map_err(s)?;
+        Cmd::Verify { path } if path.to_ascii_lowercase().ends_with(".aff4") => {
+            let a = guara_core::aff4::Aff4Source::open(std::path::Path::new(&path)).map_err(s)?;
+            println!("Formato: AFF4");
+            for (k, v) in &a.info {
+                println!("{k}: {v}");
+            }
+            eprintln!("Recalculando o hash...");
+            match a.verify_stream_md5().map_err(s)? {
+                Some(true) => {
+                    println!("MD5 gravado e recalculado conferem.");
+                    Ok(())
+                }
+                Some(false) => Err("O MD5 recalculado difere do gravado na imagem.".into()),
+                None => {
+                    println!("Esta imagem não traz MD5 para conferir.");
+                    Ok(())
+                }
+            }
+        }
+        Cmd::Verify { path } => {
+            let e = guara_core::ewf::EwfSource::open(std::path::Path::new(&path)).map_err(s)?;
+            println!(
+                "Formato: {}",
+                if e.info.version == 2 {
+                    "Ex01 (EnCase 7)"
+                } else {
+                    "E01 (EnCase)"
+                }
+            );
+            println!("Segmentos: {}", e.info.segments);
+            for (k, v) in &e.info.fields {
+                println!("{k}: {v}");
+            }
+            eprintln!("Recalculando o hash...");
+            match e.verify().map_err(s)? {
+                Some(true) => {
+                    println!("MD5 gravado e recalculado conferem: {}", e.info.md5.clone().unwrap_or_default());
+                    Ok(())
+                }
+                Some(false) => Err("O MD5 recalculado difere do gravado na imagem: ela está corrompida ou foi alterada.".into()),
+                None => {
+                    println!("Esta imagem não traz hash gravado para conferir.");
+                    Ok(())
+                }
+            }
+        }
+        Cmd::Image {
+            path,
+            dest,
+            format,
+            case,
+            examiner,
+            description,
+            evidence,
+            notes,
+            segment_mib,
+            compression,
+        } => {
+            let fmt = match format.as_str() {
+                "raw" => guara_core::image::ImageFormat::Raw,
+                "e01" => guara_core::image::ImageFormat::E01 {
+                    case_number: case,
+                    description,
+                    evidence_number: evidence,
+                    examiner,
+                    notes,
+                    segment_mib,
+                    compression,
+                },
+                "aff4" => guara_core::image::ImageFormat::Aff4 {
+                    case_number: case,
+                    examiner,
+                    evidence_number: evidence,
+                    notes,
+                },
+                x => {
+                    return Err(format!(
+                        "formato de imagem desconhecido: {x} (use raw, e01 ou aff4)"
+                    ))
+                }
+            };
+            let job = eng.start_image_as(&path, &dest, &fmt).map_err(s)?;
            let st = wait(&eng, &job, None)?;
            if st["status"] == "error" {
                return Err(st["error"].as_str().unwrap_or("falha").to_string());
@@ -702,3 +953,98 @@ fn paint(code: &str, s: &str) -> String {
 fn s<E: std::fmt::Display>(e: E) -> String {
    e.to_string()
 }
+
+fn print_health(v: &Value) {
+    let st = v["status"].as_str().unwrap_or("unknown");
+    if !v["available"].as_bool().unwrap_or(false) {
+        println!("{}", v["summary"].as_str().unwrap_or(""));
+        return;
+    }
+    let word = match st {
+        "ok" => paint("32", "Bom"),
+        "warning" => paint("33", "Atenção"),
+        "failing" => paint("31", "Ruim"),
+        _ => "?".into(),
+    };
+    let pct = v["health_pct"]
+        .as_u64()
+        .map(|p| format!(" ({p}%)"))
+        .unwrap_or_default();
+    println!("Disco: {}", v["disk"].as_str().unwrap_or(""));
+    if let Some(p) = v["partition"].as_str() {
+        println!("  (o SMART é do disco inteiro que contém {p})");
+    }
+    println!(
+        "Estado: {word}{pct}  {}",
+        v["summary"].as_str().unwrap_or("")
+    );
+    let num = |k: &str| v[k].as_i64();
+    let bytes = |k: &str| v[k].as_u64().map(human);
+    let mut m = Vec::new();
+    if let Some(t) = num("temperature_c") {
+        m.push(format!("Temperatura: {t} °C"));
+    }
+    if let Some(h) = num("power_on_hours") {
+        m.push(format!("Horas ligado: {h}"));
+    }
+    if let Some(c) = num("power_cycles") {
+        m.push(format!("Vezes ligado: {c}"));
+    }
+    if let Some(r) = bytes("host_reads") {
+        m.push(format!("Total lido: {r}"));
+    }
+    if let Some(w) = bytes("host_writes") {
+        m.push(format!("Total gravado: {w}"));
+    }
+    if !m.is_empty() {
+        println!("{}", m.join(" · "));
+    }
+    if st != "ok" {
+        for kv in v["details"].as_array().into_iter().flatten() {
+            println!(
+                "  ! {}: {}",
+                kv[0].as_str().unwrap_or(""),
+                kv[1].as_str().unwrap_or("")
+            );
+        }
+    }
+    println!();
+    for kv in v["info"].as_array().into_iter().flatten() {
+        println!(
+            "  {:<24}{}",
+            kv[0].as_str().unwrap_or(""),
+            kv[1].as_str().unwrap_or("")
+        );
+    }
+    let attrs = v["attributes"].as_array().cloned().unwrap_or_default();
+    if !attrs.is_empty() {
+        let o = |x: &Value| {
+            x.as_i64()
+                .map(|n| n.to_string())
+                .unwrap_or_else(|| "-".into())
+        };
+        println!(
+            "\n     ID  {:<34}{:>6}{:>6}{:>7}  Bruto",
+            "Atributo", "Atual", "Pior", "Limite"
+        );
+        for a in attrs {
+            let dot = match a["status"].as_str() {
+                Some("failing") => paint("31", "●"),
+                Some("warning") => paint("33", "●"),
+                _ => paint("32", "●"),
+            };
+            println!(
+                "  {dot}  {:<3} {:<34}{:>6}{:>6}{:>7}  {}",
+                a["id"].as_str().unwrap_or(""),
+                a["name"].as_str().unwrap_or(""),
+                o(&a["value"]),
+                o(&a["worst"]),
+                o(&a["thresh"]),
+                a["raw"].as_str().unwrap_or("")
+            );
+        }
+    }
+    for adv in v["advice"].as_array().into_iter().flatten() {
+        println!("\n{}", adv.as_str().unwrap_or(""));
+    }
+}
@@ -19,6 +19,16 @@ image = { version = "0.25", default-features = false, features = ["png", "gif",
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
 thiserror = "2"
 tiny_http = "0.12"
+bzip2 = "0.6"
+zip = { version = "2", default-features = false, features = ["deflate"] }
+snap = "1"
+ruzstd = "0.7"
+lz4_flex = { version = "0.11", default-features = false, features = ["safe-decode", "safe-encode"] }
+aes = "0.8"
+hmac = "0.12"
+pbkdf2 = { version = "0.12", default-features = false, features = ["hmac"] }
+ripemd = "0.1"
+argon2 = "0.5"

 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
@@ -28,3 +38,4 @@ windows-sys = { version = "0.59", features = ["Win32_Foundation", "Win32_Storage

 [dev-dependencies]
 tempfile = "3"
+mp4 = "0.14"
@@ -0,0 +1,846 @@
+//! AFF4 (Advanced Forensic Format 4, padrão v1.0): contêiner ZIP com metadados em Turtle.
+//!
+//! Leitura de imagens lineares e mapeadas (inclusive esparsas), com blocos comprimidos por
+//! snappy, deflate, LZ4 ou sem compressão. Gravação de uma imagem linear com blocos snappy.
+//! Conjuntos em vários volumes (spanned/striped) não são suportados.
+
+use crate::error::{Error, Result};
+use crate::hashing::MultiHasher;
+use crate::image::ImageReport;
+use crate::source::{read_exact_at, Source};
+use std::collections::HashMap;
+use std::fs::File;
+use std::io::{self, Read, Write};
+use std::path::Path;
+use std::sync::Mutex;
+
+pub fn is_aff4(head: &[u8]) -> bool {
+    // ZIP local file header + primeiro nome "container.description" ou "version.txt".
+    head.len() > 50
+        && head.starts_with(b"PK\x03\x04")
+        && (find(&head[30..head.len().min(80)], b"container.description")
+            || find(&head[30..head.len().min(80)], b"version.txt"))
+}
+
+fn find(h: &[u8], n: &[u8]) -> bool {
+    h.windows(n.len()).any(|w| w == n)
+}
+
+const NS: &str = "http://aff4.org/Schema#";
+
+// ------------------------------------------------------------------ Turtle
+
+#[derive(Debug, Default, Clone)]
+struct Resource {
+    types: Vec<String>,
+    props: HashMap<String, Vec<String>>,
+}
+
+impl Resource {
+    fn get(&self, k: &str) -> Option<&str> {
+        self.props
+            .get(k)
+            .and_then(|v| v.first())
+            .map(|s| s.as_str())
+    }
+    fn num(&self, k: &str) -> Option<u64> {
+        self.get(k)?.parse().ok()
+    }
+    fn is(&self, t: &str) -> bool {
+        self.types.iter().any(|x| x == t)
+    }
+}
+
+struct Turtle<'a> {
+    b: &'a [u8],
+    i: usize,
+    prefixes: HashMap<String, String>,
+}
+
+impl Turtle<'_> {
+    fn ws(&mut self) {
+        loop {
+            while self.i < self.b.len() && self.b[self.i].is_ascii_whitespace() {
+                self.i += 1;
+            }
+            if self.i < self.b.len() && self.b[self.i] == b'#' {
+                while self.i < self.b.len() && self.b[self.i] != b'\n' {
+                    self.i += 1;
+                }
+            } else {
+                break;
+            }
+        }
+    }
+    fn expand(&self, tok: &str) -> String {
+        if let Some((p, l)) = tok.split_once(':') {
+            if let Some(base) = self.prefixes.get(p) {
+                return format!("{base}{l}");
+            }
+        }
+        tok.to_string()
+    }
+    /// Um termo: <iri>, "literal"[^^tipo], nome:prefixado ou `a`.
+    fn term(&mut self) -> Option<String> {
+        self.ws();
+        let c = *self.b.get(self.i)?;
+        match c {
+            b'<' => {
+                let s = self.i + 1;
+                while self.i < self.b.len() && self.b[self.i] != b'>' {
+                    self.i += 1;
+                }
+                let v = String::from_utf8_lossy(&self.b[s..self.i]).to_string();
+                self.i += 1;
+                Some(v)
+            }
+            b'"' => {
+                self.i += 1;
+                let mut out = Vec::new();
+                while self.i < self.b.len() && self.b[self.i] != b'"' {
+                    if self.b[self.i] == b'\\' && self.i + 1 < self.b.len() {
+                        self.i += 1;
+                    }
+                    out.push(self.b[self.i]);
+                    self.i += 1;
+                }
+                self.i += 1;
+                if self.b[self.i..].starts_with(b"^^") {
+                    self.i += 2;
+                    let _ = self.term();
+                } else if self.b.get(self.i) == Some(&b'@') {
+                    while self.i < self.b.len() && !self.b[self.i].is_ascii_whitespace() {
+                        self.i += 1;
+                    }
+                }
+                Some(String::from_utf8_lossy(&out).to_string())
+            }
+            _ => {
+                let s = self.i;
+                while self.i < self.b.len()
+                    && !self.b[self.i].is_ascii_whitespace()
+                    && !matches!(self.b[self.i], b';' | b',')
+                {
+                    self.i += 1;
+                }
+                // ponto final de sentença colado ao termo
+                let mut e = self.i;
+                if e > s && self.b[e - 1] == b'.' {
+                    e -= 1;
+                    self.i = e;
+                }
+                let tok = String::from_utf8_lossy(&self.b[s..e]).to_string();
+                Some(if tok == "a" { tok } else { self.expand(&tok) })
+            }
+        }
+    }
+}
+
+fn parse_turtle(text: &str) -> HashMap<String, Resource> {
+    let mut t = Turtle {
+        b: text.as_bytes(),
+        i: 0,
+        prefixes: HashMap::new(),
+    };
+    let mut out: HashMap<String, Resource> = HashMap::new();
+    loop {
+        t.ws();
+        if t.i >= t.b.len() {
+            break;
+        }
+        if t.b[t.i..].starts_with(b"@prefix") {
+            t.i += 7;
+            t.ws();
+            let s = t.i;
+            while t.i < t.b.len() && t.b[t.i] != b':' {
+                t.i += 1;
+            }
+            let name = String::from_utf8_lossy(&t.b[s..t.i]).trim().to_string();
+            t.i += 1;
+            let iri = t.term().unwrap_or_default();
+            t.ws();
+            if t.b.get(t.i) == Some(&b'.') {
+                t.i += 1;
+            }
+            t.prefixes.insert(name, iri);
+            continue;
+        }
+        // sujeito
+        let Some(subj) =
+            (if t.b[t.i] == b':' && t.b.get(t.i + 1).map_or(true, |c| c.is_ascii_whitespace()) {
+                t.i += 1;
+                Some(t.prefixes.get("").cloned().unwrap_or_default())
+            } else {
+                t.term()
+            })
+        else {
+            break;
+        };
+        let res = out.entry(subj).or_default();
+        loop {
+            let Some(pred) = t.term() else { return out };
+            let mut objs = vec![];
+            loop {
+                let Some(o) = t.term() else { return out };
+                objs.push(o);
+                t.ws();
+                if t.b.get(t.i) == Some(&b',') {
+                    t.i += 1;
+                    continue;
+                }
+                break;
+            }
+            if pred == "a" {
+                res.types.extend(objs);
+            } else {
+                res.props.entry(pred).or_default().extend(objs);
+            }
+            t.ws();
+            match t.b.get(t.i) {
+                Some(b';') => {
+                    t.i += 1;
+                    t.ws();
+                    // ";" final antes de "."
+                    if t.b.get(t.i) == Some(&b'.') {
+                        t.i += 1;
+                        break;
+                    }
+                }
+                Some(b'.') => {
+                    t.i += 1;
+                    break;
+                }
+                _ => break,
+            }
+        }
+    }
+    out
+}
+
+// ------------------------------------------------------------------ leitor
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Method {
+    Stored,
+    Deflate,
+    Zlib,
+    Snappy,
+    Lz4,
+}
+
+#[derive(Clone)]
+struct ImageStream {
+    urn: String,
+    chunk: u64,
+    per_bevy: u64,
+    method: Method,
+    size: u64,
+}
+
+#[derive(Clone, Copy)]
+struct MapEntry {
+    start: u64,
+    len: u64,
+    target_off: u64,
+    target: u32,
+}
+
+#[derive(Clone)]
+enum Target {
+    Stream(usize),
+    Zero,
+    Fill(u8),
+}
+
+#[derive(Clone, Copy)]
+struct Loc {
+    data_start: u64,
+    size: u64,
+}
+
+pub struct Aff4Source {
+    file: File,
+    entries: HashMap<String, Loc>,
+    streams: Vec<ImageStream>,
+    targets: Vec<Target>,
+    map: Vec<MapEntry>,
+    size: u64,
+    /// Metadados legíveis: caso, examinador, notas, hashes.
+    pub info: HashMap<String, String>,
+    cache: Mutex<Option<(usize, u64, Vec<u8>)>>,
+    index_cache: Mutex<HashMap<(usize, u64), std::sync::Arc<Vec<u8>>>>,
+}
+
+fn enc(urn: &str) -> String {
+    urn.replace(':', "%3A").replace('/', "%2F")
+}
+
+fn method_of(uri: &str) -> Method {
+    let u = uri.to_ascii_lowercase();
+    if u.contains("snappy") {
+        Method::Snappy
+    } else if u.contains("lz4") {
+        Method::Lz4
+    } else if u.contains("rfc1951") {
+        Method::Deflate
+    } else if u.contains("rfc1950") {
+        Method::Zlib
+    } else {
+        Method::Stored
+    }
+}
+
+impl Aff4Source {
+    pub fn open(path: &Path) -> Result<Self> {
+        let file = File::open(path)?;
+        let mut zip = zip::ZipArchive::new(file.try_clone()?)
+            .map_err(|e| Error::msg(format!("AFF4 inválido (ZIP): {e}")))?;
+        let mut entries = HashMap::new();
+        for i in 0..zip.len() {
+            let f = zip.by_index_raw(i).map_err(|e| Error::msg(e.to_string()))?;
+            entries.insert(
+                f.name().to_string(),
+                Loc {
+                    data_start: f.data_start(),
+                    size: f.compressed_size(),
+                },
+            );
+        }
+        let turtle = {
+            let mut f = zip
+                .by_name("information.turtle")
+                .map_err(|_| Error::msg("AFF4 sem information.turtle"))?;
+            let mut s = String::new();
+            f.read_to_string(&mut s)?;
+            s
+        };
+        let res = parse_turtle(&turtle);
+        let img_t = format!("{NS}Image");
+        let disk_t = format!("{NS}DiskImage");
+        let ds = format!("{NS}dataStream");
+        let image = res
+            .values()
+            .find(|r| (r.is(&img_t) || r.is(&disk_t)) && r.get(&ds).is_some())
+            .ok_or_else(|| {
+                Error::msg("AFF4 sem objeto de imagem (aff4:Image com aff4:dataStream)")
+            })?;
+        let mut info = HashMap::new();
+        if let Some(v) = image.get(&format!("{NS}diskModel")) {
+            info.insert("Modelo do disco".to_string(), v.to_string());
+        }
+        for (k, label) in [
+            ("caseNumber", "Número do caso"),
+            ("examiner", "Examinador"),
+            ("notes", "Notas"),
+            ("evidenceNumber", "Número da evidência"),
+            ("caseName", "Nome do caso"),
+        ] {
+            if let Some(v) = res.values().find_map(|r| r.get(&format!("{NS}{k}"))) {
+                info.insert(label.to_string(), v.to_string());
+            }
+        }
+        let data_urn = image.get(&ds).unwrap().to_string();
+        // Hashes gravados no fluxo de dados (ou no mapa).
+        for r in res
+            .values()
+            .filter(|r| r.get(&format!("{NS}hash")).is_some())
+        {
+            for h in r.props.get(&format!("{NS}hash")).into_iter().flatten() {
+                match h.len() {
+                    32 if h.chars().all(|c| c.is_ascii_hexdigit()) => {
+                        info.entry("md5".to_string()).or_insert_with(|| h.clone());
+                    }
+                    40 if h.chars().all(|c| c.is_ascii_hexdigit()) => {
+                        info.entry("sha1".to_string()).or_insert_with(|| h.clone());
+                    }
+                    _ => {}
+                }
+            }
+        }
+        let mut me = Self {
+            file,
+            entries,
+            streams: vec![],
+            targets: vec![],
+            map: vec![],
+            size: 0,
+            info,
+            cache: Mutex::new(None),
+            index_cache: Mutex::new(HashMap::new()),
+        };
+        let top = res
+            .get(&data_urn)
+            .ok_or_else(|| Error::msg("AFF4: fluxo de dados da imagem não encontrado"))?;
+        let map_t = format!("{NS}Map");
+        if top.is(&map_t) {
+            me.size = top.num(&format!("{NS}size")).unwrap_or(0);
+            let mp = enc(&data_urn);
+            let idx_txt = me.read_entry(&format!("{mp}/idx"))?;
+            for line in String::from_utf8_lossy(&idx_txt).lines() {
+                let line = line.trim();
+                if line.is_empty() {
+                    continue;
+                }
+                if let Some(sym) = line.strip_prefix(&format!("{NS}SymbolicStream")) {
+                    let b = u8::from_str_radix(sym, 16)
+                        .map_err(|_| Error::msg("AFF4: fluxo simbólico inválido"))?;
+                    me.targets.push(Target::Fill(b));
+                } else if line == format!("{NS}Zero") {
+                    me.targets.push(Target::Zero);
+                } else if line.starts_with(NS) {
+                    me.targets.push(Target::Zero);
+                } else {
+                    let s = me.load_stream(&res, line)?;
+                    me.streams.push(s);
+                    me.targets.push(Target::Stream(me.streams.len() - 1));
+                }
+            }
+            let m = me.read_entry(&format!("{mp}/map"))?;
+            for c in m.chunks_exact(28) {
+                me.map.push(MapEntry {
+                    start: u64::from_le_bytes(c[0..8].try_into().unwrap()),
+                    len: u64::from_le_bytes(c[8..16].try_into().unwrap()),
+                    target_off: u64::from_le_bytes(c[16..24].try_into().unwrap()),
+                    target: u32::from_le_bytes(c[24..28].try_into().unwrap()),
+                });
+            }
+            me.map.sort_by_key(|e| e.start);
+        } else {
+            let s = me.load_stream(&res, &data_urn)?;
+            me.size = s.size;
+            me.streams.push(s);
+            me.targets.push(Target::Stream(0));
+            me.map = vec![MapEntry {
+                start: 0,
+                len: me.size,
+                target_off: 0,
+                target: 0,
+            }];
+        }
+        if me.size == 0 {
+            me.size = image.num(&format!("{NS}size")).unwrap_or(0);
+        }
+        Ok(me)
+    }
+
+    fn load_stream(&self, res: &HashMap<String, Resource>, urn: &str) -> Result<ImageStream> {
+        let r = res
+            .get(urn)
+            .ok_or_else(|| Error::msg(format!("AFF4: fluxo {urn} não descrito")))?;
+        Ok(ImageStream {
+            urn: urn.to_string(),
+            chunk: r.num(&format!("{NS}chunkSize")).unwrap_or(32768),
+            per_bevy: r.num(&format!("{NS}chunksInSegment")).unwrap_or(2048),
+            method: r
+                .get(&format!("{NS}compressionMethod"))
+                .map(method_of)
+                .unwrap_or(Method::Stored),
+            size: r.num(&format!("{NS}size")).unwrap_or(0),
+        })
+    }
+
+    /// MD5 do primeiro fluxo de blocos (o que o AFF4 grava em `aff4:hash`), para conferir a integridade.
+    pub fn verify_stream_md5(&self) -> Result<Option<bool>> {
+        let Some(want) = self.info.get("md5").cloned() else {
+            return Ok(None);
+        };
+        let Some(st) = self.streams.first() else {
+            return Ok(None);
+        };
+        let mut h = MultiHasher::new();
+        let mut buf = vec![0u8; st.chunk as usize];
+        let mut pos = 0u64;
+        while pos < st.size {
+            let n = (st.size - pos).min(st.chunk) as usize;
+            self.read_stream(0, pos, &mut buf[..n])?;
+            h.update(&buf[..n]);
+            pos += n as u64;
+        }
+        Ok(Some(h.finalize().md5 == want))
+    }
+
+    fn read_entry(&self, name: &str) -> Result<Vec<u8>> {
+        let loc = self
+            .entries
+            .get(name)
+            .ok_or_else(|| Error::msg(format!("AFF4: entrada {name} ausente")))?;
+        let mut v = vec![0u8; loc.size as usize];
+        read_exact_at_file(&self.file, loc.data_start, &mut v)?;
+        Ok(v)
+    }
+
+    fn chunk(&self, si: usize, chunk_no: u64) -> io::Result<Vec<u8>> {
+        {
+            let c = self.cache.lock().unwrap();
+            if let Some((s, n, d)) = c.as_ref() {
+                if *s == si && *n == chunk_no {
+                    return Ok(d.clone());
+                }
+            }
+        }
+        let st = &self.streams[si];
+        let (bevy, within) = (chunk_no / st.per_bevy, chunk_no % st.per_bevy);
+        let base = format!("{}/{:08}", enc(&st.urn), bevy);
+        let index = {
+            let mut ic = self.index_cache.lock().unwrap();
+            if let Some(i) = ic.get(&(si, bevy)) {
+                i.clone()
+            } else {
+                let loc = self.entries.get(&format!("{base}.index")).ok_or_else(|| {
+                    io::Error::new(io::ErrorKind::NotFound, "índice do bevy ausente")
+                })?;
+                let mut v = vec![0u8; loc.size as usize];
+                read_exact_at_file(&self.file, loc.data_start, &mut v)?;
+                let a = std::sync::Arc::new(v);
+                ic.insert((si, bevy), a.clone());
+                a
+            }
+        };
+        let e = index
+            .get(within as usize * 12..within as usize * 12 + 12)
+            .ok_or_else(|| io::Error::new(io::ErrorKind::UnexpectedEof, "bloco fora do índice"))?;
+        let (off, len) = (
+            u64::from_le_bytes(e[0..8].try_into().unwrap()),
+            u32::from_le_bytes(e[8..12].try_into().unwrap()) as usize,
+        );
+        let loc = self
+            .entries
+            .get(&base)
+            .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "bevy ausente"))?;
+        let mut raw = vec![0u8; len];
+        read_exact_at_file(&self.file, loc.data_start + off, &mut raw)?;
+        let want = st.chunk.min(st.size.saturating_sub(chunk_no * st.chunk)) as usize;
+        let data = if len == st.chunk as usize || st.method == Method::Stored {
+            raw
+        } else {
+            let bad = |m: String| io::Error::new(io::ErrorKind::InvalidData, m);
+            match st.method {
+                Method::Snappy => snap::raw::Decoder::new()
+                    .decompress_vec(&raw)
+                    .map_err(|e| bad(format!("snappy: {e}")))?,
+                Method::Lz4 => lz4_flex::block::decompress(&raw, st.chunk as usize)
+                    .map_err(|e| bad(format!("lz4: {e}")))?,
+                Method::Deflate => {
+                    let mut v = Vec::with_capacity(st.chunk as usize);
+                    flate2::read::DeflateDecoder::new(&raw[..])
+                        .read_to_end(&mut v)
+                        .map_err(|e| bad(format!("deflate: {e}")))?;
+                    v
+                }
+                Method::Zlib => {
+                    let mut v = Vec::with_capacity(st.chunk as usize);
+                    flate2::read::ZlibDecoder::new(&raw[..])
+                        .read_to_end(&mut v)
+                        .map_err(|e| bad(format!("zlib: {e}")))?;
+                    v
+                }
+                Method::Stored => unreachable!(),
+            }
+        };
+        let mut data = data;
+        data.resize(want.max(data.len().min(st.chunk as usize)), 0);
+        *self.cache.lock().unwrap() = Some((si, chunk_no, data.clone()));
+        Ok(data)
+    }
+
+    fn read_stream(&self, si: usize, off: u64, buf: &mut [u8]) -> io::Result<()> {
+        let cs = self.streams[si].chunk;
+        let mut done = 0;
+        while done < buf.len() {
+            let pos = off + done as u64;
+            let (cn, within) = (pos / cs, (pos % cs) as usize);
+            let d = self.chunk(si, cn)?;
+            if within >= d.len() {
+                buf[done..].fill(0);
+                return Ok(());
+            }
+            let n = (d.len() - within).min(buf.len() - done);
+            buf[done..done + n].copy_from_slice(&d[within..within + n]);
+            done += n;
+        }
+        Ok(())
+    }
+}
+
+fn read_exact_at_file(f: &File, off: u64, buf: &mut [u8]) -> io::Result<()> {
+    #[cfg(unix)]
+    {
+        std::os::unix::fs::FileExt::read_exact_at(f, buf, off)
+    }
+    #[cfg(windows)]
+    {
+        let mut done = 0;
+        while done < buf.len() {
+            let n =
+                std::os::windows::fs::FileExt::seek_read(f, &mut buf[done..], off + done as u64)?;
+            if n == 0 {
+                return Err(io::Error::new(
+                    io::ErrorKind::UnexpectedEof,
+                    "AFF4 truncado",
+                ));
+            }
+            done += n;
+        }
+        Ok(())
+    }
+}
+
+impl Source for Aff4Source {
+    fn size(&self) -> u64 {
+        self.size
+    }
+
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<usize> {
+        if offset >= self.size || buf.is_empty() {
+            return Ok(0);
+        }
+        let want = buf.len().min((self.size - offset) as usize);
+        let mut done = 0usize;
+        while done < want {
+            let pos = offset + done as u64;
+            let i = self.map.partition_point(|e| e.start + e.len <= pos);
+            let Some(e) = self.map.get(i).filter(|e| e.start <= pos) else {
+                // vão do mapa: zeros até a próxima entrada
+                let next = self.map.get(i).map(|e| e.start).unwrap_or(self.size);
+                let n = ((next - pos) as usize).min(want - done);
+                buf[done..done + n].fill(0);
+                done += n;
+                continue;
+            };
+            let n = ((e.start + e.len - pos) as usize).min(want - done);
+            let toff = e.target_off + (pos - e.start);
+            match self.targets.get(e.target as usize) {
+                Some(Target::Stream(si)) => {
+                    self.read_stream(*si, toff, &mut buf[done..done + n])?
+                }
+                Some(Target::Fill(b)) => buf[done..done + n].fill(*b),
+                _ => buf[done..done + n].fill(0),
+            }
+            done += n;
+        }
+        Ok(done)
+    }
+}
+
+// ------------------------------------------------------------------ gravação
+
+#[derive(Debug, Clone)]
+pub struct Aff4Options {
+    pub case_name: String,
+    pub examiner: String,
+    pub notes: String,
+    pub evidence_number: String,
+    pub chunk_size: u32,
+}
+
+impl Default for Aff4Options {
+    fn default() -> Self {
+        Self {
+            case_name: String::new(),
+            examiner: String::new(),
+            notes: String::new(),
+            evidence_number: String::new(),
+            chunk_size: 32768,
+        }
+    }
+}
+
+fn new_uuid() -> String {
+    let mut b = [0u8; 16];
+    let _ = std::fs::File::open("/dev/urandom").and_then(|mut f| f.read_exact(&mut b));
+    if b == [0u8; 16] {
+        let t = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .map(|d| d.as_nanos())
+            .unwrap_or(1);
+        b = (t ^ (std::process::id() as u128) << 64).to_le_bytes();
+    }
+    b[6] = (b[6] & 0x0F) | 0x40;
+    b[8] = (b[8] & 0x3F) | 0x80;
+    let h: Vec<String> = b.iter().map(|x| format!("{x:02x}")).collect();
+    format!(
+        "{}-{}-{}-{}-{}",
+        h[0..4].concat(),
+        h[4..6].concat(),
+        h[6..8].concat(),
+        h[8..10].concat(),
+        h[10..16].concat()
+    )
+}
+
+fn iso_now() -> String {
+    let secs = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs() as i64)
+        .unwrap_or(0);
+    let days = secs.div_euclid(86400);
+    let rem = secs.rem_euclid(86400);
+    let z = days + 719468;
+    let era = z.div_euclid(146097);
+    let doe = z.rem_euclid(146097);
+    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+    let y = yoe + era * 400;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = if m <= 2 { y + 1 } else { y };
+    format!(
+        "{y:04}-{m:02}-{d:02}T{:02}:{:02}:{:02}.000Z",
+        rem / 3600,
+        rem % 3600 / 60,
+        rem % 60
+    )
+}
+
+fn esc(s: &str) -> String {
+    s.replace('\\', "\\\\")
+        .replace('"', "\\\"")
+        .replace('\n', "\\n")
+}
+
+/// Grava uma imagem AFF4 linear (um fluxo de blocos snappy) de `src`.
+pub fn write_aff4(
+    src: &dyn Source,
+    dest: &Path,
+    opts: &Aff4Options,
+    cancelled: &(dyn Fn() -> bool + Sync),
+    progress: &mut dyn FnMut(u64, u64),
+) -> Result<ImageReport> {
+    let out = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(dest)
+        .map_err(|e| {
+            Error::msg(format!(
+                "não foi possível criar {}: {e} (o arquivo não pode existir)",
+                dest.display()
+            ))
+        })?;
+    crate::owner::give_to_user(dest);
+    let total = src.size();
+    let chunk = opts.chunk_size as u64;
+    let per_bevy = 2048u64;
+    let volume = format!("aff4://{}", new_uuid());
+    let stream = format!("aff4://{}", new_uuid());
+    let image = format!("aff4://{}", new_uuid());
+    let mut zip = zip::ZipWriter::new(out);
+    let stored = zip::write::SimpleFileOptions::default()
+        .compression_method(zip::CompressionMethod::Stored)
+        .large_file(true);
+    let result = (|| -> Result<ImageReport> {
+        zip.start_file("container.description", stored)
+            .map_err(zerr)?;
+        zip.write_all(volume.as_bytes())?;
+        zip.start_file("version.txt", stored).map_err(zerr)?;
+        zip.write_all(format!("major=1\nminor=2\ntool=Guara {}\n", crate::VERSION).as_bytes())?;
+
+        let mut rep = ImageReport::default();
+        let mut hasher = MultiHasher::new();
+        let mut buf = vec![0u8; chunk as usize];
+        let mut pos = 0u64;
+        let mut chunk_no = 0u64;
+        let mut enc_snap = snap::raw::Encoder::new();
+        while pos < total {
+            let bevy = chunk_no / per_bevy;
+            let name = format!("{}/{:08}", enc(&stream), bevy);
+            zip.start_file(name.as_str(), stored).map_err(zerr)?;
+            let mut index: Vec<u8> = vec![];
+            let mut boff = 0u64;
+            for _ in 0..per_bevy {
+                if pos >= total {
+                    break;
+                }
+                if cancelled() {
+                    rep.cancelled = true;
+                    break;
+                }
+                let want = (total - pos).min(chunk) as usize;
+                let b = &mut buf[..want];
+                if read_exact_at(src, pos, b).is_err() {
+                    let mut o = 0;
+                    while o < want {
+                        let n = 512.min(want - o);
+                        if read_exact_at(src, pos + o as u64, &mut b[o..o + n]).is_err() {
+                            b[o..o + n].fill(0);
+                            match rep.bad_ranges.last_mut() {
+                                Some(l) if l.0 + l.1 == pos + o as u64 => l.1 += n as u64,
+                                _ => rep.bad_ranges.push((pos + o as u64, n as u64)),
+                            }
+                        }
+                        o += n;
+                    }
+                }
+                hasher.update(b);
+                // bloco curto (último) é guardado como está; comprimido só se ficar menor
+                let comp = enc_snap
+                    .compress_vec(b)
+                    .map_err(|e| Error::msg(e.to_string()))?;
+                // Só um bloco cheio pode ficar sem compressão (comprimento == tamanho do bloco).
+                let data: &[u8] = if want as u64 == chunk && comp.len() >= want {
+                    b
+                } else {
+                    &comp
+                };
+                zip.write_all(data)?;
+                index.extend_from_slice(&boff.to_le_bytes());
+                index.extend_from_slice(&(data.len() as u32).to_le_bytes());
+                boff += data.len() as u64;
+                pos += want as u64;
+                chunk_no += 1;
+                progress(pos, total);
+            }
+            zip.start_file(format!("{name}.index").as_str(), stored)
+                .map_err(zerr)?;
+            zip.write_all(&index)?;
+            if rep.cancelled {
+                break;
+            }
+        }
+        let h = hasher.finalize();
+        rep.bytes = pos;
+        rep.md5 = h.md5.clone();
+        rep.sha1 = h.sha1.clone();
+        rep.sha256 = h.sha256.clone();
+
+        let now = iso_now();
+        let sectors = total.div_ceil(512);
+        let ttl = format!(
+            "@prefix aff4:  <http://aff4.org/Schema#> .\n@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .\n@prefix rdf:   <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .\n\n\
+<{stream}>\n        a                      aff4:ImageStream ;\n        aff4:chunkSize         \"{chunk}\"^^xsd:int ;\n        aff4:chunksInSegment   \"{per_bevy}\"^^xsd:int ;\n        aff4:compressionMethod <http://code.google.com/p/snappy/> ;\n        aff4:hash              \"{sha1}\"^^aff4:SHA1 , \"{md5}\"^^aff4:MD5 ;\n        aff4:size              \"{total}\"^^xsd:long ;\n        aff4:stored            <{volume}> ;\n        aff4:target            <{image}> ;\n        aff4:version           \"1\"^^xsd:int .\n\n\
+<{image}>\n        a                aff4:ContiguousImage , aff4:DiskImage , aff4:Image ;\n        aff4:blockSize   \"512\"^^xsd:int ;\n        aff4:dataStream  <{stream}> ;\n        aff4:sectorCount \"{sectors}\"^^xsd:long ;\n        aff4:size        \"{total}\"^^xsd:long ;\n        aff4:stored      <{volume}> .\n\n\
+<aff4://{notes_id}>\n        a                    aff4:CaseNotes ;\n        aff4:caseNumber      \"{case}\" ;\n        aff4:evidenceNumber  \"{ev}\" ;\n        aff4:examiner        \"{ex}\" ;\n        aff4:notes           \"{notes}\" ;\n        aff4:stored          <{volume}> ;\n        aff4:target          <{image}> ;\n        aff4:timestamp       \"{now}\"^^xsd:dateTime .\n\n\
+<{volume}>\n        a                  aff4:ZipVolume ;\n        aff4:contains      <{stream}> , <{image}> ;\n        aff4:creationTime  \"{now}\"^^xsd:dateTime ;\n        aff4:interface     aff4:Volume ;\n        aff4:stored        \"{fname}\" .\n",
+            sha1 = h.sha1,
+            md5 = h.md5,
+            notes_id = new_uuid(),
+            case = esc(&opts.case_name),
+            ev = esc(&opts.evidence_number),
+            ex = esc(&opts.examiner),
+            notes = esc(&opts.notes),
+            fname = esc(&dest.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default()),
+        );
+        zip.start_file("information.turtle", stored).map_err(zerr)?;
+        zip.write_all(ttl.as_bytes())?;
+        Ok(rep)
+    })();
+    match result {
+        Ok(rep) => {
+            zip.finish().map_err(zerr)?;
+            crate::owner::write_owned(
+                &dest.with_extension("map.json"),
+                serde_json::to_vec_pretty(&rep)?,
+            )?;
+            Ok(rep)
+        }
+        Err(e) => {
+            drop(zip);
+            let _ = std::fs::remove_file(dest);
+            Err(e)
+        }
+    }
+}
+
+fn zerr(e: zip::result::ZipError) -> Error {
+    Error::msg(format!("AFF4/ZIP: {e}"))
+}
@@ -0,0 +1,541 @@
+//! Monta o disco virtual a partir do que o usuário informou: membros extras (RAID/LVM) e
+//! senhas ou chaves para volumes cifrados. É a única porta de entrada para varrer e recuperar
+//! discos que não são "simples".
+
+use crate::crypt::{self, Secret, UnlockError};
+use crate::error::{Error, Result};
+use crate::partition;
+use crate::source::{open_path, Source, SubSource};
+use crate::types::{FsKind, PartInfo};
+use crate::volume::{Overlay, Region};
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+use std::sync::Arc;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "lowercase")]
+pub enum SecretInput {
+    Password {
+        value: String,
+    },
+    Recovery {
+        value: String,
+    },
+    /// Caminho de um arquivo de chave (.BEK do BitLocker, keyfile do LUKS).
+    Keyfile {
+        path: String,
+    },
+    /// Chave do volume em hexadecimal.
+    Key {
+        hex: String,
+    },
+}
+
+/// Chave de volume guardada na sessão (só quando o usuário pede para lembrar).
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct SavedKey {
+    pub start: u64,
+    pub kind: String,
+    pub key_hex: String,
+}
+
+/// RAID sem metadados: o que o usuário sabe; o resto é descoberto.
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct RaidSpec {
+    pub level: Option<crate::raid::Level>,
+    /// Tamanho da faixa em KiB.
+    pub chunk_kb: Option<u64>,
+    pub layout: Option<crate::raid::Layout>,
+    /// Ordem dos discos: índice 0 é o alvo principal, depois `members` na ordem dada.
+    pub order: Option<Vec<usize>>,
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct Assembly {
+    /// Trata o alvo e `members` como discos de um RAID sem metadados (parâmetros descobertos).
+    #[serde(default)]
+    pub raid: Option<RaidSpec>,
+    /// Outros discos ou imagens do mesmo conjunto (RAID/LVM), além do alvo principal.
+    #[serde(default)]
+    pub members: Vec<String>,
+    /// Senhas e chaves: o `snapshot` da sessão as descarta antes de gravar.
+    #[serde(default)]
+    pub secrets: Vec<SecretInput>,
+    /// Guarda as chaves de volume derivadas na sessão, para reabrir sem pedir a senha de novo.
+    #[serde(default)]
+    pub remember_keys: bool,
+    #[serde(default)]
+    pub keys: Vec<SavedKey>,
+}
+
+impl Assembly {
+    pub fn is_plain(&self) -> bool {
+        self.members.is_empty()
+            && self.secrets.is_empty()
+            && self.keys.is_empty()
+            && self.raid.is_none()
+    }
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct UnlockInfo {
+    pub start: u64,
+    pub len: u64,
+    pub kind: String,
+    pub description: String,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct LockedInfo {
+    pub start: u64,
+    pub kind: String,
+    pub reason: String,
+}
+
+pub struct Assembled {
+    pub source: Arc<dyn Source>,
+    pub unlocked: Vec<UnlockInfo>,
+    pub locked: Vec<LockedInfo>,
+    /// Chaves derivadas, para guardar na sessão se o usuário permitir.
+    pub keys: Vec<SavedKey>,
+    /// Volumes lógicos / partições extras que não estão na tabela do disco.
+    pub extra_parts: Vec<PartInfo>,
+    /// Partições reais que são só contêineres (membros de RAID/LVM já remontados).
+    pub covered: Vec<u64>,
+    /// O disco principal é só um membro de RAID: não varrer o disco cru.
+    pub skip_primary: bool,
+    pub notes: Vec<String>,
+}
+
+fn to_secrets(a: &Assembly) -> Result<Vec<Secret>> {
+    let mut v = vec![];
+    for s in &a.secrets {
+        v.push(match s {
+            SecretInput::Password { value } => Secret::Password(value.clone()),
+            SecretInput::Recovery { value } => Secret::RecoveryKey(value.clone()),
+            SecretInput::Keyfile { path } => Secret::KeyFile(std::fs::read(path).map_err(|e| {
+                Error::msg(format!(
+                    "não foi possível ler o arquivo de chave {path}: {e}"
+                ))
+            })?),
+            SecretInput::Key { hex } => Secret::VolumeKey(
+                crypt::from_hex(hex)
+                    .ok_or_else(|| Error::msg("chave do volume em hexadecimal inválida"))?,
+            ),
+        });
+    }
+    Ok(v)
+}
+
+fn kind_name(fs: FsKind) -> &'static str {
+    match fs {
+        FsKind::Bitlocker => "bitlocker",
+        FsKind::Luks => "luks",
+        FsKind::Corestorage => "filevault",
+        _ => "?",
+    }
+}
+
+fn try_unlock(window: Arc<dyn Source>, fs: FsKind, secrets: &[Secret]) -> crypt::UnlockResult {
+    match fs {
+        FsKind::Bitlocker => crypt::bitlocker::unlock(window, secrets),
+        FsKind::Luks => crypt::luks::unlock(window, secrets),
+        FsKind::Corestorage => crypt::filevault::unlock(window, secrets),
+        _ => Err(UnlockError::Unsupported("tipo".into())),
+    }
+}
+
+/// Abre `path` e aplica a montagem pedida.
+pub fn assemble(path: &str, asm: &Assembly) -> Result<Assembled> {
+    let base = open_path(Path::new(path)).map_err(|e| Error::msg(format!("{path}: {e}")))?;
+    assemble_source(base, asm)
+}
+
+const MIB: u64 = 1 << 20;
+
+/// Coloca `src` em `start`; se cair dentro de uma região virtual, a substitui por dentro.
+fn patch(regions: &mut Vec<Region>, start: u64, src: Arc<dyn Source>, label: String) {
+    let len = src.size();
+    if let Some(r) = regions
+        .iter_mut()
+        .find(|r| r.start <= start && start < r.start + r.len)
+    {
+        let inner = Region {
+            start: start - r.start,
+            len,
+            src,
+            label: label.clone(),
+        };
+        let wrapped = Overlay::new(r.src.clone(), vec![inner]);
+        if start == r.start {
+            r.len = r.len.max(len);
+        }
+        r.src = Arc::new(wrapped);
+        return;
+    }
+    regions.push(Region {
+        start,
+        len,
+        src,
+        label,
+    });
+}
+
+/// Candidato a membro de RAID/LVM: uma janela de disco (inteiro ou partição).
+struct Window {
+    src: Arc<dyn Source>,
+    /// Início no espaço do disco virtual, se a janela faz parte dele.
+    primary_start: Option<u64>,
+}
+
+fn windows_of(src: &Arc<dyn Source>, primary: bool) -> Vec<Window> {
+    let mut v = vec![Window {
+        src: src.clone(),
+        primary_start: primary.then_some(0),
+    }];
+    let layout = partition::analyze(src.as_ref(), false);
+    for p in &layout.partitions {
+        let len = if p.len == 0 {
+            src.size().saturating_sub(p.start)
+        } else {
+            p.len
+        };
+        v.push(Window {
+            src: Arc::new(SubSource::new(src.clone(), p.start, len)),
+            primary_start: primary.then_some(p.start),
+        });
+    }
+    v
+}
+
+pub fn assemble_source(base: Arc<dyn Source>, asm: &Assembly) -> Result<Assembled> {
+    let secrets = to_secrets(asm)?;
+    let mut regions: Vec<Region> = vec![];
+    let mut out = Assembled {
+        source: base.clone(),
+        unlocked: vec![],
+        locked: vec![],
+        keys: vec![],
+        extra_parts: vec![],
+        covered: vec![],
+        skip_primary: false,
+        notes: vec![],
+    };
+    let mut members: Vec<Arc<dyn Source>> = vec![];
+    for m in &asm.members {
+        members.push(open_path(Path::new(m)).map_err(|e| Error::msg(format!("{m}: {e}")))?);
+    }
+    let mut next_virtual = base.size().div_ceil(MIB) * MIB + MIB;
+    if let Some(spec) = &asm.raid {
+        let mut disks: Vec<Arc<dyn Source>> = vec![base.clone()];
+        disks.extend(members.iter().cloned());
+        let params = pick_raid(&disks, spec, &mut out.notes)?;
+        let src: Arc<dyn Source> =
+            Arc::new(crate::raid::RaidSource::new(params).map_err(Error::msg)?);
+        out.notes.push(format!(
+            "RAID montado a partir de {} disco(s) sem metadados.",
+            disks.len()
+        ));
+        out.skip_primary = true;
+        members.clear();
+        add_virtual(
+            &mut regions,
+            &mut next_virtual,
+            &mut out,
+            src,
+            "RAID".into(),
+        );
+    }
+    let mut done_containers: std::collections::BTreeSet<String> = Default::default();
+    let mut tried_pool = false;
+    // Rodadas: o que foi aberto/montado pode conter outro volume cifrado, RAID ou LVM.
+    for round in 0..4 {
+        let current: Arc<dyn Source> = Arc::new(Overlay::new(base.clone(), regions.clone()));
+        let layout = partition::analyze(current.as_ref(), false);
+        let mut all_parts: Vec<PartInfo> = layout.partitions.clone();
+        for p in &out.extra_parts {
+            if !all_parts.iter().any(|q| q.start == p.start) {
+                all_parts.push(p.clone());
+            }
+        }
+        let mut progress = false;
+
+        // 1) RAID e LVM: reúne janelas do disco principal e dos membros extras.
+        if round == 0 || !tried_pool || !out.extra_parts.is_empty() {
+            let mut pool: Vec<Window> = vec![];
+            pool.push(Window {
+                src: current.clone(),
+                primary_start: Some(0),
+            });
+            for p in &all_parts {
+                if matches!(p.fs, FsKind::Raid | FsKind::Lvm) {
+                    let len = if p.len == 0 {
+                        current.size().saturating_sub(p.start)
+                    } else {
+                        p.len
+                    };
+                    pool.push(Window {
+                        src: Arc::new(SubSource::new(current.clone(), p.start, len)),
+                        primary_start: Some(p.start),
+                    });
+                }
+            }
+            for m in &members {
+                pool.extend(windows_of(m, false));
+            }
+            tried_pool = true;
+            // RAID
+            let mut md: Vec<(Arc<dyn Source>, crate::raid::MdSuper)> = vec![];
+            let mut md_primary: Vec<u64> = vec![];
+            for w in &pool {
+                if let Some(sup) = crate::raid::read_md_super(w.src.as_ref()) {
+                    if let Some(st) = w.primary_start {
+                        md_primary.push(st);
+                    }
+                    md.push((w.src.clone(), sup));
+                }
+            }
+            let new_md: Vec<_> = md
+                .into_iter()
+                .filter(|(_, s)| {
+                    !done_containers.contains(&format!("md{}", crypt::to_hex(&s.uuid)))
+                })
+                .collect();
+            if !new_md.is_empty() {
+                for (_, s) in &new_md {
+                    done_containers.insert(format!("md{}", crypt::to_hex(&s.uuid)));
+                }
+                for res in crate::raid::assemble_md(new_md) {
+                    match res {
+                        Ok(a) => {
+                            let label = format!(
+                                "{} {}",
+                                a.info.level.name(),
+                                if a.name.is_empty() {
+                                    a.uuid.clone()
+                                } else {
+                                    a.name.clone()
+                                }
+                            );
+                            if a.missing > 0 {
+                                out.notes.push(format!(
+                                    "{label}: montado sem {} membro(s) (modo degradado).",
+                                    a.missing
+                                ));
+                            } else {
+                                out.notes.push(format!("{label} montado."));
+                            }
+                            add_virtual(
+                                &mut regions,
+                                &mut next_virtual,
+                                &mut out,
+                                a.source.clone(),
+                                label,
+                            );
+                            progress = true;
+                        }
+                        Err(e) => out.notes.push(format!("RAID não montado: {e}")),
+                    }
+                }
+                out.covered.extend(md_primary);
+            }
+            // LVM
+            let mut pvs: Vec<(Arc<dyn Source>, crate::lvm::PvInfo)> = vec![];
+            let mut pv_primary: Vec<u64> = vec![];
+            let md_srcs: Vec<Arc<dyn Source>> = regions.iter().map(|r| r.src.clone()).collect();
+            let mut lvm_pool: Vec<(Arc<dyn Source>, Option<u64>)> = pool
+                .iter()
+                .map(|w| (w.src.clone(), w.primary_start))
+                .collect();
+            for (r, s) in regions.iter().zip(md_srcs) {
+                lvm_pool.push((s, Some(r.start)));
+            }
+            for (src, st) in lvm_pool {
+                if let Some(pv) = crate::lvm::read_pv(src.as_ref()) {
+                    if !done_containers.insert(format!("pv{}", pv.uuid)) {
+                        continue;
+                    }
+                    if let Some(st) = st {
+                        pv_primary.push(st);
+                    }
+                    pvs.push((src, pv));
+                }
+            }
+            if !pvs.is_empty() {
+                for vg in crate::lvm::assemble_vgs(pvs) {
+                    for w in &vg.warnings {
+                        out.notes.push(format!("LVM {}: {w}", vg.name));
+                    }
+                    for (name, lv) in vg.lvs {
+                        add_virtual(
+                            &mut regions,
+                            &mut next_virtual,
+                            &mut out,
+                            lv,
+                            format!("LVM {}/{}", vg.name, name),
+                        );
+                        progress = true;
+                    }
+                }
+                out.covered.extend(pv_primary);
+            }
+        }
+
+        // 2) Desbloqueio de volumes cifrados.
+        let current: Arc<dyn Source> = Arc::new(Overlay::new(base.clone(), regions.clone()));
+        let layout = partition::analyze(current.as_ref(), false);
+        let mut all_parts: Vec<PartInfo> = layout.partitions.clone();
+        for p in &out.extra_parts {
+            if !all_parts.iter().any(|q| q.start == p.start) {
+                all_parts.push(p.clone());
+            }
+        }
+        out.locked.clear();
+        for p in &all_parts {
+            if p.encrypted.is_none() || out.unlocked.iter().any(|u| u.start == p.start) {
+                continue;
+            }
+            let len = if p.len == 0 {
+                current.size().saturating_sub(p.start)
+            } else {
+                p.len
+            };
+            let window: Arc<dyn Source> = Arc::new(SubSource::new(current.clone(), p.start, len));
+            let mut all = secrets.clone();
+            for k in asm.keys.iter().filter(|k| k.start == p.start) {
+                if let Some(b) = crypt::from_hex(&k.key_hex) {
+                    all.push(Secret::VolumeKey(b));
+                }
+            }
+            match try_unlock(window, p.fs, &all) {
+                Ok(u) => {
+                    let ulen = u.source.size();
+                    out.unlocked.push(UnlockInfo {
+                        start: p.start,
+                        len: ulen,
+                        kind: kind_name(p.fs).into(),
+                        description: u.description.clone(),
+                    });
+                    if let Some(k) = &u.volume_key {
+                        out.keys.push(SavedKey { start: p.start, kind: kind_name(p.fs).into(), key_hex: crypt::to_hex(k) });
+                    }
+                    patch(&mut regions, p.start, u.source, u.description);
+                    progress = true;
+                }
+                Err(e) => out.locked.push(LockedInfo {
+                    start: p.start,
+                    kind: kind_name(p.fs).into(),
+                    reason: match e {
+                        UnlockError::WrongSecret if secrets.is_empty() && asm.keys.is_empty() => "volume cifrado: informe a senha, a chave de recuperação ou o arquivo de chave".into(),
+                        other => other.to_string(),
+                    },
+                }),
+            }
+        }
+        if !progress {
+            break;
+        }
+    }
+    if !regions.is_empty() {
+        out.source = Arc::new(Overlay::new(base, regions));
+        // Atualiza o que se sabe sobre as partições virtuais (algumas foram desbloqueadas depois).
+        for p in &mut out.extra_parts {
+            if let Some((fs, len)) = partition::detect_fs(out.source.as_ref(), p.start) {
+                p.fs = fs;
+                p.encrypted = fs.encrypted().map(String::from);
+                if let Some(l) = len {
+                    p.len = p.len.min(l).max(1);
+                }
+            }
+        }
+    }
+    out.covered.sort_unstable();
+    out.covered.dedup();
+    Ok(out)
+}
+
+/// Anexa um volume virtual depois do fim do disco e registra as partições que ele contém.
+fn add_virtual(
+    regions: &mut Vec<Region>,
+    next: &mut u64,
+    out: &mut Assembled,
+    src: Arc<dyn Source>,
+    label: String,
+) {
+    let start = *next;
+    let len = src.size();
+    if len == 0 {
+        return;
+    }
+    *next = (start + len).div_ceil(MIB) * MIB + MIB;
+    let inner = partition::analyze(src.as_ref(), false);
+    if inner.partitions.is_empty() {
+        out.extra_parts.push(PartInfo {
+            index: 0,
+            start,
+            len,
+            fs: FsKind::Unknown,
+            label: Some(label.clone()),
+            lost: false,
+            encrypted: None,
+            table_type: Some(label.clone()),
+        });
+    } else {
+        for p in inner.partitions {
+            let mut q = p.clone();
+            q.start += start;
+            q.label = q.label.or_else(|| Some(label.clone()));
+            out.extra_parts.push(q);
+        }
+    }
+    regions.push(Region {
+        start,
+        len,
+        src,
+        label,
+    });
+}
+
+/// Escolhe os parâmetros do RAID: o que o usuário deu manda; o resto vem da detecção.
+fn pick_raid(
+    disks: &[Arc<dyn Source>],
+    spec: &RaidSpec,
+    notes: &mut Vec<String>,
+) -> Result<crate::raid::RaidParams> {
+    use crate::raid::{Member, RaidParams};
+    if let (Some(level), Some(chunk), Some(layout), Some(order)) =
+        (spec.level, spec.chunk_kb, spec.layout, spec.order.clone())
+    {
+        if order.len() == disks.len() && order.iter().all(|&i| i < disks.len()) {
+            let members = order
+                .iter()
+                .map(|&i| {
+                    Some(Member {
+                        src: disks[i].clone(),
+                        data_offset: 0,
+                    })
+                })
+                .collect();
+            return Ok(RaidParams::simple(level, chunk * 1024, layout, members));
+        }
+    }
+    let cands = crate::raid_detect::detect(disks, &|| false);
+    let c = cands
+        .into_iter()
+        .find(|c| {
+            spec.level.map_or(true, |l| c.level == l)
+                && spec.chunk_kb.map_or(true, |k| c.chunk == k * 1024)
+                && spec.layout.map_or(true, |l| c.layout == l)
+                && spec.order.as_ref().map_or(true, |o| *o == c.order)
+        })
+        .ok_or_else(|| Error::msg("não foi possível descobrir os parâmetros do RAID (nenhuma combinação produziu um sistema de arquivos coerente)"))?;
+    notes.push(format!(
+        "Parâmetros do RAID descobertos: {}, faixa de {} KiB, layout {:?}, ordem dos discos {:?} (pontuação {:.1}).",
+        c.level.name(),
+        c.chunk / 1024,
+        c.layout,
+        c.order,
+        c.score
+    ));
+    Ok(c.params(disks))
+}
@@ -62,6 +62,7 @@ pub fn carve_range(
            break;
        }
        let scan_len = got.min(CHUNK).min((end - pos) as usize);
+        ev.chunk(pos, &buf[..scan_len]);
        let mut i = 0usize;
        while i < scan_len {
            let abs = pos + i as u64;
@@ -78,10 +79,12 @@ pub fn carve_range(
                        || cfg.categories.contains(&category_for_ext(hit.ext));
                    if hit.len >= MIN_LEN && allowed {
                        let action = ev.hit(abs, &hit);
-                        if matches!(action, HitAction::Skip)
-                            && hit.confidence != crate::types::Confidence::Low
-                        {
-                            skip_until = abs + hit.len;
+                        match action {
+                            HitAction::Skip if hit.confidence != crate::types::Confidence::Low => {
+                                skip_until = abs + hit.len;
+                            }
+                            HitAction::SkipLen(n) => skip_until = abs + n,
+                            _ => {}
                        }
                    }
                }
@@ -109,6 +112,8 @@ pub enum CarveEnd {
 /// Receptor de eventos do carving.
 pub trait CarveEvents {
    fn advance(&mut self, bytes: u64);
+    /// Cada trecho lido, antes de procurar assinaturas (para indexar o que serve a recomposição).
+    fn chunk(&mut self, _abs: u64, _data: &[u8]) {}
    fn hit(&mut self, offset: u64, hit: &Hit) -> HitAction;
 }

@@ -116,6 +121,8 @@ pub trait CarveEvents {
 pub enum HitAction {
    /// Pula o conteúdo do arquivo reconhecido (comportamento padrão).
    Skip,
+    /// Pula só estes bytes (arquivo cujo resto não é confiável).
+    SkipLen(u64),
    /// Segue setor a setor (acerto descartado).
    Continue,
 }
@@ -0,0 +1,529 @@
+//! BitLocker (Windows 7 em diante, inclusive BitLocker To Go): AES-CBC com ou sem difusor
+//! Elephant, e AES-XTS. Protetores: senha, chave de recuperação, chave de inicialização (.BEK),
+//! chave limpa (proteção suspensa) e chave do volume já conhecida. TPM não é suportado.
+
+use super::*;
+use crate::source::{read_vec, SubSource};
+use sha2::{Digest, Sha256};
+
+fn le16(b: &[u8], o: usize) -> usize {
+    u16::from_le_bytes([b[o], b[o + 1]]) as usize
+}
+fn le32(b: &[u8], o: usize) -> u32 {
+    u32::from_le_bytes(b[o..o + 4].try_into().unwrap())
+}
+fn le64(b: &[u8], o: usize) -> u64 {
+    u64::from_le_bytes(b[o..o + 8].try_into().unwrap())
+}
+
+const GUID_NORMAL: [u8; 16] = [
+    0x3b, 0xd6, 0x67, 0x49, 0x29, 0x2e, 0xd8, 0x4a, 0x83, 0x99, 0xf6, 0xa3, 0x39, 0xe3, 0xd0, 0x01,
+];
+const GUID_EOW: [u8; 16] = [
+    0x3b, 0x4d, 0xa8, 0x92, 0x80, 0xdd, 0x0e, 0x4d, 0x9e, 0x4e, 0xb1, 0xe3, 0x28, 0x4e, 0xae, 0xd8,
+];
+
+/// Posição da tabela de deslocamentos FVE, se for BitLocker (normal ou To Go).
+fn offsets_pos(vbr: &[u8]) -> Option<usize> {
+    if vbr.len() >= 11 && &vbr[3..11] == b"-FVE-FS-" {
+        return Some(176);
+    }
+    // BitLocker To Go: parece FAT ("MSWIN4.1"), mas guarda o GUID do BitLocker no setor de boot.
+    if vbr.len() >= 464 && (vbr[424..440] == GUID_NORMAL || vbr[424..440] == GUID_EOW) {
+        return Some(440);
+    }
+    None
+}
+
+pub fn detect(vbr: &[u8]) -> bool {
+    offsets_pos(vbr).is_some()
+}
+
+// ------------------------------------------------------------- Elephant
+
+fn rotl(x: u32, n: u32) -> u32 {
+    x.rotate_left(n)
+}
+
+const RA: [u32; 4] = [9, 0, 13, 0];
+const RB: [u32; 4] = [0, 10, 0, 25];
+
+fn words(buf: &[u8]) -> Vec<u32> {
+    buf.chunks_exact(4)
+        .map(|c| u32::from_le_bytes(c.try_into().unwrap()))
+        .collect()
+}
+
+// Decifragem (ordem do dm-crypt do Linux): somas em ordem crescente.
+fn diffuser_a_decrypt(d: &mut [u32]) {
+    let n = d.len();
+    for _ in 0..5 {
+        for i in 0..n {
+            let a = d[(i + n - 2) % n];
+            let b = rotl(d[(i + n - 5) % n], RA[i % 4]);
+            d[i] = d[i].wrapping_add(a ^ b);
+        }
+    }
+}
+
+fn diffuser_b_decrypt(d: &mut [u32]) {
+    let n = d.len();
+    for _ in 0..3 {
+        for i in 0..n {
+            let a = d[(i + 2) % n];
+            let b = rotl(d[(i + 5) % n], RB[i % 4]);
+            d[i] = d[i].wrapping_add(a ^ b);
+        }
+    }
+}
+
+/// Decifra um setor AES-CBC + difusor Elephant (BitLocker Vista/7 sem XTS).
+pub fn elephant_decrypt(key: &AesAny, tweak: &AesAny, buf: &mut [u8], byte_off: u64) {
+    let mut iv = [0u8; 16];
+    iv[..8].copy_from_slice(&byte_off.to_le_bytes());
+    key.encrypt(&mut iv);
+    cbc_decrypt(key, &iv, buf);
+    let mut d = words(buf);
+    diffuser_b_decrypt(&mut d);
+    diffuser_a_decrypt(&mut d);
+    for (i, w) in d.iter().enumerate() {
+        buf[i * 4..i * 4 + 4].copy_from_slice(&w.to_le_bytes());
+    }
+    // Chave do setor: duas cifragens do deslocamento com a chave de ajuste.
+    let mut k0 = [0u8; 16];
+    k0[..8].copy_from_slice(&byte_off.to_le_bytes());
+    let mut k1 = k0;
+    k1[15] = 0x80;
+    tweak.encrypt(&mut k0);
+    tweak.encrypt(&mut k1);
+    let mut sk = [0u8; 32];
+    sk[..16].copy_from_slice(&k0);
+    sk[16..].copy_from_slice(&k1);
+    for (i, b) in buf.iter_mut().enumerate() {
+        *b ^= sk[i % 32];
+    }
+}
+
+// ------------------------------------------------------------------ CCM
+
+/// AES-CCM (nonce de 12 bytes, tag de 16): `blob` = tag cifrada (16) + dados cifrados.
+fn ccm_decrypt(key: &AesAny, nonce: &[u8], blob: &[u8]) -> Option<Vec<u8>> {
+    if nonce.len() != 12 || blob.len() < 16 {
+        return None;
+    }
+    let ctr = |i: u32| -> [u8; 16] {
+        let mut a = [0u8; 16];
+        a[0] = 2;
+        a[1..13].copy_from_slice(nonce);
+        a[13..16].copy_from_slice(&i.to_be_bytes()[1..]);
+        key.encrypt(&mut a);
+        a
+    };
+    let s0 = ctr(0);
+    let mut tag = [0u8; 16];
+    for i in 0..16 {
+        tag[i] = blob[i] ^ s0[i];
+    }
+    let ct = &blob[16..];
+    let mut pt = Vec::with_capacity(ct.len());
+    for (bi, ch) in ct.chunks(16).enumerate() {
+        let s = ctr(bi as u32 + 1);
+        pt.extend(ch.iter().zip(s.iter()).map(|(a, b)| a ^ b));
+    }
+    // CBC-MAC sobre B0 + dados.
+    let mut b0 = [0u8; 16];
+    b0[0] = 0x3A;
+    b0[1..13].copy_from_slice(nonce);
+    b0[13..16].copy_from_slice(&(pt.len() as u32).to_be_bytes()[1..]);
+    key.encrypt(&mut b0);
+    let mut x = b0;
+    for ch in pt.chunks(16) {
+        for i in 0..ch.len() {
+            x[i] ^= ch[i];
+        }
+        key.encrypt(&mut x);
+    }
+    (x == tag).then_some(pt)
+}
+
+// --------------------------------------------------------------- chaves
+
+fn stretch(initial: &[u8; 32], salt: &[u8]) -> [u8; 32] {
+    let mut last = [0u8; 32];
+    let mut buf = [0u8; 88];
+    buf[32..64].copy_from_slice(initial);
+    buf[64..80].copy_from_slice(salt);
+    for i in 0u64..0x10_0000 {
+        buf[..32].copy_from_slice(&last);
+        buf[80..88].copy_from_slice(&i.to_le_bytes());
+        last.copy_from_slice(&Sha256::digest(buf));
+    }
+    last
+}
+
+fn password_key(pw: &str, salt: &[u8]) -> [u8; 32] {
+    let utf16: Vec<u8> = pw.encode_utf16().flat_map(|u| u.to_le_bytes()).collect();
+    let h1 = Sha256::digest(&utf16);
+    let mut init = [0u8; 32];
+    init.copy_from_slice(&Sha256::digest(h1));
+    stretch(&init, salt)
+}
+
+/// Chave de recuperação: 8 blocos de 6 dígitos, cada um múltiplo de 11.
+fn recovery_key(rp: &str, salt: &[u8]) -> Option<[u8; 32]> {
+    let digits: String = rp.chars().filter(|c| c.is_ascii_digit()).collect();
+    if digits.len() != 48 {
+        return None;
+    }
+    let mut raw = [0u8; 16];
+    for i in 0..8 {
+        let n: u32 = digits[i * 6..i * 6 + 6].parse().ok()?;
+        if n % 11 != 0 || n / 11 > 0xFFFF {
+            return None;
+        }
+        raw[i * 2..i * 2 + 2].copy_from_slice(&((n / 11) as u16).to_le_bytes());
+    }
+    let mut init = [0u8; 32];
+    init.copy_from_slice(&Sha256::digest(raw));
+    Some(stretch(&init, salt))
+}
+
+// ----------------------------------------------------------- metadados
+
+#[derive(Debug, Clone)]
+struct Entry {
+    etype: usize,
+    vtype: usize,
+    data: Vec<u8>,
+}
+
+fn parse_entries(b: &[u8]) -> Vec<Entry> {
+    let mut v = vec![];
+    let mut o = 0;
+    while o + 8 <= b.len() {
+        let size = le16(b, o);
+        if size < 8 || o + size > b.len() {
+            break;
+        }
+        v.push(Entry {
+            etype: le16(b, o + 2),
+            vtype: le16(b, o + 4),
+            data: b[o + 8..o + size].to_vec(),
+        });
+        o += size;
+    }
+    v
+}
+
+struct Vmk {
+    protection: usize,
+    nested: Vec<Entry>,
+}
+
+impl Vmk {
+    fn ccm(&self) -> Option<&Entry> {
+        self.nested.iter().find(|e| e.vtype == 5)
+    }
+    fn stretch_salt(&self) -> Option<&[u8]> {
+        self.nested
+            .iter()
+            .find(|e| e.vtype == 3)
+            .filter(|e| e.data.len() >= 20)
+            .map(|e| &e.data[4..20])
+    }
+}
+
+struct Fve {
+    method: usize,
+    volume_header_offset: u64,
+    volume_header_size: u64,
+    encrypted_size: u64,
+    meta_size: u64,
+    vmks: Vec<Vmk>,
+    fvek: Option<Entry>,
+}
+
+fn read_fve(src: &dyn Source, offset: u64) -> Option<Fve> {
+    let h = read_vec(src, offset, 64 + 48).ok()?;
+    if h.len() < 112 || &h[..8] != b"-FVE-FS-" {
+        return None;
+    }
+    let version = le16(&h, 10);
+    if version != 2 {
+        return None; // Vista (versão 1) não suportado
+    }
+    let encrypted_size = le64(&h, 16);
+    let hdr_sectors = le32(&h, 28) as u64;
+    let volume_header_offset = le64(&h, 56);
+    let meta_size = le32(&h, 64) as usize;
+    if !(48..=1 << 20).contains(&meta_size) {
+        return None;
+    }
+    let method = le16(&h, 64 + 36);
+    let all = read_vec(src, offset + 64, meta_size).ok()?;
+    if all.len() < meta_size {
+        return None;
+    }
+    let entries = parse_entries(&all[48..]);
+    let mut vmks = vec![];
+    let mut fvek = None;
+    let (mut vh_off, mut vh_size) = (volume_header_offset, hdr_sectors * 512);
+    for e in entries {
+        match (e.etype, e.vtype) {
+            (15, 15) if e.data.len() >= 16 => {
+                vh_off = le64(&e.data, 0);
+                vh_size = le64(&e.data, 8);
+            }
+            (2, 8) if e.data.len() > 28 => vmks.push(Vmk {
+                protection: le16(&e.data, 26),
+                nested: parse_entries(&e.data[28..]),
+            }),
+            (3, 5) => fvek = Some(e),
+            _ => {}
+        }
+    }
+    Some(Fve {
+        method,
+        volume_header_offset: vh_off,
+        volume_header_size: vh_size,
+        encrypted_size,
+        meta_size: 0x10000,
+        vmks,
+        fvek,
+    })
+}
+
+/// Chave de um arquivo .BEK (chave de inicialização).
+fn bek_key(file: &[u8]) -> Option<Vec<u8>> {
+    if file.len() < 48 {
+        return None;
+    }
+    let es = parse_entries(&file[48..]);
+    for e in &es {
+        if e.vtype == 9 && e.data.len() > 24 {
+            for n in parse_entries(&e.data[24..]) {
+                if n.vtype == 1 && n.data.len() >= 36 {
+                    return Some(n.data[4..36].to_vec());
+                }
+            }
+        }
+    }
+    None
+}
+
+fn candidate_keys(v: &Vmk, secrets: &[Secret]) -> Vec<Vec<u8>> {
+    let mut out: Vec<Vec<u8>> = vec![];
+    // Chave limpa: o próprio protetor guarda a chave em claro.
+    if v.protection == 0 {
+        for n in &v.nested {
+            if n.vtype == 1 && n.data.len() >= 36 {
+                out.push(n.data[4..36].to_vec());
+            }
+        }
+    }
+    for s in secrets {
+        match s {
+            Secret::Password(p) if v.protection == 0x2000 => {
+                if let Some(salt) = v.stretch_salt() {
+                    out.push(password_key(p, salt).to_vec());
+                }
+            }
+            Secret::RecoveryKey(r) if v.protection == 0x0800 => {
+                if let Some(k) = v.stretch_salt().and_then(|salt| recovery_key(r, salt)) {
+                    out.push(k.to_vec());
+                }
+            }
+            Secret::KeyFile(f) if v.protection == 0x0200 => {
+                if let Some(k) = bek_key(f) {
+                    out.push(k);
+                }
+            }
+            _ => {}
+        }
+    }
+    out
+}
+
+fn decrypt_key_entry(key: &[u8], e: &Entry) -> Option<Vec<u8>> {
+    let aes = AesAny::new(key)?;
+    if e.data.len() < 12 + 16 + 8 {
+        return None;
+    }
+    let pt = ccm_decrypt(&aes, &e.data[..12], &e.data[12..])?;
+    // payload = cabeçalho de entrada (8) + método (4) + chave
+    (pt.len() > 12).then(|| pt[12..].to_vec())
+}
+
+pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
+    let vbr = read_vec(src.as_ref(), 0, 512).map_err(|e| UnlockError::Corrupt(e.to_string()))?;
+    if !detect(&vbr) || vbr.len() < 512 {
+        return Err(UnlockError::Corrupt("não é BitLocker".into()));
+    }
+    let bps = le16(&vbr, 11).max(512) as u64;
+    let pos = offsets_pos(&vbr).unwrap_or(176);
+    // Três cópias dos metadados; usa a primeira legível.
+    let mut fve = None;
+    let mut meta_offsets = vec![];
+    for i in 0..3 {
+        let off = le64(&vbr, pos + i * 8);
+        if off != 0 {
+            meta_offsets.push(off);
+        }
+        if off != 0 && off < src.size() {
+            if let Some(f) = read_fve(src.as_ref(), off) {
+                fve = Some(f);
+                break;
+            }
+        }
+    }
+    let fve = fve.ok_or_else(|| {
+        UnlockError::Unsupported("metadados FVE ilegíveis ou do Windows Vista".into())
+    })?;
+    let fvek_entry = fve
+        .fvek
+        .as_ref()
+        .ok_or_else(|| UnlockError::Corrupt("sem FVEK".into()))?;
+
+    let mut volume_key: Option<Vec<u8>> = None;
+    for s in secrets {
+        if let Secret::VolumeKey(k) = s {
+            volume_key = Some(k.clone());
+        }
+    }
+    let mut vmk_found: Option<Vec<u8>> = None;
+    if volume_key.is_none() {
+        'outer: for v in &fve.vmks {
+            let Some(ccm) = v.ccm() else { continue };
+            for k in candidate_keys(v, secrets) {
+                if let Some(vmk) = decrypt_key_entry(&k, ccm) {
+                    if vmk.len() >= 32 {
+                        vmk_found = Some(vmk[..32].to_vec());
+                        break 'outer;
+                    }
+                }
+            }
+        }
+    }
+    let fvek_bytes = if let Some(k) = volume_key {
+        k
+    } else {
+        let vmk = vmk_found.ok_or(UnlockError::WrongSecret)?;
+        decrypt_key_entry(&vmk, fvek_entry)
+            .ok_or_else(|| UnlockError::Corrupt("FVEK não decifra com a VMK".into()))?
+    };
+    let k = &fvek_bytes;
+    let bad = || UnlockError::Corrupt("tamanho de chave incompatível com o método".into());
+    let (cipher, name) = match fve.method {
+        0x8000 | 0x8001 => {
+            let n = if fve.method == 0x8000 { 16 } else { 32 };
+            if k.len() < 32 + n {
+                return Err(bad());
+            }
+            (
+                SectorCipher::Elephant {
+                    key: AesAny::new(&k[..n]).ok_or_else(bad)?,
+                    tweak: AesAny::new(&k[32..32 + n]).ok_or_else(bad)?,
+                },
+                if n == 16 {
+                    "AES-128-CBC + difusor"
+                } else {
+                    "AES-256-CBC + difusor"
+                },
+            )
+        }
+        0x8002 | 0x8003 => {
+            let n = if fve.method == 0x8002 { 16 } else { 32 };
+            if k.len() < n {
+                return Err(bad());
+            }
+            let key = AesAny::new(&k[..n]).ok_or_else(bad)?;
+            (
+                SectorCipher::Cbc {
+                    key: key.clone(),
+                    iv: Iv::Eboiv(key),
+                },
+                if n == 16 {
+                    "AES-128-CBC"
+                } else {
+                    "AES-256-CBC"
+                },
+            )
+        }
+        0x8004 | 0x8005 => {
+            let n = if fve.method == 0x8004 { 16 } else { 32 };
+            if k.len() < 2 * n {
+                return Err(bad());
+            }
+            let iv = if bps > 512 {
+                Iv::Unit(bps)
+            } else {
+                Iv::Plain64
+            };
+            (
+                SectorCipher::Xts {
+                    k1: AesAny::new(&k[..n]).ok_or_else(bad)?,
+                    k2: AesAny::new(&k[n..2 * n]).ok_or_else(bad)?,
+                    iv,
+                },
+                if n == 16 {
+                    "AES-128-XTS"
+                } else {
+                    "AES-256-XTS"
+                },
+            )
+        }
+        m => {
+            return Err(UnlockError::Unsupported(format!(
+                "método de cifragem BitLocker {m:#x}"
+            )))
+        }
+    };
+    let len = src.size();
+    let mut cs = CryptSource::new(src.clone(), cipher, 0, len, bps);
+    let mut patches = vec![];
+    // Áreas de metadados FVE: o Windows não as expõe como dados.
+    for off in meta_offsets {
+        patches.push(Patch {
+            at: off,
+            len: fve.meta_size,
+            from: 0,
+            decrypt_from: None,
+            zero: true,
+        });
+    }
+    if fve.volume_header_size > 0 && fve.volume_header_offset > 0 {
+        // O início do volume original foi movido para outro lugar e cifrado lá.
+        patches.push(Patch {
+            at: fve.volume_header_offset,
+            len: fve.volume_header_size,
+            from: 0,
+            decrypt_from: None,
+            zero: true,
+        });
+        patches.push(Patch {
+            at: 0,
+            len: fve.volume_header_size,
+            from: fve.volume_header_offset,
+            decrypt_from: Some(fve.volume_header_offset),
+            zero: false,
+        });
+    }
+    cs = cs.with_patches(patches);
+    if fve.encrypted_size > 0 && fve.encrypted_size < len {
+        cs = cs.with_plain_from(fve.encrypted_size);
+    }
+    Ok(Unlocked {
+        source: Arc::new(cs),
+        description: format!("BitLocker ({name})"),
+        volume_key: Some(fvek_bytes),
+    })
+}
+
+pub fn unlock_window(
+    base: Arc<dyn Source>,
+    start: u64,
+    len: u64,
+    secrets: &[Secret],
+) -> UnlockResult {
+    unlock(Arc::new(SubSource::new(base, start, len)), secrets)
+}
@@ -0,0 +1,261 @@
+//! FileVault 2 sobre Core Storage (volumes HFS+ cifrados do macOS 10.7 a 10.12 e Fusion Drives).
+//! Senha ou chave do volume; chave de recuperação institucional não é suportada.
+
+use super::*;
+use crate::source::{read_vec, SubSource};
+use sha2::{Digest, Sha256};
+
+const MD_BLOCK: usize = 8192;
+
+fn le32(b: &[u8], o: usize) -> u32 {
+    u32::from_le_bytes(b[o..o + 4].try_into().unwrap())
+}
+fn le64(b: &[u8], o: usize) -> u64 {
+    u64::from_le_bytes(b[o..o + 8].try_into().unwrap())
+}
+
+pub fn detect(head: &[u8]) -> bool {
+    head.len() >= 512 && head[88] == 0x43 && head[89] == 0x53 && head[10] == 0x10
+}
+
+/// Desembrulha uma chave AES-128 de 24 bytes (RFC 3394).
+fn unwrap_key(kek: &[u8], wrapped: &[u8]) -> Option<[u8; 16]> {
+    let aes = AesAny::new(kek)?;
+    if wrapped.len() != 24 {
+        return None;
+    }
+    let mut a: [u8; 8] = wrapped[..8].try_into().unwrap();
+    let mut r2: [u8; 8] = wrapped[8..16].try_into().unwrap();
+    let mut r3: [u8; 8] = wrapped[16..24].try_into().unwrap();
+    for t in (1..=12u64).rev() {
+        let prev_r2 = r2;
+        let tb = t.to_be_bytes();
+        let mut blk = [0u8; 16];
+        for i in 0..8 {
+            blk[i] = a[i] ^ tb[i];
+        }
+        blk[8..].copy_from_slice(&r3);
+        aes.decrypt(&mut blk);
+        a.copy_from_slice(&blk[..8]);
+        r2.copy_from_slice(&blk[8..]);
+        r3 = prev_r2;
+    }
+    if a != [0xA6; 8] {
+        return None;
+    }
+    let mut out = [0u8; 16];
+    out[..8].copy_from_slice(&r2);
+    out[8..].copy_from_slice(&r3);
+    Some(out)
+}
+
+fn b64(s: &str) -> Option<Vec<u8>> {
+    let mut out = vec![];
+    let (mut acc, mut bits) = (0u32, 0);
+    for c in s.bytes() {
+        let v = match c {
+            b'A'..=b'Z' => c - b'A',
+            b'a'..=b'z' => c - b'a' + 26,
+            b'0'..=b'9' => c - b'0' + 52,
+            b'+' => 62,
+            b'/' => 63,
+            b'=' | b'\n' | b'\r' | b' ' | b'\t' => continue,
+            _ => return None,
+        } as u32;
+        acc = (acc << 6) | v;
+        bits += 6;
+        if bits >= 8 {
+            bits -= 8;
+            out.push((acc >> bits) as u8);
+            acc &= (1 << bits) - 1;
+        }
+    }
+    Some(out)
+}
+
+/// Valor de `<key>NOME</key><tipo ...>VALOR</tipo>` num plist simples (primeira ocorrência com valor).
+fn plist_value(xml: &str, key: &str) -> Option<String> {
+    let k = format!("<key>{key}</key>");
+    let mut from = 0;
+    while let Some(p) = xml[from..].find(&k) {
+        let rest = &xml[from + p + k.len()..];
+        from += p + k.len();
+        let Some(open) = rest.find('<').filter(|&o| o == 0) else {
+            continue;
+        };
+        let Some(gt) = rest[open..].find('>') else {
+            continue;
+        };
+        if rest[open..open + gt].ends_with('/') {
+            continue; // <reference .../>
+        }
+        let Some(te) = rest[open + 1..].find([' ', '>']) else {
+            continue;
+        };
+        let tag = &rest[open + 1..open + 1 + te];
+        let vstart = open + gt + 1;
+        if let Some(e) = rest[vstart..].find(&format!("</{tag}>")) {
+            let v = rest[vstart..vstart + e].trim();
+            if !v.is_empty() {
+                return Some(v.to_string());
+            }
+        }
+    }
+    None
+}
+
+fn xml_of(blk: &[u8], off_pos: usize) -> Option<String> {
+    let off = le32(blk, off_pos) as usize;
+    let size = le32(blk, off_pos + 4) as usize;
+    if off >= MD_BLOCK || size > MD_BLOCK - off {
+        return None;
+    }
+    Some(String::from_utf8_lossy(&blk[off..off + size]).to_string())
+}
+
+pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
+    let corrupt = |s: &str| UnlockError::Corrupt(s.to_string());
+    let h = read_vec(src.as_ref(), 0, 512).map_err(|e| corrupt(&e.to_string()))?;
+    if !detect(&h) {
+        return Err(corrupt("não é um volume Core Storage"));
+    }
+    let block_size = le32(&h, 96) as u64;
+    let disklbl = le64(&h, 104);
+    if block_size == 0 || block_size > 1 << 20 || le32(&h, 168) != 16 {
+        return Err(UnlockError::Unsupported(
+            "Core Storage com chave de metadados que não é AES-128".into(),
+        ));
+    }
+    let mut md_key = [0u8; 32];
+    md_key[..16].copy_from_slice(&h[176..192]);
+    md_key[16..].copy_from_slice(&h[304..320]);
+    let (k1, k2) = (
+        AesAny::new(&md_key[..16]).unwrap(),
+        AesAny::new(&md_key[16..]).unwrap(),
+    );
+    let md_cipher = SectorCipher::Xts {
+        k1,
+        k2,
+        iv: Iv::Plain64,
+    };
+
+    let label = read_vec(src.as_ref(), disklbl * block_size, MD_BLOCK)
+        .map_err(|e| corrupt(&e.to_string()))?;
+    if label.len() < MD_BLOCK {
+        return Err(corrupt("rótulo do disco truncado"));
+    }
+    let vgd_off = le32(&label, 220) as u64;
+    let vgd = read_vec(src.as_ref(), disklbl * block_size + vgd_off, 40)
+        .map_err(|e| corrupt(&e.to_string()))?;
+    if vgd.len() < 40 {
+        return Err(corrupt("descritor de grupos truncado"));
+    }
+    let md_blocks = le64(&vgd, 8);
+    let md_start = le64(&vgd, 32) * block_size;
+
+    let (mut iters, mut salt, mut wkek, mut wvk) = (0u32, vec![], vec![], vec![]);
+    let (mut lv_size, mut lv_off) = (0u64, 0u64);
+    let mut family = [0u8; 16];
+    let mut got = 0u8;
+    for i in 0..md_blocks.min(64) {
+        let mut b = read_vec(src.as_ref(), md_start + i * MD_BLOCK as u64, MD_BLOCK)
+            .map_err(|e| corrupt(&e.to_string()))?;
+        if b.len() < MD_BLOCK || b.iter().all(|&x| x == 0) {
+            break;
+        }
+        // XTS sobre o bloco inteiro, com o número do bloco como ajuste inicial.
+        md_cipher.decrypt_sector(&mut b, i, 0);
+        match u16::from_le_bytes([b[10], b[11]]) {
+            0x0019 => {
+                if let Some(xml) = xml_of(&b, 112) {
+                    let pwk = plist_value(&xml, "PassphraseWrappedKEKStruct").and_then(|s| b64(&s));
+                    let kw = plist_value(&xml, "KEKWrappedVolumeKeyStruct").and_then(|s| b64(&s));
+                    if let (Some(p), Some(k)) = (pwk, kw) {
+                        if p.len() >= 172 && k.len() >= 32 {
+                            salt = p[8..24].to_vec();
+                            wkek = p[32..56].to_vec();
+                            iters = le32(&p, 168);
+                            wvk = k[8..32].to_vec();
+                            got |= 1;
+                        }
+                    }
+                }
+            }
+            0x001a => {
+                if let Some(xml) = xml_of(&b, 128) {
+                    if let Some(v) = plist_value(&xml, "com.apple.corestorage.lv.size") {
+                        lv_size = u64::from_str_radix(v.trim_start_matches("0x"), 16).unwrap_or(0);
+                        got |= 8;
+                        if let Some(u) = plist_value(&xml, "com.apple.corestorage.lv.familyUUID") {
+                            let hex: String = u.chars().filter(|c| c.is_ascii_hexdigit()).collect();
+                            if let Some(b) = super::from_hex(&hex).filter(|b| b.len() == 16) {
+                                family.copy_from_slice(&b);
+                                got |= 2;
+                            }
+                        }
+                    }
+                }
+            }
+            0x0305 => {
+                lv_off = le32(&b, 104) as u64 * block_size;
+                got |= 4;
+            }
+            _ => {}
+        }
+    }
+    if got != 7 | 8 {
+        return Err(corrupt("metadados Core Storage incompletos"));
+    }
+
+    let finish = |vk16: [u8; 16]| -> UnlockResult {
+        let mut full = [0u8; 32];
+        full[..16].copy_from_slice(&vk16);
+        full[16..].copy_from_slice(
+            &Sha256::new()
+                .chain_update(vk16)
+                .chain_update(family)
+                .finalize()[..16],
+        );
+        let cipher = SectorCipher::Xts {
+            k1: AesAny::new(&full[..16]).unwrap(),
+            k2: AesAny::new(&full[16..]).unwrap(),
+            iv: Iv::Plain64,
+        };
+        let cs = CryptSource::new(src.clone(), cipher, lv_off, lv_size, 512);
+        Ok(Unlocked {
+            source: Arc::new(cs),
+            description: "FileVault 2 (Core Storage, AES-128-XTS)".into(),
+            volume_key: Some(vk16.to_vec()),
+        })
+    };
+    for s in secrets {
+        if let Secret::VolumeKey(k) = s {
+            if k.len() >= 16 {
+                let mut a = [0u8; 16];
+                a.copy_from_slice(&k[..16]);
+                return finish(a);
+            }
+        }
+    }
+    for s in secrets {
+        if let Secret::Password(p) = s {
+            let mut pk = [0u8; 16];
+            pbkdf2::pbkdf2_hmac::<Sha256>(p.as_bytes(), &salt, iters.max(1), &mut pk);
+            if let Some(kek) = unwrap_key(&pk, &wkek) {
+                if let Some(vk) = unwrap_key(&kek, &wvk) {
+                    return finish(vk);
+                }
+            }
+        }
+    }
+    Err(UnlockError::WrongSecret)
+}
+
+pub fn unlock_window(
+    base: Arc<dyn Source>,
+    start: u64,
+    len: u64,
+    secrets: &[Secret],
+) -> UnlockResult {
+    unlock(Arc::new(SubSource::new(base, start, len)), secrets)
+}
@@ -0,0 +1,474 @@
+//! LUKS1 e LUKS2 (cifras AES; PBKDF2 e Argon2; hashes SHA-1/256/512 e RIPEMD-160).
+
+use super::*;
+use crate::source::{read_vec, SubSource};
+use sha1::Sha1;
+use sha2::{Digest, Sha256, Sha512};
+
+pub const MAGIC: &[u8; 6] = b"LUKS\xBA\xBE";
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Hash {
+    Sha1,
+    Sha256,
+    Sha512,
+    Ripemd160,
+}
+
+impl Hash {
+    pub fn parse(s: &str) -> Option<Hash> {
+        Some(match s.to_ascii_lowercase().as_str() {
+            "sha1" => Hash::Sha1,
+            "sha256" => Hash::Sha256,
+            "sha512" => Hash::Sha512,
+            "ripemd160" | "rmd160" => Hash::Ripemd160,
+            _ => return None,
+        })
+    }
+    pub fn size(self) -> usize {
+        match self {
+            Hash::Sha1 | Hash::Ripemd160 => 20,
+            Hash::Sha256 => 32,
+            Hash::Sha512 => 64,
+        }
+    }
+    pub fn digest(self, parts: &[&[u8]]) -> Vec<u8> {
+        fn run<D: Digest>(parts: &[&[u8]]) -> Vec<u8> {
+            let mut d = D::new();
+            for p in parts {
+                d.update(p);
+            }
+            d.finalize().to_vec()
+        }
+        match self {
+            Hash::Sha1 => run::<Sha1>(parts),
+            Hash::Sha256 => run::<Sha256>(parts),
+            Hash::Sha512 => run::<Sha512>(parts),
+            Hash::Ripemd160 => run::<ripemd::Ripemd160>(parts),
+        }
+    }
+    pub fn pbkdf2(self, pass: &[u8], salt: &[u8], iterations: u32, len: usize) -> Vec<u8> {
+        let mut out = vec![0u8; len];
+        let it = iterations.max(1);
+        match self {
+            Hash::Sha1 => pbkdf2::pbkdf2_hmac::<Sha1>(pass, salt, it, &mut out),
+            Hash::Sha256 => pbkdf2::pbkdf2_hmac::<Sha256>(pass, salt, it, &mut out),
+            Hash::Sha512 => pbkdf2::pbkdf2_hmac::<Sha512>(pass, salt, it, &mut out),
+            Hash::Ripemd160 => pbkdf2::pbkdf2_hmac::<ripemd::Ripemd160>(pass, salt, it, &mut out),
+        }
+        out
+    }
+}
+
+/// Difusão do "anti-forensic splitter".
+fn diffuse(block: &mut [u8], h: Hash) {
+    let ds = h.size();
+    let mut i = 0u32;
+    let mut off = 0;
+    while off < block.len() {
+        let n = ds.min(block.len() - off);
+        let d = h.digest(&[&i.to_be_bytes(), &block[off..off + n]]);
+        block[off..off + n].copy_from_slice(&d[..n]);
+        off += n;
+        i += 1;
+    }
+}
+
+/// Recompõe a chave a partir das `stripes` faixas (AFmerge).
+pub fn af_merge(src: &[u8], block: usize, stripes: usize, h: Hash) -> Vec<u8> {
+    let mut buf = vec![0u8; block];
+    for i in 0..stripes.saturating_sub(1) {
+        for (b, s) in buf.iter_mut().zip(&src[i * block..(i + 1) * block]) {
+            *b ^= *s;
+        }
+        diffuse(&mut buf, h);
+    }
+    let last = &src[(stripes - 1) * block..stripes * block];
+    buf.iter().zip(last).map(|(a, b)| a ^ b).collect()
+}
+
+/// Cifra descrita por texto como "aes-xts-plain64" ou "aes-cbc-essiv:sha256".
+pub fn parse_cipher(spec: &str, key: &[u8]) -> std::result::Result<SectorCipher, UnlockError> {
+    let (alg, rest) = spec
+        .split_once('-')
+        .ok_or_else(|| UnlockError::Unsupported(spec.into()))?;
+    if !alg.eq_ignore_ascii_case("aes") {
+        return Err(UnlockError::Unsupported(format!(
+            "cifra {alg} (apenas AES)"
+        )));
+    }
+    let (mode, ivs) = rest.split_once('-').unwrap_or((rest, "plain"));
+    let bad = || UnlockError::Unsupported(format!("chave inválida para {spec}"));
+    let mk_iv = |k: &[u8]| -> std::result::Result<Iv, UnlockError> {
+        let ivl = ivs.to_ascii_lowercase();
+        Ok(match ivl.as_str() {
+            "plain64" => Iv::Plain64,
+            "plain" | "plain32" => Iv::Plain32,
+            "plain64be" => Iv::Plain64Be,
+            s if s.starts_with("essiv:") => {
+                let h =
+                    Hash::parse(&s[6..]).ok_or_else(|| UnlockError::Unsupported(spec.into()))?;
+                Iv::Essiv(AesAny::new(&h.digest(&[k])).ok_or_else(bad)?)
+            }
+            _ => return Err(UnlockError::Unsupported(format!("IV {ivs}"))),
+        })
+    };
+    match mode.to_ascii_lowercase().as_str() {
+        "xts" => {
+            if key.len() % 2 != 0 {
+                return Err(bad());
+            }
+            let h = key.len() / 2;
+            Ok(SectorCipher::Xts {
+                k1: AesAny::new(&key[..h]).ok_or_else(bad)?,
+                k2: AesAny::new(&key[h..]).ok_or_else(bad)?,
+                iv: mk_iv(&key[..h])?,
+            })
+        }
+        "cbc" => Ok(SectorCipher::Cbc {
+            key: AesAny::new(key).ok_or_else(bad)?,
+            iv: mk_iv(key)?,
+        }),
+        m => Err(UnlockError::Unsupported(format!("modo {m}"))),
+    }
+}
+
+fn passwords(secrets: &[Secret]) -> Vec<Vec<u8>> {
+    secrets
+        .iter()
+        .filter_map(|s| match s {
+            Secret::Password(p) => Some(p.as_bytes().to_vec()),
+            Secret::KeyFile(k) => Some(k.clone()),
+            _ => None,
+        })
+        .collect()
+}
+
+fn volume_keys(secrets: &[Secret]) -> Vec<Vec<u8>> {
+    secrets
+        .iter()
+        .filter_map(|s| match s {
+            Secret::VolumeKey(k) => Some(k.clone()),
+            _ => None,
+        })
+        .collect()
+}
+
+pub fn detect(head: &[u8]) -> bool {
+    head.len() >= 8 && &head[..6] == MAGIC
+}
+
+pub fn unlock(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
+    let head = read_vec(src.as_ref(), 0, 8).map_err(|e| UnlockError::Corrupt(e.to_string()))?;
+    if !detect(&head) {
+        return Err(UnlockError::Corrupt("não é LUKS".into()));
+    }
+    match u16::from_be_bytes([head[6], head[7]]) {
+        1 => unlock_v1(src, secrets),
+        2 => unlock_v2(src, secrets),
+        v => Err(UnlockError::Unsupported(format!("LUKS versão {v}"))),
+    }
+}
+
+fn be32(b: &[u8], o: usize) -> u32 {
+    u32::from_be_bytes(b[o..o + 4].try_into().unwrap())
+}
+
+fn cstr(b: &[u8]) -> String {
+    let n = b.iter().position(|&c| c == 0).unwrap_or(b.len());
+    String::from_utf8_lossy(&b[..n]).to_string()
+}
+
+fn unlock_v1(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
+    let h = read_vec(src.as_ref(), 0, 592).map_err(|e| UnlockError::Corrupt(e.to_string()))?;
+    if h.len() < 592 {
+        return Err(UnlockError::Corrupt("cabeçalho LUKS1 truncado".into()));
+    }
+    let cipher_name = cstr(&h[8..40]);
+    let cipher_mode = cstr(&h[40..72]);
+    let hash = Hash::parse(&cstr(&h[72..104]))
+        .ok_or_else(|| UnlockError::Unsupported(format!("hash {}", cstr(&h[72..104]))))?;
+    let payload = be32(&h, 104) as u64 * 512;
+    let key_bytes = be32(&h, 108) as usize;
+    let mk_digest = &h[112..132];
+    let mk_salt = &h[132..164];
+    let mk_iter = be32(&h, 164);
+    let spec = format!("{cipher_name}-{cipher_mode}");
+    if key_bytes == 0 || key_bytes > 128 {
+        return Err(UnlockError::Corrupt("tamanho de chave inválido".into()));
+    }
+    let check = |mk: &[u8]| hash.pbkdf2(mk, mk_salt, mk_iter, 20) == mk_digest;
+    let finish = |mk: Vec<u8>| -> UnlockResult {
+        let cipher = parse_cipher(&spec, &mk)?;
+        let len = src.size().saturating_sub(payload);
+        let cs = CryptSource::new(src.clone(), cipher, payload, len, 512);
+        Ok(Unlocked {
+            source: Arc::new(cs),
+            description: format!("LUKS1 ({spec})"),
+            volume_key: Some(mk),
+        })
+    };
+    for vk in volume_keys(secrets) {
+        if vk.len() == key_bytes && check(&vk) {
+            return finish(vk);
+        }
+    }
+    let pws = passwords(secrets);
+    for slot in 0..8 {
+        let o = 208 + slot * 48;
+        if be32(&h, o) != 0x00AC_71F3 {
+            continue;
+        }
+        let iter = be32(&h, o + 4);
+        let salt = &h[o + 8..o + 40];
+        let km_off = be32(&h, o + 40) as u64 * 512;
+        let stripes = be32(&h, o + 44) as usize;
+        if stripes == 0 || stripes > 100_000 {
+            continue;
+        }
+        let km_len = (key_bytes * stripes).div_ceil(512) * 512;
+        let Ok(mut km) = read_vec(src.as_ref(), km_off, km_len) else {
+            continue;
+        };
+        if km.len() < km_len {
+            continue;
+        }
+        for pw in &pws {
+            let dk = hash.pbkdf2(pw, salt, iter, key_bytes);
+            let cipher = parse_cipher(&spec, &dk)?;
+            let mut m = km.clone();
+            for (i, s) in m.chunks_exact_mut(512).enumerate() {
+                cipher.decrypt_sector(s, i as u64, i as u64 * 512);
+            }
+            let mk = af_merge(&m, key_bytes, stripes, hash);
+            if check(&mk) {
+                return finish(mk);
+            }
+        }
+        km.clear();
+    }
+    Err(UnlockError::WrongSecret)
+}
+
+fn b64(s: &str) -> Option<Vec<u8>> {
+    let mut out = vec![];
+    let mut acc = 0u32;
+    let mut bits = 0;
+    for c in s.bytes() {
+        let v = match c {
+            b'A'..=b'Z' => c - b'A',
+            b'a'..=b'z' => c - b'a' + 26,
+            b'0'..=b'9' => c - b'0' + 52,
+            b'+' => 62,
+            b'/' => 63,
+            b'=' | b'\n' | b'\r' => continue,
+            _ => return None,
+        } as u32;
+        acc = (acc << 6) | v;
+        bits += 6;
+        if bits >= 8 {
+            bits -= 8;
+            out.push((acc >> bits) as u8);
+            acc &= (1 << bits) - 1;
+        }
+    }
+    Some(out)
+}
+
+fn jstr<'a>(v: &'a serde_json::Value, k: &str) -> Option<&'a str> {
+    v.get(k)?.as_str()
+}
+
+/// Números no JSON do LUKS2 vêm como texto (inteiros grandes) ou número.
+fn jnum(v: &serde_json::Value, k: &str) -> Option<u64> {
+    let x = v.get(k)?;
+    x.as_u64().or_else(|| x.as_str()?.parse().ok())
+}
+
+fn unlock_v2(src: Arc<dyn Source>, secrets: &[Secret]) -> UnlockResult {
+    let h = read_vec(src.as_ref(), 0, 4096).map_err(|e| UnlockError::Corrupt(e.to_string()))?;
+    if h.len() < 4096 {
+        return Err(UnlockError::Corrupt("cabeçalho LUKS2 truncado".into()));
+    }
+    let hdr_size = u64::from_be_bytes(h[8..16].try_into().unwrap());
+    if !(16384..=(4 << 20)).contains(&hdr_size) {
+        return Err(UnlockError::Corrupt(
+            "tamanho de cabeçalho LUKS2 inválido".into(),
+        ));
+    }
+    let area = read_vec(src.as_ref(), 4096, (hdr_size - 4096) as usize)
+        .map_err(|e| UnlockError::Corrupt(e.to_string()))?;
+    let end = area.iter().position(|&c| c == 0).unwrap_or(area.len());
+    let json: serde_json::Value = serde_json::from_slice(&area[..end])
+        .map_err(|e| UnlockError::Corrupt(format!("JSON: {e}")))?;
+    let segments = json
+        .get("segments")
+        .and_then(|s| s.as_object())
+        .ok_or_else(|| UnlockError::Corrupt("sem segments".into()))?;
+    let (_, seg) = segments
+        .iter()
+        .find(|(_, s)| jstr(s, "type") == Some("crypt"))
+        .ok_or_else(|| UnlockError::Unsupported("sem segmento cifrado".into()))?;
+    let seg_off =
+        jnum(seg, "offset").ok_or_else(|| UnlockError::Corrupt("offset do segmento".into()))?;
+    let seg_len = match seg.get("size").and_then(|s| s.as_str()) {
+        Some("dynamic") | None => src.size().saturating_sub(seg_off),
+        Some(n) => n.parse().unwrap_or(0),
+    };
+    let seg_enc = jstr(seg, "encryption")
+        .unwrap_or("aes-xts-plain64")
+        .to_string();
+    let sector = jnum(seg, "sector_size").unwrap_or(512);
+    let iv_tweak = jnum(seg, "iv_tweak").unwrap_or(0);
+    let digests = json
+        .get("digests")
+        .and_then(|d| d.as_object())
+        .ok_or_else(|| UnlockError::Corrupt("sem digests".into()))?;
+
+    let check = |vk: &[u8]| -> bool {
+        for (_, d) in digests {
+            if jstr(d, "type") != Some("pbkdf2") {
+                continue;
+            }
+            let (Some(hash), Some(salt), Some(want), Some(it)) = (
+                jstr(d, "hash").and_then(Hash::parse),
+                jstr(d, "salt").and_then(b64),
+                jstr(d, "digest").and_then(b64),
+                jnum(d, "iterations"),
+            ) else {
+                continue;
+            };
+            if hash.pbkdf2(vk, &salt, it as u32, want.len()) == want {
+                return true;
+            }
+        }
+        false
+    };
+    let finish = |vk: Vec<u8>| -> UnlockResult {
+        let cipher = parse_cipher(&seg_enc, &vk)?;
+        let cs =
+            CryptSource::new(src.clone(), cipher, seg_off, seg_len, sector).with_iv_tweak(iv_tweak);
+        Ok(Unlocked {
+            source: Arc::new(cs),
+            description: format!("LUKS2 ({seg_enc})"),
+            volume_key: Some(vk),
+        })
+    };
+    for vk in volume_keys(secrets) {
+        if check(&vk) {
+            return finish(vk);
+        }
+    }
+    let pws = passwords(secrets);
+    let slots = json
+        .get("keyslots")
+        .and_then(|d| d.as_object())
+        .ok_or_else(|| UnlockError::Corrupt("sem keyslots".into()))?;
+    let mut unsupported: Option<String> = None;
+    for (_, slot) in slots {
+        if jstr(slot, "type") != Some("luks2") {
+            continue;
+        }
+        let key_size = jnum(slot, "key_size").unwrap_or(0) as usize;
+        let af = slot.get("af");
+        let stripes = af.and_then(|a| jnum(a, "stripes")).unwrap_or(4000) as usize;
+        let af_hash = af
+            .and_then(|a| jstr(a, "hash"))
+            .and_then(Hash::parse)
+            .unwrap_or(Hash::Sha256);
+        let ar = slot.get("area");
+        let (Some(a_off), Some(a_size)) = (
+            ar.and_then(|a| jnum(a, "offset")),
+            ar.and_then(|a| jnum(a, "size")),
+        ) else {
+            continue;
+        };
+        let a_enc = ar
+            .and_then(|a| jstr(a, "encryption"))
+            .unwrap_or("aes-xts-plain64");
+        let a_ksize = ar.and_then(|a| jnum(a, "key_size")).unwrap_or(64) as usize;
+        let kdf = slot.get("kdf");
+        let Some(kdf) = kdf else { continue };
+        let salt = jstr(kdf, "salt").and_then(b64).unwrap_or_default();
+        let km_len = (key_size * stripes).div_ceil(512) * 512;
+        if key_size == 0 || stripes == 0 || km_len as u64 > a_size {
+            continue;
+        }
+        let Ok(km) = read_vec(src.as_ref(), a_off, km_len) else {
+            continue;
+        };
+        if km.len() < km_len {
+            continue;
+        }
+        for pw in &pws {
+            let dk: Vec<u8> = match jstr(kdf, "type") {
+                Some("pbkdf2") => {
+                    let hh = jstr(kdf, "hash")
+                        .and_then(Hash::parse)
+                        .unwrap_or(Hash::Sha256);
+                    hh.pbkdf2(
+                        pw,
+                        &salt,
+                        jnum(kdf, "iterations").unwrap_or(1000) as u32,
+                        a_ksize,
+                    )
+                }
+                Some(t @ ("argon2i" | "argon2id")) => {
+                    let alg = if t == "argon2i" {
+                        argon2::Algorithm::Argon2i
+                    } else {
+                        argon2::Algorithm::Argon2id
+                    };
+                    let params = match argon2::Params::new(
+                        jnum(kdf, "memory").unwrap_or(65536) as u32,
+                        jnum(kdf, "time").unwrap_or(4) as u32,
+                        jnum(kdf, "cpus").unwrap_or(1) as u32,
+                        Some(a_ksize),
+                    ) {
+                        Ok(p) => p,
+                        Err(e) => {
+                            unsupported = Some(format!("parâmetros Argon2: {e}"));
+                            continue;
+                        }
+                    };
+                    let mut out = vec![0u8; a_ksize];
+                    if argon2::Argon2::new(alg, argon2::Version::V0x13, params)
+                        .hash_password_into(pw, &salt, &mut out)
+                        .is_err()
+                    {
+                        continue;
+                    }
+                    out
+                }
+                Some(t) => {
+                    unsupported = Some(format!("KDF {t}"));
+                    continue;
+                }
+                None => continue,
+            };
+            let cipher = parse_cipher(a_enc, &dk)?;
+            let mut m = km.clone();
+            for (i, s) in m.chunks_exact_mut(512).enumerate() {
+                cipher.decrypt_sector(s, i as u64, i as u64 * 512);
+            }
+            let vk = af_merge(&m, key_size, stripes, af_hash);
+            if check(&vk) {
+                return finish(vk);
+            }
+        }
+    }
+    match unsupported {
+        Some(u) => Err(UnlockError::Unsupported(u)),
+        None => Err(UnlockError::WrongSecret),
+    }
+}
+
+/// Atalho: abre uma janela da origem como LUKS.
+pub fn unlock_window(
+    base: Arc<dyn Source>,
+    start: u64,
+    len: u64,
+    secrets: &[Secret],
+) -> UnlockResult {
+    unlock(Arc::new(SubSource::new(base, start, len)), secrets)
+}
@@ -0,0 +1,365 @@
+//! Cifras de disco (somente leitura) e desbloqueio de volumes cifrados.
+//!
+//! O volume desbloqueado é exposto como uma `Source` comum: o restante do Guará
+//! (varredura, recuperação) enxerga o sistema de arquivos em claro, sem saber
+//! que existe cifra por baixo.
+
+pub mod bitlocker;
+pub mod filevault;
+pub mod luks;
+
+use crate::source::Source;
+use aes::cipher::generic_array::GenericArray;
+use aes::cipher::{BlockDecrypt, BlockEncrypt, KeyInit};
+use aes::{Aes128, Aes192, Aes256};
+use std::io;
+use std::sync::Arc;
+
+/// AES com tamanho de chave escolhido em tempo de execução.
+#[derive(Clone)]
+pub enum AesAny {
+    A128(Aes128),
+    A192(Aes192),
+    A256(Aes256),
+}
+
+impl AesAny {
+    pub fn new(key: &[u8]) -> Option<Self> {
+        Some(match key.len() {
+            16 => AesAny::A128(Aes128::new_from_slice(key).ok()?),
+            24 => AesAny::A192(Aes192::new_from_slice(key).ok()?),
+            32 => AesAny::A256(Aes256::new_from_slice(key).ok()?),
+            _ => return None,
+        })
+    }
+    pub fn encrypt(&self, b: &mut [u8; 16]) {
+        let g = GenericArray::from_mut_slice(b);
+        match self {
+            AesAny::A128(c) => c.encrypt_block(g),
+            AesAny::A192(c) => c.encrypt_block(g),
+            AesAny::A256(c) => c.encrypt_block(g),
+        }
+    }
+    pub fn decrypt(&self, b: &mut [u8; 16]) {
+        let g = GenericArray::from_mut_slice(b);
+        match self {
+            AesAny::A128(c) => c.decrypt_block(g),
+            AesAny::A192(c) => c.decrypt_block(g),
+            AesAny::A256(c) => c.decrypt_block(g),
+        }
+    }
+}
+
+fn xor16(a: &mut [u8; 16], b: &[u8]) {
+    for i in 0..16 {
+        a[i] ^= b[i];
+    }
+}
+
+/// Como o vetor de inicialização de cada setor é calculado.
+#[derive(Clone)]
+pub enum Iv {
+    /// Número do setor (de 512 bytes) em 64 bits little-endian.
+    Plain64,
+    /// Número do setor em 32 bits little-endian.
+    Plain32,
+    Plain64Be,
+    /// ESSIV: AES(SHA-256(chave), setor).
+    Essiv(AesAny),
+    /// Número da unidade de dados (setor de `usize` bytes) em 64 bits little-endian.
+    Unit(u64),
+    /// BitLocker (Windows 10 1511+): AES(chave, offset em bytes).
+    Eboiv(AesAny),
+    /// BitLocker CBC com difusor Elephant: IV = AES(chave, offset em bytes).
+    Bitlocker(AesAny),
+}
+
+impl Iv {
+    fn make(&self, sector_512: u64, byte_off: u64) -> [u8; 16] {
+        let mut iv = [0u8; 16];
+        match self {
+            Iv::Plain64 => iv[..8].copy_from_slice(&sector_512.to_le_bytes()),
+            Iv::Plain32 => iv[..4].copy_from_slice(&(sector_512 as u32).to_le_bytes()),
+            Iv::Plain64Be => iv[8..].copy_from_slice(&sector_512.to_be_bytes()),
+            Iv::Unit(u) => iv[..8].copy_from_slice(&(byte_off / u).to_le_bytes()),
+            Iv::Essiv(k) => {
+                iv[..8].copy_from_slice(&sector_512.to_le_bytes());
+                k.encrypt(&mut iv);
+            }
+            Iv::Eboiv(k) | Iv::Bitlocker(k) => {
+                iv[..8].copy_from_slice(&byte_off.to_le_bytes());
+                k.encrypt(&mut iv);
+            }
+        }
+        iv
+    }
+}
+
+/// Cifra aplicada setor a setor.
+#[derive(Clone)]
+pub enum SectorCipher {
+    Xts {
+        k1: AesAny,
+        k2: AesAny,
+        iv: Iv,
+    },
+    Cbc {
+        key: AesAny,
+        iv: Iv,
+    },
+    /// BitLocker AES-CBC com difusor Elephant (chave de dados + chave de ajuste).
+    Elephant {
+        key: AesAny,
+        tweak: AesAny,
+    },
+}
+
+fn gf_double(t: &mut [u8; 16]) {
+    let mut carry = 0u8;
+    for b in t.iter_mut() {
+        let next = *b >> 7;
+        *b = (*b << 1) | carry;
+        carry = next;
+    }
+    if carry != 0 {
+        t[0] ^= 0x87;
+    }
+}
+
+impl SectorCipher {
+    /// Decifra um setor no lugar. `sector_512` conta setores de 512 bytes; `byte_off` é a posição
+    /// em bytes relativa ao início dos dados cifrados.
+    pub fn decrypt_sector(&self, buf: &mut [u8], sector_512: u64, byte_off: u64) {
+        match self {
+            SectorCipher::Xts { k1, k2, iv } => {
+                let mut t = iv.make(sector_512, byte_off);
+                k2.encrypt(&mut t);
+                for ch in buf.chunks_exact_mut(16) {
+                    let mut b = [0u8; 16];
+                    b.copy_from_slice(ch);
+                    xor16(&mut b, &t);
+                    k1.decrypt(&mut b);
+                    xor16(&mut b, &t);
+                    ch.copy_from_slice(&b);
+                    gf_double(&mut t);
+                }
+            }
+            SectorCipher::Cbc { key, iv } => {
+                cbc_decrypt(key, &iv.make(sector_512, byte_off), buf);
+            }
+            SectorCipher::Elephant { key, tweak } => {
+                bitlocker::elephant_decrypt(key, tweak, buf, byte_off);
+            }
+        }
+    }
+}
+
+pub fn cbc_decrypt(key: &AesAny, iv: &[u8; 16], buf: &mut [u8]) {
+    let mut prev = *iv;
+    for ch in buf.chunks_exact_mut(16) {
+        let mut c = [0u8; 16];
+        c.copy_from_slice(ch);
+        let mut b = c;
+        key.decrypt(&mut b);
+        xor16(&mut b, &prev);
+        ch.copy_from_slice(&b);
+        prev = c;
+    }
+}
+
+pub fn cbc_encrypt(key: &AesAny, iv: &[u8; 16], buf: &mut [u8]) {
+    let mut prev = *iv;
+    for ch in buf.chunks_exact_mut(16) {
+        let mut b = [0u8; 16];
+        b.copy_from_slice(ch);
+        xor16(&mut b, &prev);
+        key.encrypt(&mut b);
+        ch.copy_from_slice(&b);
+        prev = b;
+    }
+}
+
+/// Volume cifrado visto em claro: `len` bytes que começam em `data_offset` na origem.
+pub struct CryptSource {
+    inner: Arc<dyn Source>,
+    cipher: SectorCipher,
+    data_offset: u64,
+    len: u64,
+    sector: u64,
+    /// Setores antes deste limite estão em claro (BitLocker parcialmente cifrado) ou
+    /// são cobertos por uma cópia (os primeiros setores do BitLocker).
+    patches: Vec<Patch>,
+    /// A partir deste byte (relativo aos dados) o conteúdo ainda não foi cifrado.
+    plain_from: u64,
+    /// Somado ao número do setor no cálculo do IV (iv_tweak do LUKS2).
+    iv_tweak: u64,
+}
+
+/// Trecho do volume lido de outro lugar da origem (BitLocker move o início do volume).
+#[derive(Clone)]
+pub struct Patch {
+    /// Início no volume em claro.
+    pub at: u64,
+    pub len: u64,
+    /// Onde estão os dados, na origem, já em claro.
+    pub from: u64,
+    /// Se os bytes de origem precisam ser decifrados (usando a posição `from_crypt`).
+    pub decrypt_from: Option<u64>,
+    /// Devolve zeros (áreas de metadados do BitLocker).
+    pub zero: bool,
+}
+
+impl CryptSource {
+    pub fn new(
+        inner: Arc<dyn Source>,
+        cipher: SectorCipher,
+        data_offset: u64,
+        len: u64,
+        sector: u64,
+    ) -> Self {
+        let sector = sector.max(512);
+        Self {
+            inner,
+            cipher,
+            data_offset,
+            len: len / sector * sector,
+            sector,
+            patches: vec![],
+            plain_from: u64::MAX,
+            iv_tweak: 0,
+        }
+    }
+    pub fn with_patches(mut self, p: Vec<Patch>) -> Self {
+        self.patches = p;
+        self
+    }
+    pub fn with_iv_tweak(mut self, t: u64) -> Self {
+        self.iv_tweak = t;
+        self
+    }
+    pub fn with_plain_from(mut self, off: u64) -> Self {
+        self.plain_from = off;
+        self
+    }
+
+    fn read_sector_plain(&self, rel: u64, out: &mut [u8]) -> io::Result<()> {
+        // `rel` alinhado ao setor; `out.len() == sector`.
+        for p in &self.patches {
+            if rel >= p.at && rel < p.at + p.len {
+                if p.zero {
+                    out.fill(0);
+                    return Ok(());
+                }
+                let src_off = p.from + (rel - p.at);
+                crate::source::read_exact_at(self.inner.as_ref(), self.data_offset + src_off, out)?;
+                if let Some(pos) = p.decrypt_from {
+                    let r = pos + (rel - p.at);
+                    self.cipher.decrypt_sector(out, r / 512, r);
+                }
+                return Ok(());
+            }
+        }
+        crate::source::read_exact_at(self.inner.as_ref(), self.data_offset + rel, out)?;
+        if rel < self.plain_from {
+            self.cipher
+                .decrypt_sector(out, rel / 512 + self.iv_tweak, rel);
+        }
+        Ok(())
+    }
+}
+
+impl Source for CryptSource {
+    fn size(&self) -> u64 {
+        self.len
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<usize> {
+        if offset >= self.len || buf.is_empty() {
+            return Ok(0);
+        }
+        let want = buf.len().min((self.len - offset) as usize);
+        let s = self.sector;
+        let mut done = 0usize;
+        let mut tmp = vec![0u8; s as usize];
+        while done < want {
+            let pos = offset + done as u64;
+            let rel = pos / s * s;
+            let within = (pos - rel) as usize;
+            let n = (s as usize - within).min(want - done);
+            self.read_sector_plain(rel, &mut tmp)?;
+            buf[done..done + n].copy_from_slice(&tmp[within..within + n]);
+            done += n;
+        }
+        Ok(done)
+    }
+}
+
+/// Algo que o usuário fornece para abrir um volume.
+#[derive(Clone)]
+pub enum Secret {
+    Password(String),
+    /// Chave de recuperação numérica do BitLocker (8 grupos de 6 dígitos).
+    RecoveryKey(String),
+    /// Conteúdo de um arquivo de chave (.BEK do BitLocker, keyfile do LUKS).
+    KeyFile(Vec<u8>),
+    /// Chave do volume já conhecida (FVEK/master key).
+    VolumeKey(Vec<u8>),
+}
+
+impl std::fmt::Debug for Secret {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            Secret::Password(_) => "Secret::Password(..)",
+            Secret::RecoveryKey(_) => "Secret::RecoveryKey(..)",
+            Secret::KeyFile(_) => "Secret::KeyFile(..)",
+            Secret::VolumeKey(_) => "Secret::VolumeKey(..)",
+        })
+    }
+}
+
+#[derive(Debug)]
+pub enum UnlockError {
+    /// Nenhuma das senhas/chaves abriu o volume.
+    WrongSecret,
+    Unsupported(String),
+    Corrupt(String),
+}
+
+impl std::fmt::Display for UnlockError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            UnlockError::WrongSecret => write!(f, "senha ou chave incorreta"),
+            UnlockError::Unsupported(s) => write!(f, "não suportado: {s}"),
+            UnlockError::Corrupt(s) => write!(f, "cabeçalho inválido: {s}"),
+        }
+    }
+}
+
+impl From<UnlockError> for crate::Error {
+    fn from(e: UnlockError) -> Self {
+        crate::Error::msg(e.to_string())
+    }
+}
+
+/// Volume aberto.
+pub struct Unlocked {
+    pub source: Arc<dyn Source>,
+    pub description: String,
+    /// Chave do volume (para reabrir sem a senha, se o usuário permitir guardá-la).
+    pub volume_key: Option<Vec<u8>>,
+}
+
+pub type UnlockResult = std::result::Result<Unlocked, UnlockError>;
+
+pub fn to_hex(b: &[u8]) -> String {
+    b.iter().map(|x| format!("{x:02x}")).collect()
+}
+
+pub fn from_hex(s: &str) -> Option<Vec<u8>> {
+    let s = s.trim();
+    if s.len() % 2 != 0 {
+        return None;
+    }
+    (0..s.len() / 2)
+        .map(|i| u8::from_str_radix(&s[i * 2..i * 2 + 2], 16).ok())
+        .collect()
+}
@@ -0,0 +1,398 @@
+//! Recomposição de arquivos fragmentados no carving.
+//!
+//! Para JPEG: valida os bytes contíguos com o decodificador de entropia; se a imagem quebra,
+//! procura entre os clusters "com cara de JPEG" próximos a continuação cujo DC de luminância
+//! emenda sem salto, até três fragmentos. É o que dá para fazer sem tabela de alocação, e só
+//! vale quando o sistema de arquivos não deixou metadados para o arquivo.
+
+use crate::jpegscan::{self, Header, State, Stop};
+use crate::source::{read_vec, Source};
+use crate::types::Extent;
+
+const MAX_FILE: usize = 48 << 20;
+/// Janela de busca da continuação, em bytes, depois e antes do primeiro fragmento.
+const WINDOW_AFTER: u64 = 512 << 20;
+const WINDOW_BEFORE: u64 = 64 << 20;
+const PROBE: usize = 8192;
+pub const CLUSTER: u64 = 4096;
+const MAX_PROBES: usize = 20_000;
+
+/// Marca os clusters (de 4 KiB, alinhados ao início da origem) que parecem dados entropy-coded
+/// de JPEG: sem marcadores no meio e com bytes bem distribuídos.
+#[derive(Default, Clone)]
+pub struct ClusterIndex {
+    bits: Vec<u64>,
+}
+
+impl ClusterIndex {
+    pub fn new(size: u64) -> Self {
+        Self {
+            bits: vec![0; (size / CLUSTER / 64 + 1) as usize],
+        }
+    }
+    pub fn set(&mut self, off: u64) {
+        let c = (off / CLUSTER) as usize;
+        if let Some(w) = self.bits.get_mut(c / 64) {
+            *w |= 1 << (c % 64);
+        }
+    }
+    pub fn get(&self, off: u64) -> bool {
+        let c = (off / CLUSTER) as usize;
+        self.bits
+            .get(c / 64)
+            .map(|w| w >> (c % 64) & 1 == 1)
+            .unwrap_or(false)
+    }
+    /// Examina um trecho lido e marca os clusters candidatos.
+    pub fn scan_chunk(&mut self, abs: u64, buf: &[u8]) {
+        let first = abs.div_ceil(CLUSTER) * CLUSTER;
+        let mut o = first;
+        while o + CLUSTER <= abs + buf.len() as u64 {
+            let c = &buf[(o - abs) as usize..(o - abs + CLUSTER) as usize];
+            if jpeg_like(c) {
+                self.set(o);
+            }
+            o += CLUSTER;
+        }
+    }
+    pub fn iter_range(&self, from: u64, to: u64) -> impl Iterator<Item = u64> + '_ {
+        let (a, b) = (from.div_ceil(CLUSTER), to / CLUSTER);
+        (a..b)
+            .filter(move |&c| {
+                self.bits
+                    .get(c as usize / 64)
+                    .map(|w| w >> (c % 64) & 1 == 1)
+                    .unwrap_or(false)
+            })
+            .map(|c| c * CLUSTER)
+    }
+}
+
+pub fn jpeg_like(c: &[u8]) -> bool {
+    let mut seen = [false; 256];
+    let mut distinct = 0;
+    for (i, &b) in c.iter().enumerate() {
+        if !seen[b as usize] {
+            seen[b as usize] = true;
+            distinct += 1;
+        }
+        if b == 0xFF {
+            match c.get(i + 1) {
+                Some(&n) if n == 0x00 || (0xD0..=0xD7).contains(&n) => {}
+                Some(0xD9) if i + 2 >= c.len() - 16 => {}
+                None => {}
+                _ => return false,
+            }
+        }
+    }
+    distinct >= 190
+}
+
+pub struct Pool<'a> {
+    pub index: &'a ClusterIndex,
+    /// Extents já atribuídos a outros arquivos.
+    pub used: &'a [Extent],
+}
+
+impl Pool<'_> {
+    fn free_at(&self, off: u64, len: u64) -> bool {
+        !self
+            .used
+            .iter()
+            .any(|u| off < u.end() && off + len > u.offset)
+    }
+}
+
+#[derive(Debug)]
+pub enum Analysis {
+    /// Contíguo e consistente; `len` inclui o EOI.
+    Intact { len: u64 },
+    /// Remontado a partir de fragmentos.
+    Rebuilt { extents: Vec<Extent>, size: u64 },
+    /// Só o início é confiável.
+    Broken { good_len: u64 },
+    /// Formato que não sabemos validar (progressivo etc.).
+    Unsupported,
+}
+
+/// Procura FF D9 logo depois do último MCU (até 64 bytes de preenchimento).
+fn eoi_after(data: &[u8], pos: usize) -> Option<usize> {
+    let end = (pos + 64).min(data.len().saturating_sub(1));
+    (pos.saturating_sub(2)..end)
+        .find(|&i| data[i] == 0xFF && data[i + 1] == 0xD9)
+        .map(|i| i + 2)
+}
+
+/// Valida o JPEG que começa em `off` e, se estiver quebrado, tenta recompô-lo.
+pub fn analyze_jpeg(
+    src: &dyn Source,
+    off: u64,
+    hit_len: u64,
+    pool: &Pool,
+    allow_rebuild: bool,
+) -> Analysis {
+    let read_len = (hit_len as usize).clamp(4096, MAX_FILE);
+    let Ok(buf) = read_vec(src, off, read_len) else {
+        return Analysis::Unsupported;
+    };
+    let Some(h) = jpegscan::parse_header(&buf) else {
+        return Analysis::Unsupported;
+    };
+    let d = jpegscan::decode(&h, &buf, State::start(&h), u32::MAX, 512);
+    let disc = jpegscan::first_discontinuity(&h, &d.dc);
+    if d.stop == Stop::Done && disc.is_none() {
+        if let Some(end) = eoi_after(&buf, d.state.pos) {
+            return Analysis::Intact { len: end as u64 };
+        }
+    }
+    let mut stop_pos = match d.stop {
+        Stop::Marker(_, p) | Stop::Error(p) => p,
+        Stop::Truncated | Stop::Done => buf.len(),
+    };
+    if let Some(m) = disc {
+        let bad = d
+            .snaps
+            .iter()
+            .rev()
+            .find(|s| (s.mcu as usize) <= m)
+            .map(|s| s.pos)
+            .unwrap_or(h.scan_start);
+        stop_pos = stop_pos.min(bad);
+    }
+    let cl = CLUSTER as usize;
+    if off % CLUSTER != 0 || !allow_rebuild {
+        return Analysis::Broken {
+            good_len: (stop_pos / 512 * 512).max(512) as u64,
+        };
+    }
+
+    let mut pieces: Vec<(u64, usize)> = vec![];
+    let mut joined = buf;
+    let mut cur_base = off; // início absoluto do fragmento atual
+    let mut frag_start = 0usize; // posição em `joined` onde o fragmento atual começa
+    let mut snaps = d.snaps;
+    let mut suspect = stop_pos;
+
+    for _ in 0..3 {
+        let top = suspect.saturating_sub(frag_start) / cl * cl;
+        let mut best: Option<(usize, u64, State, f64)> = None;
+        let mut probes = 0usize;
+        for back in 0..4usize {
+            let Some(bc_rel) = top.checked_sub(back * cl).filter(|&b| b > 0) else {
+                break;
+            };
+            let bc = frag_start + bc_rel;
+            let Some(snap) = snaps
+                .iter()
+                .rev()
+                .find(|s| s.pos <= bc)
+                .cloned()
+                .or_else(|| (frag_start == 0).then(|| State::start(&h)))
+            else {
+                continue;
+            };
+            let mut plane = jpegscan::Plane::new(&h);
+            let _ =
+                jpegscan::decode_plane(&h, &joined[..bc], State::start(&h), u32::MAX, &mut plane);
+            let lo = off.saturating_sub(WINDOW_BEFORE);
+            let hi = cur_base + bc_rel as u64 + WINDOW_AFTER;
+            let pre = jpegscan::decode(&h, &joined[..bc], State::start(&h), u32::MAX, 0);
+            let bpm_prefix =
+                (pre.state.pos.saturating_sub(h.scan_start)) as f64 / pre.dc.len().max(1) as f64;
+            let mut ranked: Vec<(f64, u64)> = vec![];
+            for q in pool.index.iter_range(lo, hi) {
+                if q >= cur_base && q < cur_base + bc_rel as u64 + CLUSTER {
+                    continue;
+                }
+                if !pool.free_at(q, CLUSTER)
+                    || pieces
+                        .iter()
+                        .any(|&(po, pl)| q < po + pl as u64 && q + CLUSTER > po)
+                {
+                    continue;
+                }
+                probes += 1;
+                if probes > MAX_PROBES {
+                    break;
+                }
+                if let Some(sc) =
+                    probe_candidate(src, &h, &joined[..bc], &plane, &snap, q, bpm_prefix)
+                {
+                    ranked.push((sc, q));
+                }
+            }
+            ranked.sort_by(|a, b| a.0.partial_cmp(&b.0).unwrap());
+            ranked.truncate(120);
+            // Etapa 2: a continuação certa fecha a imagem exatamente no último MCU.
+            let mut longest: Option<(usize, u64, f64)> = None;
+            for (sc, q) in ranked {
+                let avail = (src.size() - q) as usize;
+                let more = read_vec(src, q, MAX_FILE.min(avail)).unwrap_or_default();
+                let mut j2 = joined[..bc].to_vec();
+                j2.extend_from_slice(&more);
+                let d2 = jpegscan::decode(&h, &j2, snap.clone(), u32::MAX, 0);
+                if d2.stop == Stop::Done && eoi_after(&j2, d2.state.pos).is_some() {
+                    best = Some((bc, q, snap.clone(), 0.0));
+                    break;
+                }
+                let reach = match d2.stop {
+                    Stop::Marker(_, p) | Stop::Error(p) => p.saturating_sub(bc),
+                    _ => j2.len() - bc,
+                };
+                if reach >= 3 * cl && longest.map_or(true, |l| sc < l.2) {
+                    longest = Some((reach, q, sc));
+                }
+            }
+            if best.is_none() {
+                if let Some((_, q, sc)) = longest {
+                    if sc < 25.0 {
+                        let cand = (bc, q, snap.clone(), sc);
+                        if best.as_ref().map_or(true, |b| sc < b.3) {
+                            best = Some(cand);
+                        }
+                    }
+                }
+            }
+            if best.as_ref().is_some_and(|b| b.3 == 0.0) {
+                break;
+            }
+        }
+        let Some((bc, q, snap, _)) = best else { break };
+        pieces.push((cur_base, bc - frag_start));
+        let more = read_vec(src, q, MAX_FILE.min((src.size() - q) as usize)).unwrap_or_default();
+        joined.truncate(bc);
+        joined.extend_from_slice(&more);
+        let d2 = jpegscan::decode(&h, &joined, snap, u32::MAX, 512);
+        if d2.stop == Stop::Done {
+            if let Some(end) = eoi_after(&joined, d2.state.pos) {
+                pieces.push((q, end - bc));
+                return finish(pieces);
+            }
+        }
+        // Quebrou de novo: onde?
+        let mut sp = match d2.stop {
+            Stop::Marker(_, p) | Stop::Error(p) => p,
+            _ => joined.len(),
+        };
+        let all = jpegscan::decode(&h, &joined, State::start(&h), u32::MAX, 0);
+        if let Some(m) = jpegscan::first_discontinuity(&h, &all.dc) {
+            let bad = d2
+                .snaps
+                .iter()
+                .rev()
+                .find(|s| (s.mcu as usize) <= m)
+                .map(|s| s.pos)
+                .unwrap_or(bc);
+            if bad > bc {
+                sp = sp.min(bad);
+            }
+        }
+        snaps = d2.snaps;
+        cur_base = q;
+        frag_start = bc;
+        suspect = sp.max(bc + cl);
+    }
+    let good = pieces.iter().map(|p| p.1).sum::<usize>()
+        + suspect.saturating_sub(frag_start).min(cl * 4) / 512 * 512;
+    Analysis::Broken {
+        good_len: (stop_pos.min(good.max(512)) / 512 * 512).max(512) as u64,
+    }
+}
+
+fn finish(pieces: Vec<(u64, usize)>) -> Analysis {
+    let mut extents: Vec<Extent> = vec![];
+    for (o, l) in &pieces {
+        match extents.last_mut() {
+            Some(last) if last.end() == *o => last.len += *l as u64,
+            _ => extents.push(Extent::new(*o, *l as u64)),
+        }
+    }
+    let size = pieces.iter().map(|p| p.1 as u64).sum();
+    if extents.len() == 1 {
+        return Analysis::Intact { len: size };
+    }
+    Analysis::Rebuilt { extents, size }
+}
+
+/// Pontuação (menor é melhor) de `q` como continuação de `prefix`: diferença média de pixels
+/// nas bordas entre os MCUs novos e seus vizinhos. Natural: poucos níveis de cinza; lixo: dezenas.
+fn probe_candidate(
+    src: &dyn Source,
+    h: &Header,
+    prefix: &[u8],
+    plane: &jpegscan::Plane,
+    snap: &State,
+    q: u64,
+    bpm_prefix: f64,
+) -> Option<f64> {
+    let more = read_vec(src, q, PROBE).ok()?;
+    if more.len() < 1024 {
+        return None;
+    }
+    let mut joined = Vec::with_capacity(prefix.len() + more.len());
+    joined.extend_from_slice(prefix);
+    joined.extend_from_slice(&more);
+    let seam = plane.have;
+    const K: u32 = 36;
+    let mut news: std::collections::HashMap<u32, Vec<u8>> = std::collections::HashMap::new();
+    let mut hook = |mcu: u32, blocks: &[[i32; 64]]| {
+        if mcu >= seam {
+            news.insert(mcu, jpegscan::mcu_luma(h, blocks));
+        }
+    };
+    let want = seam.saturating_sub(snap.mcu) + K + 1;
+    let d = jpegscan::decode_hook(h, &joined, snap.clone(), want, 0, Some(&mut hook));
+    match d.stop {
+        Stop::Error(_) => return None,
+        Stop::Marker(m, _) if m != 0xD9 => return None,
+        _ => {}
+    }
+    let (mw, mh) = (plane.mw, plane.mh);
+    let mx = h.mcus_x;
+    let get = |idx: u32| -> Option<Vec<u8>> {
+        if idx < seam {
+            let (x, y) = ((idx % mx) as usize, (idx / mx) as usize);
+            let mut v = vec![0u8; mw * mh];
+            for r in 0..mh {
+                let o = (y * mh + r) * plane.w + x * mw;
+                v[r * mw..(r + 1) * mw].copy_from_slice(&plane.px[o..o + mw]);
+            }
+            Some(v)
+        } else {
+            news.get(&idx).cloned()
+        }
+    };
+    let (mut sum, mut n) = (0f64, 0u32);
+    for idx in seam + 1..seam + 1 + K {
+        let Some(cur) = news.get(&idx) else { break };
+        if idx % mx > 0 {
+            if let Some(l) = get(idx - 1) {
+                for y in 0..mh {
+                    sum += (cur[y * mw] as i32 - l[y * mw + mw - 1] as i32).abs() as f64;
+                    n += 1;
+                }
+            }
+        }
+        if idx >= mx {
+            if let Some(t) = get(idx - mx) {
+                for x in 0..mw {
+                    sum += (cur[x] as i32 - t[(mh - 1) * mw + x] as i32).abs() as f64;
+                    n += 1;
+                }
+            }
+        }
+    }
+    if n < 40 {
+        return None;
+    }
+    // Bytes por MCU depois da emenda, comparados com os do trecho anterior.
+    let after = d.dc.len() as f64 - (seam.saturating_sub(snap.mcu)) as f64;
+    let used = d.state.pos.saturating_sub(prefix.len()) as f64;
+    let ratio = if after > 4.0 && used > 0.0 {
+        (used / after) / bpm_prefix.max(0.5)
+    } else {
+        1.0
+    };
+    let sc = sum / n as f64 + 20.0 * ratio.ln().abs();
+    Some(sc)
+}
@@ -0,0 +1,651 @@
+//! APFS (volumes sem cifragem): lê o contêiner, o mapa de objetos e a árvore de arquivos de cada
+//! volume; arquivos apagados vêm de duas fontes: as árvores dos instantâneos (snapshots) e os nós
+//! antigos da árvore (copy-on-write) que ainda estão no disco. Volumes cifrados (FileVault) são
+//! detectados e deixados para a varredura por assinatura.
+
+use super::{make_found, Ctx, NewFound, VolumeScan};
+use crate::source::{read_vec, Source};
+use crate::types::{Confidence, DataLoc, Extent, Origin};
+use std::collections::{BTreeMap, HashMap, HashSet};
+
+fn le16(b: &[u8], o: usize) -> u16 {
+    b.get(o..o + 2)
+        .map(|s| u16::from_le_bytes([s[0], s[1]]))
+        .unwrap_or(0)
+}
+fn le32(b: &[u8], o: usize) -> u32 {
+    b.get(o..o + 4)
+        .map(|s| u32::from_le_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+fn le64(b: &[u8], o: usize) -> u64 {
+    b.get(o..o + 8)
+        .map(|s| u64::from_le_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+
+const OBJ_TYPE_MASK: u32 = 0xFFFF;
+const T_BTREE_ROOT: u32 = 2;
+const T_BTREE_NODE: u32 = 3;
+const SUBTYPE_FSTREE: u32 = 0x0E;
+
+// tipos de registro da árvore de arquivos
+const R_SNAP_METADATA: u8 = 1;
+const R_INODE: u8 = 3;
+const R_FILE_EXTENT: u8 = 8;
+const R_DIR_REC: u8 = 9;
+
+/// Soma de verificação Fletcher-64 do APFS (cobre o bloco menos os 8 bytes iniciais).
+pub fn fletcher64(data: &[u8]) -> u64 {
+    let (mut s1, mut s2) = (0u64, 0u64);
+    for w in data.chunks_exact(4) {
+        s1 = (s1 + u32::from_le_bytes(w.try_into().unwrap()) as u64) % 0xFFFF_FFFF;
+        s2 = (s2 + s1) % 0xFFFF_FFFF;
+    }
+    let c1 = 0xFFFF_FFFF - ((s1 + s2) % 0xFFFF_FFFF);
+    let c2 = 0xFFFF_FFFF - ((s1 + c1) % 0xFFFF_FFFF);
+    (c2 << 32) | c1
+}
+
+struct Apfs<'a> {
+    src: &'a dyn Source,
+    base: u64,
+    bs: u64,
+    blocks: u64,
+}
+
+struct BNode {
+    flags: u16,
+    level: u16,
+    /// (chave, valor) por entrada
+    entries: Vec<(Vec<u8>, Vec<u8>)>,
+    oid: u64,
+    xid: u64,
+}
+
+impl<'a> Apfs<'a> {
+    fn block(&self, paddr: u64) -> Option<Vec<u8>> {
+        if paddr >= self.blocks {
+            return None;
+        }
+        let b = read_vec(self.src, self.base + paddr * self.bs, self.bs as usize).ok()?;
+        (b.len() as u64 == self.bs).then_some(b)
+    }
+
+    fn checked_block(&self, paddr: u64) -> Option<Vec<u8>> {
+        let b = self.block(paddr)?;
+        (fletcher64(&b[8..]) == le64(&b, 0)).then_some(b)
+    }
+
+    fn parse_node(&self, b: &[u8], fixed_k: usize, fixed_v: usize) -> Option<BNode> {
+        let flags = le16(b, 32);
+        let level = le16(b, 34);
+        let n = le32(b, 36) as usize;
+        let toc_off = le16(b, 40) as usize;
+        let toc_len = le16(b, 42) as usize;
+        let is_fixed = flags & 4 != 0;
+        let is_root = flags & 1 != 0;
+        let key_base = 56 + toc_off + toc_len;
+        let val_end = b.len() - if is_root { 40 } else { 0 };
+        let mut entries = Vec::with_capacity(n);
+        for i in 0..n {
+            let (koff, klen, voff, vlen);
+            if is_fixed {
+                let o = 56 + toc_off + i * 4;
+                koff = le16(b, o) as usize;
+                voff = le16(b, o + 2) as usize;
+                klen = fixed_k;
+                vlen = if level == 0 { fixed_v } else { 8 };
+            } else {
+                let o = 56 + toc_off + i * 8;
+                koff = le16(b, o) as usize;
+                klen = le16(b, o + 2) as usize;
+                voff = le16(b, o + 4) as usize;
+                vlen = le16(b, o + 6) as usize;
+            }
+            let ks = key_base + koff;
+            let k = b.get(ks..ks + klen)?.to_vec();
+            let v = if voff == 0xFFFF {
+                vec![]
+            } else {
+                b.get(val_end.checked_sub(voff)?..)?.get(..vlen)?.to_vec()
+            };
+            entries.push((k, v));
+        }
+        Some(BNode {
+            flags,
+            level,
+            entries,
+            oid: le64(b, 8),
+            xid: le64(b, 16),
+        })
+    }
+
+    /// Todas as entradas de uma árvore física (mapa de objetos): filhos são endereços físicos.
+    fn walk_physical(
+        &self,
+        root: u64,
+        fixed_k: usize,
+        fixed_v: usize,
+        f: &mut dyn FnMut(&[u8], &[u8]),
+    ) {
+        let mut stack = vec![(root, 0u32)];
+        let mut seen = HashSet::new();
+        while let Some((p, depth)) = stack.pop() {
+            if depth > 8 || !seen.insert(p) {
+                continue;
+            }
+            let Some(b) = self.checked_block(p) else {
+                continue;
+            };
+            let Some(n) = self.parse_node(&b, fixed_k, fixed_v) else {
+                continue;
+            };
+            if n.level == 0 {
+                for (k, v) in &n.entries {
+                    f(k, v);
+                }
+            } else {
+                for (_, v) in n.entries.iter().rev() {
+                    stack.push((le64(v, 0), depth + 1));
+                }
+            }
+        }
+    }
+
+    /// Mapa de objetos: oid -> [(xid, paddr)] ordenado por xid.
+    fn omap(&self, omap_paddr: u64) -> HashMap<u64, Vec<(u64, u64)>> {
+        let mut m: HashMap<u64, Vec<(u64, u64)>> = HashMap::new();
+        let Some(ob) = self.checked_block(omap_paddr) else {
+            return m;
+        };
+        let tree = le64(&ob, 48);
+        self.walk_physical(tree, 16, 16, &mut |k, v| {
+            m.entry(le64(k, 0))
+                .or_default()
+                .push((le64(k, 8), le64(v, 8)));
+        });
+        for v in m.values_mut() {
+            v.sort();
+        }
+        m
+    }
+}
+
+fn lookup(m: &HashMap<u64, Vec<(u64, u64)>>, oid: u64, max_xid: u64) -> Option<u64> {
+    m.get(&oid)?
+        .iter()
+        .rev()
+        .find(|(x, _)| *x <= max_xid)
+        .map(|(_, p)| *p)
+}
+
+// ---------------------------------------------------------------- registros
+
+#[derive(Clone, Debug, Default)]
+struct Inode {
+    parent: u64,
+    private_id: u64,
+    mtime: i64,
+    ctime: i64,
+    atime: i64,
+    mode: u16,
+    size: u64,
+    name: Option<String>,
+    has: bool,
+    compressed: bool,
+}
+
+#[derive(Clone, Debug, Default)]
+struct FileRec {
+    inode: Inode,
+    names: BTreeMap<u64, String>, // pai -> nome
+}
+
+type Files = HashMap<u64, FileRec>;
+type Extents = HashMap<u64, BTreeMap<u64, (u64, u64, u64)>>; // private_id -> logical -> (len, paddr, crypto)
+
+fn ns(t: u64) -> i64 {
+    (t / 1_000_000_000) as i64
+}
+
+fn add_record(files: &mut Files, extents: &mut Extents, k: &[u8], v: &[u8]) {
+    let hdr = le64(k, 0);
+    let (id, ty) = (hdr & 0x0FFF_FFFF_FFFF_FFFF, (hdr >> 60) as u8);
+    match ty {
+        R_INODE if v.len() >= 92 => {
+            let e = files.entry(id).or_default();
+            let mut ino = Inode {
+                parent: le64(v, 0),
+                private_id: le64(v, 8),
+                ctime: ns(le64(v, 16)), // criação
+                mtime: ns(le64(v, 24)),
+                atime: ns(le64(v, 40)),
+                mode: le16(v, 80),
+                size: le64(v, 84),
+                has: true,
+                ..Default::default()
+            };
+            let flags = le64(v, 48);
+            ino.compressed = le32(v, 68) & 0x20 != 0;
+            let _ = flags;
+            // campos estendidos
+            let xf = &v[92..];
+            if xf.len() >= 4 {
+                let n = le16(xf, 0) as usize;
+                let mut p = 4 + n * 4;
+                for i in 0..n {
+                    let (xt, xs) = (xf[4 + i * 4], le16(xf, 6 + i * 4) as usize);
+                    let data = xf.get(p..p + xs).unwrap_or(&[]);
+                    match xt {
+                        4 => {
+                            ino.name = Some(
+                                String::from_utf8_lossy(
+                                    data.split(|&c| c == 0).next().unwrap_or(&[]),
+                                )
+                                .to_string(),
+                            )
+                        }
+                        8 if data.len() >= 8 => ino.size = le64(data, 0),
+                        _ => {}
+                    }
+                    p += xs.div_ceil(8) * 8;
+                }
+            }
+            e.inode = ino;
+        }
+        R_DIR_REC if k.len() > 12 && v.len() >= 18 => {
+            let nl = (le32(k, 8) & 0x3FF) as usize;
+            if let Some(name) = k.get(12..12 + nl) {
+                let name = String::from_utf8_lossy(name.split(|&c| c == 0).next().unwrap_or(&[]))
+                    .to_string();
+                files.entry(le64(v, 0)).or_default().names.insert(id, name);
+            }
+        }
+        R_FILE_EXTENT if k.len() >= 16 && v.len() >= 24 => {
+            let len = le64(v, 0) & 0x00FF_FFFF_FFFF_FFFF;
+            extents
+                .entry(id)
+                .or_default()
+                .insert(le64(k, 8), (len, le64(v, 8), le64(v, 16)));
+        }
+        _ => {}
+    }
+}
+
+impl Apfs<'_> {
+    /// Percorre a árvore de arquivos a partir de uma raiz virtual.
+    fn walk_fstree(
+        &self,
+        root_oid: u64,
+        omap: &HashMap<u64, Vec<(u64, u64)>>,
+        xid: u64,
+        f: &mut dyn FnMut(&[u8], &[u8], u64),
+    ) {
+        let Some(rp) = lookup(omap, root_oid, xid) else {
+            return;
+        };
+        let mut stack = vec![(rp, 0u32)];
+        let mut seen = HashSet::new();
+        while let Some((p, depth)) = stack.pop() {
+            if depth > 10 || !seen.insert(p) {
+                continue;
+            }
+            let Some(b) = self.checked_block(p) else {
+                continue;
+            };
+            let Some(n) = self.parse_node(&b, 16, 16) else {
+                continue;
+            };
+            if n.level == 0 {
+                for (k, v) in &n.entries {
+                    f(k, v, p);
+                }
+            } else {
+                for (_, v) in n.entries.iter().rev() {
+                    if let Some(cp) = lookup(omap, le64(v, 0), xid) {
+                        stack.push((cp, depth + 1));
+                    }
+                }
+            }
+        }
+    }
+}
+
+fn path_of(files: &Files, mut id: u64) -> String {
+    let mut parts = vec![];
+    for _ in 0..64 {
+        if id == 2 || id == 1 {
+            break;
+        }
+        match files
+            .get(&id)
+            .and_then(|f| f.names.iter().next().map(|(p, n)| (*p, n.clone())))
+        {
+            Some((p, n)) => {
+                parts.push(n);
+                id = p;
+            }
+            None => break,
+        }
+    }
+    parts.reverse();
+    parts.join("/")
+}
+
+struct Volume {
+    name: String,
+    omap_paddr: u64,
+    root_oid: u64,
+    snap_tree_oid: u64,
+    encrypted: bool,
+}
+
+fn parse_volume(b: &[u8]) -> Option<Volume> {
+    if &b[32..36] != b"APSB" {
+        return None;
+    }
+    let name = String::from_utf8_lossy(&b[704..960])
+        .split('\0')
+        .next()
+        .unwrap_or("")
+        .to_string();
+    Some(Volume {
+        name,
+        omap_paddr: le64(b, 128),
+        root_oid: le64(b, 136),
+        snap_tree_oid: le64(b, 152),
+        encrypted: le64(b, 264) & 1 == 0,
+    })
+}
+
+fn open_container<'a>(src: &'a dyn Source, base: u64) -> Option<(Apfs<'a>, Vec<u8>)> {
+    let b0 = read_vec(src, base, 4096).ok()?;
+    if b0.len() < 4096 || &b0[32..36] != b"NXSB" {
+        return None;
+    }
+    let bs = le32(&b0, 36) as u64;
+    let blocks = le64(&b0, 40);
+    if !(4096..=65536).contains(&bs) || !bs.is_power_of_two() {
+        return None;
+    }
+    let a = Apfs {
+        src,
+        base,
+        bs,
+        blocks,
+    };
+    // O superbloco mais recente está na área de descritores de checkpoint.
+    let desc_blocks = le32(&b0, 104) as u64;
+    let desc_base = le64(&b0, 112);
+    let mut best = b0.clone();
+    for i in 0..desc_blocks {
+        if let Some(b) = a.checked_block(desc_base as u64 + i) {
+            if &b[32..36] == b"NXSB" && le64(&b, 16) > le64(&best, 16) {
+                best = b;
+            }
+        }
+    }
+    Some((a, best))
+}
+
+pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
+    let _ = part_len;
+    let mut res = VolumeScan::default();
+    let Some((a, nx)) = open_container(ctx.src, base) else {
+        return res;
+    };
+    let Some(cont_omap_block) = a.checked_block(le64(&nx, 160)) else {
+        return res;
+    };
+    let _ = cont_omap_block;
+    let container_omap = a.omap(le64(&nx, 160));
+    let max_fs = le32(&nx, 180).min(100) as usize;
+    let mut vols: Vec<Volume> = vec![];
+    for i in 0..max_fs {
+        let oid = le64(&nx, 184 + i * 8);
+        if oid == 0 {
+            continue;
+        }
+        if let Some(p) = lookup(&container_omap, oid, u64::MAX) {
+            if let Some(b) = a.checked_block(p) {
+                if let Some(v) = parse_volume(&b) {
+                    vols.push(v);
+                }
+            }
+        }
+    }
+    let nvols = vols.len();
+    for v in &vols {
+        if v.encrypted {
+            res.warnings.push(format!("APFS: o volume \"{}\" está cifrado (FileVault); os arquivos só são legíveis com a chave, então use a varredura por assinatura apenas se o volume já estiver aberto.", v.name));
+            continue;
+        }
+        scan_volume(ctx, &a, v, nvols == 1, &mut res);
+        if (ctx.cancelled)() {
+            return res;
+        }
+    }
+    res
+}
+
+fn scan_volume(ctx: &mut Ctx, a: &Apfs, v: &Volume, allow_stale_scan: bool, res: &mut VolumeScan) {
+    let omap = a.omap(v.omap_paddr);
+    let current_xid = u64::MAX;
+    // Árvore atual.
+    let mut live: Files = HashMap::new();
+    let mut live_ext: Extents = HashMap::new();
+    let mut live_nodes: HashSet<u64> = HashSet::new();
+    a.walk_fstree(v.root_oid, &omap, current_xid, &mut |k, val, node| {
+        live_nodes.insert(node);
+        add_record(&mut live, &mut live_ext, k, val);
+    });
+    // Instantâneos.
+    let mut stale: Files = HashMap::new();
+    let mut stale_ext: Extents = HashMap::new();
+    if v.snap_tree_oid != 0 {
+        if let Some(sp) = lookup(&omap, v.snap_tree_oid, current_xid).or(Some(v.snap_tree_oid)) {
+            let mut snaps: Vec<(u64, u64)> = vec![]; // (xid, sblock paddr)
+            let mut stack = vec![sp];
+            let mut seen = HashSet::new();
+            while let Some(p) = stack.pop() {
+                if !seen.insert(p) {
+                    continue;
+                }
+                let Some(b) = a.checked_block(p) else {
+                    continue;
+                };
+                let Some(n) = a.parse_node(&b, 0, 0) else {
+                    continue;
+                };
+                if n.level == 0 {
+                    for (k, val) in &n.entries {
+                        let hdr = le64(k, 0);
+                        if (hdr >> 60) as u8 == R_SNAP_METADATA && val.len() >= 40 {
+                            snaps.push((hdr & 0x0FFF_FFFF_FFFF_FFFF, le64(val, 8)));
+                        }
+                    }
+                } else {
+                    for (_, val) in &n.entries {
+                        // árvore de metadados de snapshot: filhos físicos ou virtuais
+                        let c = le64(val, 0);
+                        stack.push(lookup(&omap, c, current_xid).unwrap_or(c));
+                    }
+                }
+            }
+            for (xid, sblock) in snaps {
+                let Some(sb) = a.checked_block(sblock) else {
+                    continue;
+                };
+                let Some(sv) = parse_volume(&sb) else {
+                    continue;
+                };
+                a.walk_fstree(sv.root_oid, &omap, xid, &mut |k, val, _| {
+                    add_record(&mut stale, &mut stale_ext, k, val);
+                });
+            }
+        }
+    }
+    // Nós antigos da árvore de arquivos.
+    if allow_stale_scan {
+        let total = a.blocks;
+        for p in 0..total {
+            if p % 4096 == 0 {
+                if (ctx.cancelled)() {
+                    return;
+                }
+                (ctx.progress)(p, total);
+            }
+            let Some(b) = a.block(p) else { continue };
+            let ty = le32(&b, 24) & OBJ_TYPE_MASK;
+            if (ty != T_BTREE_NODE && ty != T_BTREE_ROOT)
+                || le32(&b, 28) != SUBTYPE_FSTREE
+                || le16(&b, 34) != 0
+            {
+                continue;
+            }
+            if live_nodes.contains(&p) || fletcher64(&b[8..]) != le64(&b, 0) {
+                continue;
+            }
+            if let Some(n) = a.parse_node(&b, 16, 16) {
+                let _ = (n.oid, n.xid, n.flags);
+                for (k, val) in &n.entries {
+                    add_record(&mut stale, &mut stale_ext, k, val);
+                }
+            }
+        }
+    }
+    // Arquivos que só existem nas versões antigas.
+    let mut ids: Vec<&u64> = stale.keys().collect();
+    ids.sort();
+    let mut seen_first: HashSet<u64> = HashSet::new();
+    for id in ids {
+        if live.get(id).is_some_and(|f| f.inode.has) {
+            continue;
+        }
+        let rec = &stale[id];
+        let ino = &rec.inode;
+        if !ino.has || ino.mode & 0o170000 != 0o100000 || ino.size == 0 {
+            continue;
+        }
+        let Some(ex) = stale_ext.get(&ino.private_id) else {
+            continue;
+        };
+        if ex.values().any(|e| e.2 != 0) {
+            continue; // extensão cifrada
+        }
+        // nome e pasta: da entrada de diretório, senão do próprio inode
+        let (name, parent) = match rec.names.iter().next() {
+            Some((p, n)) => (n.clone(), *p),
+            None => match &ino.name {
+                Some(n) => (n.clone(), ino.parent),
+                None => (format!("arquivo_{id}"), ino.parent),
+            },
+        };
+        let merged: Files = stale
+            .iter()
+            .map(|(k, v)| (*k, v.clone()))
+            .chain(live.iter().map(|(k, v)| (*k, v.clone())))
+            .collect();
+        let dir = Some(format!("/{}", path_of(&merged, parent)).replace("//", "/"));
+        let mut extents: Vec<Extent> = vec![];
+        let mut pos = 0u64;
+        let mut ok = true;
+        for (&lo, &(len, paddr, _)) in ex {
+            if lo > pos {
+                extents.push(Extent {
+                    offset: 0,
+                    len: lo - pos,
+                    sparse: true,
+                });
+            }
+            if paddr == 0 {
+                extents.push(Extent {
+                    offset: 0,
+                    len,
+                    sparse: true,
+                });
+            } else if paddr < a.blocks {
+                extents.push(Extent::new(a.base + paddr * a.bs, len));
+            } else {
+                ok = false;
+            }
+            pos = lo + len;
+        }
+        if !ok || pos < ino.size.min(1) {
+            continue;
+        }
+        let extents = super::fat::trim_extents(extents, ino.size);
+        let Some(first) = extents.iter().find(|e| !e.sparse) else {
+            continue;
+        };
+        if !seen_first.insert(first.offset) {
+            continue;
+        }
+        let note = if ino.compressed {
+            "arquivo comprimido pelo macOS (decmpfs): o conteúdo pode estar incompleto"
+        } else {
+            "versão antiga da árvore ou instantâneo do APFS"
+        };
+        let ts = |t: i64| (t > 0).then_some(t);
+        let nf = NewFound {
+            name,
+            dir,
+            size: ino.size,
+            origin: Origin::Apfs,
+            data: DataLoc::Extents { extents },
+            modified: ts(ino.mtime),
+            created: ts(ino.ctime),
+            accessed: ts(ino.atime),
+            base: if ino.compressed {
+                Confidence::Low
+            } else {
+                Confidence::Medium
+            },
+            note: Some(note),
+        };
+        let f = make_found(ctx, nf);
+        (ctx.emit)(f);
+    }
+    let _ = res;
+}
+
+/// Arquivos e pastas atuais do primeiro volume sem cifragem (caminho, tamanho, é pasta).
+pub fn live_paths(src: &dyn Source, base: u64) -> Vec<(String, u64, bool)> {
+    let Some((a, nx)) = open_container(src, base) else {
+        return vec![];
+    };
+    let cont = a.omap(le64(&nx, 160));
+    let mut out = vec![];
+    for i in 0..le32(&nx, 180).min(100) as usize {
+        let oid = le64(&nx, 184 + i * 8);
+        let Some(p) = lookup(&cont, oid, u64::MAX) else {
+            continue;
+        };
+        let Some(vb) = a.checked_block(p) else {
+            continue;
+        };
+        let Some(v) = parse_volume(&vb) else { continue };
+        if v.encrypted {
+            continue;
+        }
+        let omap = a.omap(v.omap_paddr);
+        let mut files: Files = HashMap::new();
+        let mut ext: Extents = HashMap::new();
+        a.walk_fstree(v.root_oid, &omap, u64::MAX, &mut |k, val, _| {
+            add_record(&mut files, &mut ext, k, val)
+        });
+        for (&id, f) in &files {
+            if !f.inode.has || id <= 2 {
+                continue;
+            }
+            out.push((
+                path_of(&files, id),
+                f.inode.size,
+                f.inode.mode & 0o170000 == 0o040000,
+            ));
+        }
+    }
+    out.sort();
+    out
+}
@@ -0,0 +1,944 @@
+//! Btrfs (um dispositivo; perfis single, DUP e RAID 1): árvores atuais para nomes e mapa de
+//! espaço livre, e arquivos apagados achados em nós antigos das árvores. Como o Btrfs nunca
+//! sobrescreve metadados no lugar (copy-on-write), as versões anteriores dos nós continuam no
+//! disco até o espaço ser reaproveitado: varremos os blocos de metadata em busca delas.
+//! Extensões comprimidas (zlib, zstd, lzo) são descompactadas na recuperação.
+
+use super::{make_found, merge_extents, Ctx, NewFound, VolumeScan};
+use crate::source::{read_vec, Source};
+use crate::types::{Confidence, DataLoc, Extent, Origin, Packed, PackedCodec, Part};
+use std::collections::{BTreeMap, HashMap, HashSet};
+
+const MAGIC: &[u8; 8] = b"_BHRfS_M";
+const SB_OFF: u64 = 0x10000;
+
+// chaves
+const INODE_ITEM: u8 = 1;
+const INODE_REF: u8 = 12;
+const EXTENT_DATA: u8 = 108;
+const ROOT_ITEM: u8 = 132;
+const EXTENT_ITEM: u8 = 168;
+const METADATA_ITEM: u8 = 169;
+const CHUNK_ITEM: u8 = 228;
+
+fn le16(b: &[u8], o: usize) -> u16 {
+    b.get(o..o + 2)
+        .map(|s| u16::from_le_bytes([s[0], s[1]]))
+        .unwrap_or(0)
+}
+fn le32(b: &[u8], o: usize) -> u32 {
+    b.get(o..o + 4)
+        .map(|s| u32::from_le_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+fn le64(b: &[u8], o: usize) -> u64 {
+    b.get(o..o + 8)
+        .map(|s| u64::from_le_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+
+pub fn crc32c(data: &[u8]) -> u32 {
+    static TABLE: std::sync::OnceLock<[u32; 256]> = std::sync::OnceLock::new();
+    let t = TABLE.get_or_init(|| {
+        let mut t = [0u32; 256];
+        for i in 0..256u32 {
+            let mut c = i;
+            for _ in 0..8 {
+                c = if c & 1 != 0 {
+                    (c >> 1) ^ 0x82F6_3B78
+                } else {
+                    c >> 1
+                };
+            }
+            t[i as usize] = c;
+        }
+        t
+    });
+    let mut c = !0u32;
+    for &b in data {
+        c = t[((c ^ b as u32) & 0xFF) as usize] ^ (c >> 8);
+    }
+    !c
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct Key {
+    pub objectid: u64,
+    pub ty: u8,
+    pub offset: u64,
+}
+
+fn key_at(b: &[u8], o: usize) -> Key {
+    Key {
+        objectid: le64(b, o),
+        ty: b.get(o + 8).copied().unwrap_or(0),
+        offset: le64(b, o + 9),
+    }
+}
+
+#[derive(Clone, Debug)]
+struct Chunk {
+    logical: u64,
+    len: u64,
+    ty: u64,
+    /// (offset físico do primeiro stripe) por cópia
+    phys: Vec<u64>,
+}
+
+#[derive(Clone, Debug)]
+enum NodeKind {
+    Leaf(Vec<(Key, Vec<u8>)>),
+    Internal(Vec<(Key, u64)>),
+}
+
+#[derive(Clone, Debug)]
+struct Node {
+    bytenr: u64,
+    generation: u64,
+    owner: u64,
+    kind: NodeKind,
+}
+
+struct Fs<'a> {
+    src: &'a dyn Source,
+    base: u64,
+    nodesize: u64,
+    sectorsize: u64,
+    fsid: [u8; 16],
+    chunks: Vec<Chunk>,
+    root: u64,
+    chunk_root: u64,
+}
+
+impl<'a> Fs<'a> {
+    fn open(src: &'a dyn Source, base: u64) -> Option<Fs<'a>> {
+        let sb = read_vec(src, base + SB_OFF, 4096).ok()?;
+        if sb.len() < 4096 || &sb[64..72] != MAGIC {
+            return None;
+        }
+        let csum_type = le16(&sb, 196);
+        if csum_type == 0 && crc32c(&sb[32..4096]) != le32(&sb, 0) {
+            return None;
+        }
+        let nodesize = le32(&sb, 148) as u64;
+        let sectorsize = le32(&sb, 144) as u64;
+        if !nodesize.is_power_of_two()
+            || !(4096..=65536).contains(&nodesize)
+            || !sectorsize.is_power_of_two()
+        {
+            return None;
+        }
+        let mut fsid = [0u8; 16];
+        fsid.copy_from_slice(&sb[32..48]);
+        let mut fs = Fs {
+            src,
+            base,
+            nodesize,
+            sectorsize,
+            fsid,
+            chunks: vec![],
+            root: le64(&sb, 80),
+            chunk_root: le64(&sb, 88),
+        };
+        // sys_chunk_array
+        let n = le32(&sb, 160) as usize;
+        let arr = sb.get(0x32B..0x32B + n.min(2048))?;
+        let mut p = 0;
+        while p + 17 + 48 <= arr.len() {
+            let k = key_at(arr, p);
+            if k.ty != CHUNK_ITEM {
+                break;
+            }
+            let (ch, used) = parse_chunk(&arr[p + 17..], k.offset)?;
+            fs.chunks.push(ch);
+            p += 17 + used;
+        }
+        // chunk tree completa
+        let mut more = vec![];
+        let cr = fs.chunk_root;
+        fs.walk(cr, &mut |k, d| {
+            if k.ty == CHUNK_ITEM {
+                if let Some((ch, _)) = parse_chunk(d, k.offset) {
+                    more.push(ch);
+                }
+            }
+        });
+        for c in more {
+            if !fs.chunks.iter().any(|x| x.logical == c.logical) {
+                fs.chunks.push(c);
+            }
+        }
+        fs.chunks.sort_by_key(|c| c.logical);
+        Some(fs)
+    }
+
+    fn phys(&self, logical: u64) -> Option<u64> {
+        let i = self
+            .chunks
+            .partition_point(|c| c.logical + c.len <= logical);
+        let c = self.chunks.get(i)?;
+        (c.logical <= logical)
+            .then(|| {
+                c.phys
+                    .first()
+                    .map(|p| self.base + p + (logical - c.logical))
+            })
+            .flatten()
+    }
+
+    fn read_node(&self, logical: u64) -> Option<Node> {
+        let p = self.phys(logical)?;
+        let raw = read_vec(self.src, p, self.nodesize as usize).ok()?;
+        self.parse_node(&raw, Some(logical))
+    }
+
+    fn parse_node(&self, raw: &[u8], expect: Option<u64>) -> Option<Node> {
+        if raw.len() as u64 != self.nodesize || raw[32..48] != self.fsid {
+            return None;
+        }
+        let bytenr = le64(raw, 48);
+        if expect.is_some_and(|e| e != bytenr) {
+            return None;
+        }
+        if crc32c(&raw[32..]) != le32(raw, 0) {
+            return None;
+        }
+        let nritems = le32(raw, 96) as usize;
+        let level = raw[100];
+        if nritems > (self.nodesize as usize) / 25 {
+            return None;
+        }
+        let hdr = 101usize;
+        let kind = if level == 0 {
+            let mut items = Vec::with_capacity(nritems);
+            for i in 0..nritems {
+                let o = hdr + i * 25;
+                let k = key_at(raw, o);
+                let (off, size) = (le32(raw, o + 17) as usize, le32(raw, o + 21) as usize);
+                let s = hdr + off;
+                if s + size > raw.len() {
+                    return None;
+                }
+                items.push((k, raw[s..s + size].to_vec()));
+            }
+            NodeKind::Leaf(items)
+        } else {
+            let mut ptrs = Vec::with_capacity(nritems);
+            for i in 0..nritems {
+                let o = hdr + i * 33;
+                if o + 33 > raw.len() {
+                    return None;
+                }
+                ptrs.push((key_at(raw, o), le64(raw, o + 17)));
+            }
+            NodeKind::Internal(ptrs)
+        };
+        Some(Node {
+            bytenr,
+            generation: le64(raw, 80),
+            owner: le64(raw, 88),
+            kind,
+        })
+    }
+
+    /// Percorre uma árvore em ordem, chamando `f` para cada item de folha.
+    fn walk(&self, root: u64, f: &mut dyn FnMut(&Key, &[u8])) {
+        let mut seen = HashSet::new();
+        self.walk_inner(root, f, &mut seen, &mut |_| {}, 0);
+    }
+
+    fn walk_nodes(&self, root: u64, f: &mut dyn FnMut(&Key, &[u8]), nodes: &mut dyn FnMut(&Node)) {
+        let mut seen = HashSet::new();
+        self.walk_inner(root, f, &mut seen, nodes, 0);
+    }
+
+    fn walk_inner(
+        &self,
+        at: u64,
+        f: &mut dyn FnMut(&Key, &[u8]),
+        seen: &mut HashSet<u64>,
+        nodes: &mut dyn FnMut(&Node),
+        depth: u32,
+    ) {
+        if depth > 10 || !seen.insert(at) {
+            return;
+        }
+        let Some(n) = self.read_node(at) else { return };
+        nodes(&n);
+        match &n.kind {
+            NodeKind::Leaf(items) => {
+                for (k, d) in items {
+                    f(k, d);
+                }
+            }
+            NodeKind::Internal(ptrs) => {
+                for (_, child) in ptrs {
+                    self.walk_inner(*child, f, seen, nodes, depth + 1);
+                }
+            }
+        }
+    }
+}
+
+fn parse_chunk(d: &[u8], logical: u64) -> Option<(Chunk, usize)> {
+    if d.len() < 48 {
+        return None;
+    }
+    let len = le64(d, 0);
+    let ty = le64(d, 24);
+    let nstripes = le16(d, 44) as usize;
+    if nstripes == 0 || nstripes > 32 || d.len() < 48 + nstripes * 32 {
+        return None;
+    }
+    let phys = (0..nstripes).map(|i| le64(d, 48 + i * 32 + 8)).collect();
+    Some((
+        Chunk {
+            logical,
+            len,
+            ty,
+            phys,
+        },
+        48 + nstripes * 32,
+    ))
+}
+
+// ---------------------------------------------------------------- inodes
+
+#[derive(Clone, Debug, Default)]
+struct InodeData {
+    gen: u64,
+    size: u64,
+    mode: u32,
+    mtime: i64,
+    ctime: i64,
+    atime: i64,
+    has_inode: bool,
+    refs: HashMap<u64, String>,
+    /// offset no arquivo -> (geração do nó, item)
+    extents: BTreeMap<u64, (u64, Vec<u8>)>,
+}
+
+type Files = HashMap<(u64, u64), InodeData>;
+
+fn add_item(files: &mut Files, owner: u64, gen: u64, k: &Key, d: &[u8]) {
+    match k.ty {
+        INODE_ITEM if d.len() >= 160 => {
+            let e = files.entry((owner, k.objectid)).or_default();
+            let g = le64(d, 0);
+            if !e.has_inode || g >= e.gen {
+                e.has_inode = true;
+                e.gen = g;
+                e.size = le64(d, 16);
+                e.mode = le32(d, 52);
+                e.atime = le64(d, 112) as i64;
+                e.ctime = le64(d, 124) as i64;
+                e.mtime = le64(d, 136) as i64;
+            }
+        }
+        INODE_REF if d.len() >= 10 => {
+            let nlen = le16(d, 8) as usize;
+            if let Some(n) = d.get(10..10 + nlen) {
+                files
+                    .entry((owner, k.objectid))
+                    .or_default()
+                    .refs
+                    .insert(k.offset, String::from_utf8_lossy(n).to_string());
+            }
+        }
+        EXTENT_DATA if d.len() >= 21 => {
+            let e = files.entry((owner, k.objectid)).or_default();
+            match e.extents.get(&k.offset) {
+                Some((g, _)) if *g > gen => {}
+                _ => {
+                    e.extents.insert(k.offset, (gen, d.to_vec()));
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+fn is_fs_tree(id: u64) -> bool {
+    id == 5 || (256..(1u64 << 48)).contains(&id)
+}
+
+pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
+    let _ = part_len;
+    let mut res = VolumeScan::default();
+    let Some(fs) = Fs::open(ctx.src, base) else {
+        return res;
+    };
+    if fs
+        .chunks
+        .iter()
+        .any(|c| c.ty & 0x1 << 3 != 0 || c.ty & 0x10 != 0 || c.ty & 0x100 != 0 || c.ty & 0x200 != 0)
+    {
+        res.warnings.push("Btrfs em RAID 0/10/5/6: a leitura de metadados ainda não suporta esses perfis; usando só assinaturas.".into());
+        return res;
+    }
+
+    // 1) Árvores atuais: raízes das subvolumes e extents alocados.
+    let mut roots: Vec<(u64, u64)> = vec![]; // (id da árvore, bytenr)
+    let mut extent_root = 0u64;
+    let rr = fs.root;
+    fs.walk(rr, &mut |k, d| {
+        if k.ty == ROOT_ITEM && d.len() >= 239 {
+            let bytenr = le64(d, 176);
+            if k.objectid == 2 {
+                extent_root = bytenr;
+            } else if is_fs_tree(k.objectid) {
+                roots.push((k.objectid, bytenr));
+            }
+        }
+    });
+    let mut live_nodes: HashSet<u64> = HashSet::new();
+    let mut live: Files = HashMap::new();
+    for &(id, bytenr) in &roots {
+        let mut tmp: Vec<(Key, Vec<u8>)> = vec![];
+        let mut gens: HashMap<u64, u64> = HashMap::new();
+        let mut seen_nodes: Vec<(u64, u64)> = vec![];
+        {
+            let mut items = |k: &Key, d: &[u8]| tmp.push((*k, d.to_vec()));
+            let mut nodes = |n: &Node| {
+                seen_nodes.push((n.bytenr, n.generation));
+            };
+            fs.walk_nodes(bytenr, &mut items, &mut nodes);
+        }
+        for (b, g) in seen_nodes {
+            live_nodes.insert(b);
+            gens.insert(b, g);
+        }
+        for (k, d) in &tmp {
+            add_item(&mut live, id, u64::MAX, k, d);
+        }
+        if (ctx.cancelled)() {
+            return res;
+        }
+    }
+
+    // Extents alocados (árvore de extents) e mapa livre dos blocos de dados.
+    let mut allocated: Vec<Extent> = vec![];
+    if extent_root != 0 {
+        let nodesize = fs.nodesize;
+        fs.walk(extent_root, &mut |k, _| {
+            if k.ty == EXTENT_ITEM {
+                allocated.push(Extent::new(k.objectid, k.offset));
+            } else if k.ty == METADATA_ITEM {
+                allocated.push(Extent::new(k.objectid, nodesize));
+            }
+        });
+    }
+    let allocated = merge_extents(allocated);
+    let mut free: Vec<Extent> = vec![];
+    for c in fs.chunks.iter().filter(|c| c.ty & 0x1 != 0) {
+        // blocos de dados: livres = chunk - alocado
+        let mut cur = c.logical;
+        let i = allocated.partition_point(|e| e.end() <= c.logical);
+        for e in &allocated[i..] {
+            if e.offset >= c.logical + c.len {
+                break;
+            }
+            if e.offset > cur {
+                if let Some(p) = fs.phys(cur) {
+                    free.push(Extent::new(p, e.offset - cur));
+                }
+            }
+            cur = cur.max(e.end());
+        }
+        if cur < c.logical + c.len {
+            if let Some(p) = fs.phys(cur) {
+                free.push(Extent::new(p, c.logical + c.len - cur));
+            }
+        }
+    }
+    res.free = Some(merge_extents(free));
+
+    // 2) Varre os blocos de metadata atrás de versões antigas de folhas de árvores de arquivos.
+    let mut stale: Files = HashMap::new();
+    let ns = fs.nodesize as usize;
+    let step = fs.sectorsize as usize;
+    let md_chunks: Vec<Chunk> = fs
+        .chunks
+        .iter()
+        .filter(|c| c.ty & 0x4 != 0)
+        .cloned()
+        .collect();
+    let total_md: u64 = md_chunks.iter().map(|c| c.len).sum();
+    let mut done_md = 0u64;
+    for c in &md_chunks {
+        let Some(p0) = c.phys.first().copied() else {
+            continue;
+        };
+        let mut off = 0u64;
+        let block = 8usize << 20;
+        while off < c.len {
+            if (ctx.cancelled)() {
+                return res;
+            }
+            let n = ((c.len - off) as usize).min(block + ns);
+            let Ok(buf) = read_vec(ctx.src, fs.base + p0 + off, n) else {
+                break;
+            };
+            let mut i = 0usize;
+            while i + ns <= buf.len() && (off + i as u64) < c.len {
+                let logical = c.logical + off + i as u64;
+                // cabeçalho barato antes do CRC
+                if buf[i + 32..i + 48] == fs.fsid
+                    && le64(&buf[i..], 48) == logical
+                    && buf[i + 100] == 0
+                {
+                    if let Some(node) = fs.parse_node(&buf[i..i + ns], Some(logical)) {
+                        if is_fs_tree(node.owner) && !live_nodes.contains(&logical) {
+                            if let NodeKind::Leaf(items) = &node.kind {
+                                for (k, d) in items {
+                                    add_item(&mut stale, node.owner, node.generation, k, d);
+                                }
+                            }
+                        }
+                    }
+                }
+                i += step;
+            }
+            off += block as u64;
+            done_md += block as u64;
+            (ctx.progress)(done_md.min(total_md), total_md.max(1));
+        }
+    }
+
+    // 3) Arquivos que só existem nas folhas antigas.
+    let path_of = |owner: u64, mut ino: u64| -> String {
+        let mut parts: Vec<String> = vec![];
+        for _ in 0..64 {
+            if ino == 256 {
+                break;
+            }
+            let e = stale.get(&(owner, ino)).or_else(|| live.get(&(owner, ino)));
+            match e.and_then(|e| e.refs.iter().next()) {
+                Some((parent, name)) => {
+                    parts.push(name.clone());
+                    ino = *parent;
+                }
+                None => {
+                    parts.push("(pasta perdida)".into());
+                    break;
+                }
+            }
+        }
+        parts.reverse();
+        parts.join("/")
+    };
+    let mut keys: Vec<&(u64, u64)> = stale.keys().collect();
+    keys.sort();
+    for key in keys {
+        let (owner, ino) = *key;
+        if live.contains_key(&(owner, ino)) {
+            continue;
+        }
+        let e = &stale[&(owner, ino)];
+        if !e.has_inode || e.mode & 0o170000 != 0o100000 || e.size == 0 || e.extents.is_empty() {
+            continue;
+        }
+        let Some((name, parent)) = e.refs.iter().next().map(|(p, n)| (n.clone(), *p)) else {
+            continue;
+        };
+        let dir = {
+            let p = path_of(owner, parent);
+            Some(if p.is_empty() {
+                String::new()
+            } else {
+                format!("/{p}")
+            })
+        };
+        let Some((data, any_alloc, all_ok)) = build_data(&fs, e, &allocated) else {
+            continue;
+        };
+        let (conf, note) = if !all_ok {
+            (
+                Confidence::Low,
+                "faltam trechos do arquivo na versão antiga da árvore".to_string(),
+            )
+        } else if any_alloc {
+            (Confidence::Medium, "versão antiga do Btrfs; alguns blocos ainda constam como alocados (podem ser de outro arquivo)".to_string())
+        } else {
+            (
+                Confidence::High,
+                "versão antiga da árvore do Btrfs; blocos de dados livres".to_string(),
+            )
+        };
+        let ts = |t: i64| (t > 0).then_some(t);
+        let nf = NewFound {
+            name,
+            dir,
+            size: e.size,
+            origin: Origin::Btrfs,
+            data,
+            modified: ts(e.mtime),
+            created: ts(e.ctime),
+            accessed: ts(e.atime),
+            base: conf,
+            note: Some(&note),
+        };
+        let f = make_found(ctx, nf);
+        (ctx.emit)(f);
+    }
+    res
+}
+
+/// Converte os itens EXTENT_DATA em extents físicos ou partes (inline/comprimidas).
+fn build_data(fs: &Fs, e: &InodeData, allocated: &[Extent]) -> Option<(DataLoc, bool, bool)> {
+    let mut parts: Vec<Part> = vec![];
+    let mut pos = 0u64;
+    let mut any_alloc = false;
+    let mut all_ok = true;
+    let mut plain_only = true;
+    let mut hole = |parts: &mut Vec<Part>, len: u64| {
+        if len > 0 {
+            parts.push(Part::Run { offset: 0, len });
+            // marcador: offset 0 + sparse tratado abaixo
+        }
+    };
+    let _ = &mut hole;
+    let mut sparse_marks: Vec<usize> = vec![];
+    for (&foff, (_, d)) in &e.extents {
+        if foff >= e.size {
+            break;
+        }
+        if foff > pos {
+            sparse_marks.push(parts.len());
+            parts.push(Part::Run {
+                offset: 0,
+                len: foff - pos,
+            });
+            plain_only = false;
+            pos = foff;
+        }
+        let ty = d[20];
+        let comp = d[16];
+        if ty == 0 {
+            // inline
+            let raw = &d[21..];
+            let ram = le64(d, 8) as usize;
+            let bytes = match comp {
+                0 => raw.to_vec(),
+                c => decode(c, raw, ram)?,
+            };
+            let len = (bytes.len() as u64).min(e.size - foff);
+            parts.push(Part::Bytes {
+                bytes: bytes[..len as usize].to_vec(),
+            });
+            plain_only = false;
+            pos = foff + len;
+            continue;
+        }
+        if d.len() < 53 {
+            all_ok = false;
+            break;
+        }
+        let (disk, disk_len, offset, num) = (le64(d, 21), le64(d, 29), le64(d, 37), le64(d, 45));
+        let num = num.min(e.size.saturating_sub(foff));
+        if disk == 0 || ty == 2 {
+            sparse_marks.push(parts.len());
+            parts.push(Part::Run {
+                offset: 0,
+                len: num,
+            });
+            plain_only = false;
+        } else {
+            let Some(phys) = fs.phys(disk) else {
+                all_ok = false;
+                break;
+            };
+            let overlaps = {
+                let i = allocated.partition_point(|x| x.end() <= disk);
+                allocated.get(i).is_some_and(|x| x.offset < disk + disk_len)
+            };
+            any_alloc |= overlaps;
+            if comp == 0 {
+                parts.push(Part::Run {
+                    offset: phys + offset,
+                    len: num,
+                });
+            } else {
+                let codec = match comp {
+                    1 => PackedCodec::Zlib,
+                    2 => PackedCodec::Zstd,
+                    3..=6 => PackedCodec::Lzo,
+                    _ => {
+                        all_ok = false;
+                        break;
+                    }
+                };
+                parts.push(Part::Packed(Packed {
+                    offset: phys,
+                    disk_len,
+                    ram_len: le64(d, 8),
+                    skip: offset,
+                    len: num,
+                    codec,
+                }));
+                plain_only = false;
+            }
+        }
+        pos = foff + num;
+    }
+    if pos < e.size {
+        all_ok = false;
+    }
+    if plain_only {
+        let ex: Vec<Extent> = parts
+            .iter()
+            .filter_map(|p| {
+                if let Part::Run { offset, len } = p {
+                    Some(Extent::new(*offset, *len))
+                } else {
+                    None
+                }
+            })
+            .collect();
+        return Some((DataLoc::Extents { extents: ex }, any_alloc, all_ok));
+    }
+    // Buracos viram trechos esparsos: Part::Run com offset 0 não serve; usa Bytes de zeros pequenos.
+    let mut out: Vec<Part> = vec![];
+    for (i, p) in parts.into_iter().enumerate() {
+        if sparse_marks.contains(&i) {
+            if let Part::Run { len, .. } = p {
+                out.push(Part::Zeros { len });
+                continue;
+            }
+        }
+        out.push(p);
+    }
+    Some((DataLoc::Parts { parts: out }, any_alloc, all_ok))
+}
+
+fn decode(codec: u8, raw: &[u8], ram: usize) -> Option<Vec<u8>> {
+    match codec {
+        1 => {
+            use std::io::Read;
+            let mut v = Vec::with_capacity(ram);
+            flate2::read::ZlibDecoder::new(raw)
+                .read_to_end(&mut v)
+                .ok()?;
+            Some(v)
+        }
+        2 => {
+            use std::io::Read;
+            let mut dec = ruzstd::StreamingDecoder::new(raw).ok()?;
+            let mut v = Vec::with_capacity(ram);
+            dec.read_to_end(&mut v).ok()?;
+            Some(v)
+        }
+        _ => lzo_btrfs(raw, ram),
+    }
+}
+
+/// Formato de extensão LZO do Btrfs: tamanho total (u32) + segmentos [tamanho (u32)][dados LZO1X]
+/// de até um setor de 4 KiB descomprimido cada, sem cruzar fronteiras de setor.
+pub fn lzo_btrfs(raw: &[u8], ram: usize) -> Option<Vec<u8>> {
+    if raw.len() < 4 {
+        return None;
+    }
+    let total = le32(raw, 0) as usize;
+    let mut out = Vec::with_capacity(ram);
+    let mut p = 4usize;
+    while p + 4 <= raw.len().min(total) && out.len() < ram {
+        // pula o preenchimento até o próximo setor se sobrar menos de 4 bytes
+        let in_sector = 4096 - (p % 4096);
+        if in_sector < 4 {
+            p += in_sector;
+            continue;
+        }
+        let seg = le32(raw, p) as usize;
+        p += 4;
+        let chunk = raw.get(p..p + seg)?;
+        let want = (ram - out.len()).min(4096);
+        out.extend(lzo1x_decompress(chunk, want)?);
+        p += seg;
+    }
+    Some(out)
+}
+
+/// LZO1X (descompressão segura, no mesmo esquema de estados do kernel Linux).
+pub fn lzo1x_decompress(src: &[u8], max_out: usize) -> Option<Vec<u8>> {
+    let mut out: Vec<u8> = Vec::with_capacity(max_out);
+    let mut ip = 0usize;
+    let byte = |i: usize| src.get(i).copied().map(|b| b as usize);
+    let lits = |out: &mut Vec<u8>, ip: &mut usize, n: usize| -> Option<()> {
+        out.extend_from_slice(src.get(*ip..*ip + n)?);
+        *ip += n;
+        Some(())
+    };
+    let ext = |ip: &mut usize, base: usize| -> Option<usize> {
+        let mut extra = 0usize;
+        while byte(*ip)? == 0 {
+            extra += 255;
+            *ip += 1;
+        }
+        let v = base + extra + byte(*ip)?;
+        *ip += 1;
+        Some(v)
+    };
+    // estado: literais ao fim da instrução anterior (0..3) ou 4 depois de uma corrida de literais
+    let mut state;
+    if byte(0)? > 17 {
+        let t = byte(0)? - 17;
+        ip = 1;
+        lits(&mut out, &mut ip, t)?;
+        state = if t < 4 { t } else { 4 };
+    } else {
+        state = 0;
+    }
+    loop {
+        if out.len() > max_out + 4096 {
+            return None;
+        }
+        let t = byte(ip)?;
+        ip += 1;
+        if t < 16 {
+            if state == 0 {
+                let n = if t == 0 { ext(&mut ip, 15)? } else { t } + 3;
+                lits(&mut out, &mut ip, n)?;
+                state = 4;
+                continue;
+            }
+            let h = byte(ip)?;
+            ip += 1;
+            let (dist, len) = if state == 4 {
+                ((t >> 2) + (h << 2) + 2049, 3)
+            } else {
+                ((t >> 2) + (h << 2) + 1, 2)
+            };
+            copy_match(&mut out, dist, len)?;
+            let next = t & 3;
+            lits(&mut out, &mut ip, next)?;
+            state = next;
+        } else if t >= 64 {
+            let h = byte(ip)?;
+            ip += 1;
+            copy_match(&mut out, 1 + ((t >> 2) & 7) + (h << 3), (t >> 5) + 1)?;
+            let next = t & 3;
+            lits(&mut out, &mut ip, next)?;
+            state = next;
+        } else if t >= 32 {
+            let len = if t & 31 == 0 {
+                ext(&mut ip, 31)?
+            } else {
+                t & 31
+            } + 2;
+            let b = (byte(ip)?) | (byte(ip + 1)? << 8);
+            ip += 2;
+            copy_match(&mut out, 1 + (b >> 2), len)?;
+            let next = b & 3;
+            lits(&mut out, &mut ip, next)?;
+            state = next;
+        } else {
+            let len = if t & 7 == 0 { ext(&mut ip, 7)? } else { t & 7 } + 2;
+            let b = (byte(ip)?) | (byte(ip + 1)? << 8);
+            ip += 2;
+            let d = ((t & 8) << 11) + (b >> 2);
+            if d == 0 {
+                return Some(out);
+            }
+            copy_match(&mut out, d + 0x4000, len)?;
+            let next = b & 3;
+            lits(&mut out, &mut ip, next)?;
+            state = next;
+        }
+    }
+}
+
+fn copy_match(out: &mut Vec<u8>, dist: usize, len: usize) -> Option<()> {
+    if dist == 0 || dist > out.len() {
+        return None;
+    }
+    let start = out.len() - dist;
+    for i in 0..len {
+        let b = out[start + i];
+        out.push(b);
+    }
+    Some(())
+}
+
+/// Arquivos e pastas atuais com caminho completo e tamanho (usa só as árvores vivas).
+pub fn live_paths(src: &dyn Source, base: u64) -> Vec<(String, u64, bool)> {
+    let Some(fs) = Fs::open(src, base) else {
+        return vec![];
+    };
+    let mut roots: Vec<(u64, u64)> = vec![];
+    fs.walk(fs.root, &mut |k, d| {
+        if k.ty == ROOT_ITEM && d.len() >= 239 && is_fs_tree(k.objectid) {
+            roots.push((k.objectid, le64(d, 176)));
+        }
+    });
+    let mut files: Files = HashMap::new();
+    for (id, b) in roots {
+        fs.walk(b, &mut |k, d| add_item(&mut files, id, u64::MAX, k, d));
+    }
+    let mut out = vec![];
+    for (&(owner, ino), e) in &files {
+        if !e.has_inode || ino == 256 {
+            continue;
+        }
+        let mut parts = vec![];
+        let mut cur = ino;
+        for _ in 0..64 {
+            if cur == 256 {
+                break;
+            }
+            match files.get(&(owner, cur)).and_then(|x| x.refs.iter().next()) {
+                Some((p, n)) => {
+                    parts.push(n.clone());
+                    cur = *p;
+                }
+                None => break,
+            }
+        }
+        parts.reverse();
+        out.push((parts.join("/"), e.size, e.mode & 0o170000 == 0o040000));
+    }
+    out.sort();
+    out
+}
+
+/// Posições das árvores principais, para ferramentas e testes que precisam editar a imagem.
+pub struct TreeLocations {
+    pub nodesize: u64,
+    /// Endereço físico (absoluto na origem) do primeiro nó de cada árvore.
+    pub root_tree: u64,
+    pub fs_tree: u64,
+    pub extent_tree: u64,
+    /// Endereços lógicos correspondentes.
+    pub root_tree_logical: u64,
+    pub fs_tree_logical: u64,
+    pub extent_tree_logical: u64,
+    /// Converte endereço lógico em físico.
+    pub chunks: Vec<(u64, u64, u64)>,
+}
+
+pub fn locate_trees(src: &dyn Source, base: u64) -> Option<TreeLocations> {
+    let fs = Fs::open(src, base)?;
+    let (mut fs_t, mut ext_t) = (0u64, 0u64);
+    fs.walk(fs.root, &mut |k, d| {
+        if k.ty == ROOT_ITEM && d.len() >= 239 {
+            if k.objectid == 5 {
+                fs_t = le64(d, 176);
+            } else if k.objectid == 2 {
+                ext_t = le64(d, 176);
+            }
+        }
+    });
+    Some(TreeLocations {
+        nodesize: fs.nodesize,
+        root_tree: fs.phys(fs.root)?,
+        fs_tree: fs.phys(fs_t)?,
+        extent_tree: fs.phys(ext_t)?,
+        root_tree_logical: fs.root,
+        fs_tree_logical: fs_t,
+        extent_tree_logical: ext_t,
+        chunks: fs
+            .chunks
+            .iter()
+            .filter_map(|c| c.phys.first().map(|p| (c.logical, c.len, fs.base + p)))
+            .collect(),
+    })
+}
@@ -0,0 +1,576 @@
+//! HFS+ / HFSX (inclusive volumes embutidos num wrapper HFS clássico).
+//!
+//! Lê o catálogo (árvore B+) para nomes e caminhos, o bitmap de alocação para o mapa de
+//! espaço livre e procura arquivos apagados em três lugares: sobras dentro dos nós folha do
+//! catálogo, cópias antigas de nós no diário (journal) e registros de arquivo "soltos".
+
+use super::{make_found, merge_extents, Ctx, NewFound, VolumeScan};
+use crate::source::{read_vec, Source};
+use crate::types::{Confidence, DataLoc, Extent, Origin};
+use std::collections::{HashMap, HashSet};
+
+const HFS_EPOCH: i64 = 2_082_844_800;
+
+fn be16(b: &[u8], o: usize) -> u16 {
+    b.get(o..o + 2)
+        .map(|s| u16::from_be_bytes([s[0], s[1]]))
+        .unwrap_or(0)
+}
+fn be32(b: &[u8], o: usize) -> u32 {
+    b.get(o..o + 4)
+        .map(|s| u32::from_be_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+fn be64(b: &[u8], o: usize) -> u64 {
+    b.get(o..o + 8)
+        .map(|s| u64::from_be_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+
+#[derive(Clone, Debug, Default)]
+struct Fork {
+    size: u64,
+    blocks: u32,
+    extents: Vec<(u32, u32)>,
+}
+
+fn parse_fork(b: &[u8]) -> Fork {
+    let mut f = Fork {
+        size: be64(b, 0),
+        blocks: be32(b, 12),
+        extents: vec![],
+    };
+    for i in 0..8 {
+        let (s, c) = (be32(b, 16 + i * 8), be32(b, 20 + i * 8));
+        if c != 0 {
+            f.extents.push((s, c));
+        }
+    }
+    f
+}
+
+/// Posição do volume HFS+ dentro da partição (wrapper HFS clássico) ou `None` se não for HFS+.
+pub fn locate(src: &dyn Source, base: u64) -> Option<u64> {
+    let h = read_vec(src, base + 1024, 512).ok()?;
+    if h.len() < 512 {
+        return None;
+    }
+    match &h[0..2] {
+        b"H+" | b"HX" => Some(base),
+        b"BD" if &h[124..126] == b"H+" => {
+            let alblk = be32(&h, 20) as u64;
+            let alblst = be16(&h, 28) as u64;
+            let start = be16(&h, 126) as u64;
+            Some(base + alblst * 512 + start * alblk)
+        }
+        _ => None,
+    }
+}
+
+struct Vol<'a> {
+    src: &'a dyn Source,
+    base: u64,
+    bs: u64,
+    total: u64,
+    catalog: Fork,
+    extents_file: Fork,
+    alloc: Fork,
+    next_cnid: u32,
+    journal_info: u32,
+}
+
+impl<'a> Vol<'a> {
+    fn open(src: &'a dyn Source, base: u64) -> Option<Vol<'a>> {
+        let h = read_vec(src, base + 1024, 512).ok()?;
+        if h.len() < 512 || !(&h[0..2] == b"H+" || &h[0..2] == b"HX") {
+            return None;
+        }
+        let bs = be32(&h, 40) as u64;
+        if bs < 512 || !bs.is_power_of_two() {
+            return None;
+        }
+        Some(Vol {
+            src,
+            base,
+            bs,
+            total: be32(&h, 44) as u64,
+            alloc: parse_fork(&h[112..192]),
+            extents_file: parse_fork(&h[192..272]),
+            catalog: parse_fork(&h[272..352]),
+            next_cnid: be32(&h, 64),
+            journal_info: be32(&h, 12),
+        })
+    }
+
+    fn block_off(&self, b: u64) -> u64 {
+        self.base + b * self.bs
+    }
+
+    /// Todas as extensões de um fork (inclusive as do arquivo de overflow).
+    fn fork_extents(&self, f: &Fork, file_id: u32, fork_type: u8) -> Vec<Extent> {
+        let mut ex: Vec<(u32, u32)> = f.extents.clone();
+        let mut have: u64 = ex.iter().map(|e| e.1 as u64).sum();
+        if have < f.blocks as u64 && file_id >= 2 {
+            ex.extend(self.overflow_extents(file_id, fork_type, have as u32));
+            have = ex.iter().map(|e| e.1 as u64).sum();
+            let _ = have;
+        }
+        merge_extents(
+            ex.into_iter()
+                .map(|(s, c)| Extent::new(self.block_off(s as u64), c as u64 * self.bs))
+                .collect::<Vec<_>>(),
+        )
+        .into_iter()
+        .collect()
+    }
+
+    /// Extensões além das oito iniciais, procuradas no arquivo de overflow (árvore B+).
+    fn overflow_extents(&self, file_id: u32, fork_type: u8, mut start: u32) -> Vec<(u32, u32)> {
+        let mut out = vec![];
+        let node_size = match self.tree_node_size(&self.extents_file) {
+            Some(n) => n,
+            None => return out,
+        };
+        let total_nodes = self.extents_file.size / node_size as u64;
+        for n in 1..total_nodes.min(100_000) {
+            let Some(node) = self.read_tree_node(&self.extents_file, n as u32, node_size) else {
+                continue;
+            };
+            if node[8] != 0xFF {
+                continue;
+            }
+            for r in records(&node) {
+                // chave: keyLength u16, forkType u8, pad u8, fileID u32, startBlock u32
+                if r.len() < 12 + 64 || be16(r, 0) != 10 {
+                    continue;
+                }
+                if r[2] == fork_type && be32(r, 4) == file_id && be32(r, 8) == start {
+                    let mut got = 0;
+                    for i in 0..8 {
+                        let (s, c) = (be32(r, 12 + i * 8), be32(r, 16 + i * 8));
+                        if c != 0 {
+                            out.push((s, c));
+                            got += c;
+                        }
+                    }
+                    start += got;
+                }
+            }
+        }
+        out
+    }
+
+    fn tree_node_size(&self, f: &Fork) -> Option<usize> {
+        let first = self.read_fork_bytes(f, 0, 64)?;
+        let ns = be16(&first, 32) as usize;
+        (512..=65536).contains(&ns).then_some(ns)
+    }
+
+    fn read_tree_node(&self, f: &Fork, n: u32, ns: usize) -> Option<Vec<u8>> {
+        self.read_fork_bytes(f, n as u64 * ns as u64, ns)
+    }
+
+    /// Lê bytes de um fork que tem só extensões iniciais ou overflow já resolvido (para árvores).
+    fn read_fork_bytes(&self, f: &Fork, off: u64, len: usize) -> Option<Vec<u8>> {
+        let mut out = Vec::with_capacity(len);
+        let mut pos = 0u64;
+        for &(s, c) in &f.extents {
+            let elen = c as u64 * self.bs;
+            if off + out.len() as u64 >= pos && off + (out.len() as u64) < pos + elen {
+                let within = off + out.len() as u64 - pos;
+                let n = ((elen - within) as usize).min(len - out.len());
+                out.extend(read_vec(self.src, self.block_off(s as u64) + within, n).ok()?);
+                if out.len() == len {
+                    return Some(out);
+                }
+            }
+            pos += elen;
+        }
+        (out.len() == len).then_some(out)
+    }
+}
+
+/// Registros de um nó B+ (fatias, da chave em diante).
+fn records(node: &[u8]) -> Vec<&[u8]> {
+    let n = be16(node, 10) as usize;
+    let mut offs = vec![];
+    for i in 0..=n {
+        let p = node.len().saturating_sub(2 * (i + 1));
+        offs.push(be16(node, p) as usize);
+    }
+    let mut out = vec![];
+    for i in 0..n {
+        let (a, b) = (offs[i], offs[i + 1]);
+        if a >= 14 && b > a && b <= node.len() {
+            out.push(&node[a..b]);
+        }
+    }
+    out
+}
+
+fn utf16be(b: &[u8]) -> String {
+    let u: Vec<u16> = b
+        .chunks_exact(2)
+        .map(|c| u16::from_be_bytes([c[0], c[1]]))
+        .collect();
+    String::from_utf16_lossy(&u)
+        .replace('/', "_")
+        .replace(':', "/")
+}
+
+struct CatFile {
+    parent: u32,
+    name: String,
+    id: u32,
+    data: Fork,
+    created: u32,
+    modified: u32,
+    accessed: u32,
+    stale: bool,
+}
+
+fn date(d: u32) -> Option<i64> {
+    (d != 0).then(|| d as i64 - HFS_EPOCH)
+}
+
+/// Decodifica um registro do catálogo (chave + dados). `max_id` descarta lixo.
+fn decode_record(
+    r: &[u8],
+    max_id: u32,
+    files: &mut Vec<CatFile>,
+    threads: &mut HashMap<u32, (u32, String)>,
+    folders: &mut HashMap<(u32, String), u32>,
+    stale: bool,
+) {
+    let klen = be16(r, 0) as usize;
+    if klen < 6 || klen + 2 > r.len() {
+        return;
+    }
+    let parent = be32(r, 2);
+    let nlen = be16(r, 6) as usize;
+    if nlen > 255 || klen != 6 + nlen * 2 && klen != 6 {
+        return;
+    }
+    let name = utf16be(r.get(8..8 + nlen * 2).unwrap_or(&[]));
+    let mut d = 2 + klen;
+    if d % 2 == 1 {
+        d += 1;
+    }
+    let Some(rec) = r.get(d..) else { return };
+    match be16(rec, 0) {
+        1 if rec.len() >= 88 => {
+            let id = be32(rec, 8);
+            if id >= 2 && id < max_id.max(16) {
+                folders.entry((parent, name)).or_insert(id);
+            }
+        }
+        3 if rec.len() >= 10 => {
+            // thread de pasta: chave = (id da pasta, ""); dados = (pai, nome)
+            let pn = be16(rec, 8) as usize;
+            if pn <= 255 {
+                threads.entry(parent).or_insert((
+                    be32(rec, 4),
+                    utf16be(rec.get(10..10 + pn * 2).unwrap_or(&[])),
+                ));
+            }
+        }
+        2 if rec.len() >= 248 => {
+            let id = be32(rec, 8);
+            if id < 16 || id >= max_id.max(16) {
+                return;
+            }
+            let data = parse_fork(&rec[88..168]);
+            files.push(CatFile {
+                parent,
+                name,
+                id,
+                data,
+                created: be32(rec, 12),
+                modified: be32(rec, 16),
+                accessed: be32(rec, 24),
+                stale,
+            });
+        }
+        4 if rec.len() >= 10 => {
+            let pn = be16(rec, 8) as usize;
+            if pn <= 255 {
+                threads.entry(parent).or_insert((
+                    be32(rec, 4),
+                    utf16be(rec.get(10..10 + pn * 2).unwrap_or(&[])),
+                ));
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Procura registros de arquivo nas sobras de um nó (entre os dados e a tabela de offsets).
+fn scan_slack(
+    node: &[u8],
+    max_id: u32,
+    files: &mut Vec<CatFile>,
+    threads: &mut HashMap<u32, (u32, String)>,
+    folders: &mut HashMap<(u32, String), u32>,
+) {
+    let n = be16(node, 10) as usize;
+    let table = node.len().saturating_sub(2 * (n + 1));
+    let used_end = (be16(node, table) as usize).max(14);
+    let mut p = used_end + (used_end % 2);
+    while p + 40 < table {
+        let klen = be16(node, p) as usize;
+        let nlen = be16(node, p + 6) as usize;
+        if klen == 6 + nlen * 2 && (1..=255).contains(&nlen) && p + 2 + klen + 2 < table {
+            let parent = be32(node, p + 2);
+            if parent >= 1 && parent < max_id.max(16) {
+                let d = (p + 2 + klen + 1) & !1;
+                let rt = be16(node, d);
+                if matches!(rt, 1..=4) {
+                    let end = (d + 248).min(table);
+                    decode_record(&node[p..end], max_id, files, threads, folders, true);
+                    p = d + if rt == 2 { 248 } else { 16 };
+                    continue;
+                }
+            }
+        }
+        p += 2;
+    }
+}
+
+pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
+    let mut res = VolumeScan::default();
+    let _ = part_len;
+    let Some(vbase) = locate(ctx.src, base) else {
+        return res;
+    };
+    let Some(vol) = Vol::open(ctx.src, vbase) else {
+        return res;
+    };
+
+    // Mapa de espaço livre.
+    if let Some(bm) = vol.read_fork_all(&vol.alloc, (vol.total / 8 + 1) as usize) {
+        let mut free = vec![];
+        let mut run: Option<u64> = None;
+        for b in 0..vol.total {
+            let used = bm
+                .get((b / 8) as usize)
+                .map(|x| x >> (7 - (b % 8)) & 1 == 1)
+                .unwrap_or(true);
+            match (used, run) {
+                (false, None) => run = Some(b),
+                (true, Some(s)) => {
+                    free.push(Extent::new(vol.block_off(s), (b - s) * vol.bs));
+                    run = None;
+                }
+                _ => {}
+            }
+        }
+        if let Some(s) = run {
+            free.push(Extent::new(vol.block_off(s), (vol.total - s) * vol.bs));
+        }
+        res.free = Some(merge_extents(free));
+    }
+
+    let Some(ns) = vol.tree_node_size(&vol.catalog) else {
+        res.warnings.push("HFS+: catálogo ilegível.".into());
+        return res;
+    };
+    let Some(hdr) = vol.read_tree_node(&vol.catalog, 0, ns) else {
+        return res;
+    };
+    let first_leaf = be32(&hdr, 24);
+    let max_id = vol.next_cnid.max(16);
+    let mut files: Vec<CatFile> = vec![];
+    let mut threads: HashMap<u32, (u32, String)> = HashMap::new();
+    let mut folders: HashMap<(u32, String), u32> = HashMap::new();
+    let mut live_ids: HashSet<u32> = HashSet::new();
+
+    let mut n = first_leaf;
+    let mut guard = 0;
+    while n != 0 && guard < 5_000_000 {
+        guard += 1;
+        if (ctx.cancelled)() {
+            return res;
+        }
+        let Some(node) = vol.read_tree_node(&vol.catalog, n, ns) else {
+            break;
+        };
+        if node[8] != 0xFF {
+            break;
+        }
+        let mut live_here: Vec<CatFile> = vec![];
+        for r in records(&node) {
+            decode_record(r, max_id, &mut live_here, &mut threads, &mut folders, false);
+        }
+        for f in &live_here {
+            live_ids.insert(f.id);
+        }
+        files.extend(live_here);
+        scan_slack(&node, max_id, &mut files, &mut threads, &mut folders);
+        n = be32(&node, 0);
+    }
+
+    // Diário: cópias antigas de nós folha do catálogo.
+    if vol.journal_info != 0 {
+        scan_journal(
+            &vol,
+            ns,
+            max_id,
+            &mut files,
+            &mut threads,
+            &mut folders,
+            ctx,
+        );
+    }
+
+    // Caminho de cada pasta a partir dos threads.
+    let path_of = |parent: u32| -> String {
+        let mut parts = vec![];
+        let mut cur = parent;
+        for _ in 0..64 {
+            if cur <= 2 {
+                break;
+            }
+            match threads.get(&cur) {
+                Some((p, name)) => {
+                    parts.push(name.clone());
+                    cur = *p;
+                }
+                None => break,
+            }
+        }
+        parts.reverse();
+        format!("/{}", parts.join("/"))
+    };
+
+    let free_set = res.free.clone().unwrap_or_default();
+    let mut seen: HashSet<(u32, u64)> = HashSet::new();
+    for f in files
+        .iter()
+        .filter(|f| f.stale && !live_ids.contains(&f.id))
+    {
+        if f.data.size == 0 || f.data.extents.is_empty() {
+            continue;
+        }
+        let ex = vol.fork_extents(&f.data, f.id, 0);
+        let total_len: u64 = ex.iter().map(|e| e.len).sum();
+        if ex.is_empty()
+            || total_len < f.data.size
+            || ex.iter().any(|e| e.end() > vol.base + vol.total * vol.bs)
+        {
+            continue;
+        }
+        if !seen.insert((f.id, ex[0].offset)) {
+            continue;
+        }
+        // Mantém só os bytes do arquivo.
+        let extents = super::fat::trim_extents(ex, f.data.size);
+        // Blocos já reaproveitados?
+        let reused = extents.iter().filter(|e| !covered_by(&free_set, e)).count();
+        let (conf, note) = if reused == 0 {
+            (
+                Confidence::High,
+                "registro apagado do catálogo HFS+; blocos ainda livres".to_string(),
+            )
+        } else {
+            (
+                Confidence::Low,
+                "alguns blocos do arquivo já foram reaproveitados".to_string(),
+            )
+        };
+        let nf = NewFound {
+            name: f.name.clone(),
+            dir: Some(path_of(f.parent)),
+            size: f.data.size,
+            origin: Origin::Hfs,
+            data: DataLoc::Extents { extents },
+            modified: date(f.modified),
+            created: date(f.created),
+            accessed: date(f.accessed),
+            base: conf,
+            note: Some(&note),
+        };
+        let found = make_found(ctx, nf);
+        (ctx.emit)(found);
+    }
+    res
+}
+
+fn covered_by(free: &[Extent], e: &Extent) -> bool {
+    let i = free.partition_point(|f| f.end() <= e.offset);
+    free.get(i)
+        .map(|f| f.offset <= e.offset && f.end() >= e.end())
+        .unwrap_or(false)
+}
+
+impl Vol<'_> {
+    fn read_fork_all(&self, f: &Fork, max: usize) -> Option<Vec<u8>> {
+        let mut out = vec![];
+        for &(s, c) in &f.extents {
+            let n = (c as u64 * self.bs) as usize;
+            out.extend(
+                read_vec(
+                    self.src,
+                    self.block_off(s as u64),
+                    n.min(max.saturating_sub(out.len())),
+                )
+                .ok()?,
+            );
+            if out.len() >= max {
+                break;
+            }
+        }
+        Some(out)
+    }
+}
+
+/// Procura nós folha do catálogo nas transações guardadas no diário.
+fn scan_journal(
+    vol: &Vol,
+    ns: usize,
+    max_id: u32,
+    files: &mut Vec<CatFile>,
+    threads: &mut HashMap<u32, (u32, String)>,
+    folders: &mut HashMap<(u32, String), u32>,
+    ctx: &Ctx,
+) {
+    let Some(info) = read_vec(vol.src, vol.block_off(vol.journal_info as u64), 52)
+        .ok()
+        .filter(|b| b.len() == 52)
+    else {
+        return;
+    };
+    let (joff, jsize) = (be64(&info, 36), be64(&info, 44));
+    if jsize == 0 || jsize > 1 << 30 || vol.base + joff + jsize > vol.src.size() {
+        return;
+    }
+    let mut pos = 0u64;
+    let chunk = 4 << 20;
+    while pos < jsize {
+        if (ctx.cancelled)() {
+            return;
+        }
+        let n = chunk.min(jsize - pos) as usize;
+        let Ok(buf) = read_vec(vol.src, vol.base + joff + pos, n + ns) else {
+            break;
+        };
+        let mut i = 0;
+        while i + ns <= buf.len().min(n + ns) && i < n {
+            let nd = &buf[i..i + ns];
+            // nó folha do catálogo: kind = -1, altura 1, registros plausíveis
+            if nd[8] == 0xFF && nd[9] == 1 && be16(nd, 10) > 0 && (be16(nd, 10) as usize) < ns / 8 {
+                let table = ns - 2 * (be16(nd, 10) as usize + 1);
+                if (be16(nd, ns - 2) as usize) == 14
+                    && be16(nd, table) as usize > 14
+                    && (be16(nd, table) as usize) <= table
+                {
+                    for r in records(nd) {
+                        decode_record(r, max_id, files, threads, folders, true);
+                    }
+                    scan_slack(nd, max_id, files, threads, folders);
+                }
+            }
+            i += 512;
+        }
+        pos += n as u64;
+    }
+}
@@ -4,10 +4,14 @@
 //! devolve os extents ainda alocados ("live") para o carving pular e, quando
 //! possível, os trechos livres.

+pub mod apfs;
+pub mod btrfs;
 pub mod exfat;
 pub mod ext;
 pub mod fat;
+pub mod hfsplus;
 pub mod ntfs;
+pub mod xfs;

 use crate::signatures::{category_for_ext, matches_ext};
 use crate::source::{read_vec, Source};
@@ -65,6 +69,7 @@ pub fn make_found(ctx: &Ctx, n: NewFound) -> Found {
    let mut note = n.note.map(String::from);
    let head: Vec<u8> = match &n.data {
        DataLoc::Resident { bytes } => bytes.iter().take(32).copied().collect(),
+        DataLoc::Parts { .. } => vec![],
        DataLoc::Extents { extents } => extents
            .iter()
            .find(|e| !e.sparse)
@@ -0,0 +1,550 @@
+//! XFS (v4 e v5): mapa de espaço livre pela árvore de blocos livres de cada grupo de alocação e
+//! arquivos apagados. Ao liberar um inode, o XFS zera o modo e o tamanho mas não apaga a lista de
+//! extents que ficou dentro do inode; e a entrada de diretório liberada perde só os 4 primeiros
+//! bytes (o número do inode), preservando o nome. Juntamos as duas sobras.
+
+use super::{make_found, merge_extents, Ctx, NewFound, VolumeScan};
+use crate::signatures;
+use crate::source::{read_vec, Source};
+use crate::types::{Confidence, DataLoc, Extent, Origin};
+use std::collections::{HashMap, HashSet};
+
+fn be16(b: &[u8], o: usize) -> u16 {
+    b.get(o..o + 2)
+        .map(|s| u16::from_be_bytes([s[0], s[1]]))
+        .unwrap_or(0)
+}
+fn be32(b: &[u8], o: usize) -> u32 {
+    b.get(o..o + 4)
+        .map(|s| u32::from_be_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+fn be64(b: &[u8], o: usize) -> u64 {
+    b.get(o..o + 8)
+        .map(|s| u64::from_be_bytes(s.try_into().unwrap()))
+        .unwrap_or(0)
+}
+
+struct Xfs<'a> {
+    src: &'a dyn Source,
+    base: u64,
+    bs: u64,
+    agblocks: u64,
+    agcount: u64,
+    inodesize: u64,
+    inopblog: u32,
+    agblklog: u32,
+    sectsize: u64,
+    v5: bool,
+    ftype: bool,
+    root_ino: u64,
+    dblocks: u64,
+}
+
+impl<'a> Xfs<'a> {
+    fn open(src: &'a dyn Source, base: u64) -> Option<Xfs<'a>> {
+        let sb = read_vec(src, base, 512).ok()?;
+        if sb.len() < 512 || &sb[0..4] != b"XFSB" {
+            return None;
+        }
+        let ver = be16(&sb, 100) & 0xF;
+        let bs = be32(&sb, 4) as u64;
+        let agblocks = be32(&sb, 84) as u64;
+        let agcount = be32(&sb, 88) as u64;
+        let inodesize = be16(&sb, 104) as u64;
+        if !(512..=65536).contains(&bs)
+            || !bs.is_power_of_two()
+            || agblocks == 0
+            || agcount == 0
+            || !(256..=2048).contains(&inodesize)
+        {
+            return None;
+        }
+        let incompat = be32(&sb, 216);
+        let features2 = be32(&sb, 200);
+        let v5 = ver == 5;
+        Some(Xfs {
+            src,
+            base,
+            bs,
+            agblocks,
+            agcount,
+            inodesize,
+            inopblog: sb[123] as u32,
+            agblklog: sb[124] as u32,
+            sectsize: be16(&sb, 102) as u64,
+            v5,
+            ftype: if v5 {
+                incompat & 1 != 0
+            } else {
+                features2 & 0x200 != 0
+            },
+            root_ino: be64(&sb, 56),
+            dblocks: be64(&sb, 8),
+        })
+    }
+
+    fn ag_off(&self, agno: u64) -> u64 {
+        self.base + agno * self.agblocks * self.bs
+    }
+
+    /// Endereço físico de um bloco "fsblock" (agno << agblklog | agbno).
+    fn fsb_off(&self, fsb: u64) -> Option<u64> {
+        let (agno, agbno) = (fsb >> self.agblklog, fsb & ((1 << self.agblklog) - 1));
+        (agno < self.agcount && agbno < self.agblocks).then(|| self.ag_off(agno) + agbno * self.bs)
+    }
+
+    fn ino_off(&self, ino: u64) -> Option<u64> {
+        let shift = self.agblklog + self.inopblog;
+        let agno = ino >> shift;
+        let agbno = (ino >> self.inopblog) & ((1 << self.agblklog) - 1);
+        let idx = ino & ((1 << self.inopblog) - 1);
+        (agno < self.agcount && agbno < self.agblocks)
+            .then(|| self.ag_off(agno) + agbno * self.bs + idx * self.inodesize)
+    }
+
+    fn read_ino(&self, ino: u64) -> Option<Vec<u8>> {
+        let b = read_vec(self.src, self.ino_off(ino)?, self.inodesize as usize).ok()?;
+        (b.len() as u64 == self.inodesize && &b[0..2] == b"IN").then_some(b)
+    }
+
+    fn core_size(&self, ino: &[u8]) -> usize {
+        if ino[4] >= 3 {
+            176
+        } else {
+            100
+        }
+    }
+
+    /// Extents de um inode com a lista no próprio inode (formato 2) ou em árvore (formato 3).
+    fn extents_of(&self, ino: &[u8], max_blocks: u64) -> Vec<(u64, u64, u64)> {
+        let fmt = ino[5];
+        let start = self.core_size(ino);
+        let fork_end = if ino[82] != 0 {
+            start.max(100 + ino[82] as usize * 8)
+        } else {
+            self.inodesize as usize
+        };
+        let lit = &ino[start..fork_end.min(ino.len())];
+        let mut out = vec![];
+        match fmt {
+            2 => {
+                let n = (be32(ino, 76) as usize).min(lit.len() / 16);
+                for i in 0..n {
+                    out.push(unpack_extent(&lit[i * 16..i * 16 + 16]));
+                }
+            }
+            3 => {
+                // raiz da árvore de extents no inode: nível, nregistros, chaves e ponteiros
+                let level = be16(lit, 0) as usize;
+                let nrecs = be16(lit, 2) as usize;
+                let maxrecs = (lit.len() - 4) / 16;
+                let ptrs = 4 + maxrecs * 8;
+                for i in 0..nrecs.min(maxrecs) {
+                    let fsb = be64(lit, ptrs + i * 8);
+                    self.walk_bmbt(fsb, level - 1, &mut out, 0);
+                }
+            }
+            _ => {}
+        }
+        out.retain(|e| e.2 > 0 && e.2 <= max_blocks);
+        out
+    }
+
+    fn walk_bmbt(&self, fsb: u64, level: usize, out: &mut Vec<(u64, u64, u64)>, depth: u32) {
+        if depth > 6 || out.len() > 1_000_000 {
+            return;
+        }
+        let Some(off) = self.fsb_off(fsb) else { return };
+        let Ok(b) = read_vec(self.src, off, self.bs as usize) else {
+            return;
+        };
+        if b.len() < 24 || !(&b[0..4] == b"BMAP" || &b[0..4] == b"BMA3") {
+            return;
+        }
+        let hdr = if self.v5 { 72 } else { 24 };
+        let numrecs = be16(&b, 6) as usize;
+        if level == 0 {
+            for i in 0..numrecs {
+                if let Some(r) = b.get(hdr + i * 16..hdr + i * 16 + 16) {
+                    out.push(unpack_extent(r));
+                }
+            }
+        } else {
+            let maxrecs = (self.bs as usize - hdr) / 16;
+            let ptrs = hdr + maxrecs * 8;
+            for i in 0..numrecs {
+                self.walk_bmbt(be64(&b, ptrs + i * 8), level - 1, out, depth + 1);
+            }
+        }
+    }
+}
+
+/// Registro de extent empacotado em 128 bits: flag(1) | início no arquivo(54) | bloco(52) | quantidade(21).
+fn unpack_extent(r: &[u8]) -> (u64, u64, u64) {
+    let hi = u64::from_be_bytes(r[0..8].try_into().unwrap());
+    let lo = u64::from_be_bytes(r[8..16].try_into().unwrap());
+    let startoff = (hi >> 9) & ((1 << 54) - 1);
+    let startblock = ((hi & 0x1FF) << 43) | (lo >> 21);
+    let count = lo & 0x1F_FFFF;
+    (startoff, startblock, count)
+}
+
+/// Percorre as folhas de uma árvore B+ curta, entregando cada registro de 16 (inobt) ou 8 (bnobt) bytes.
+fn walk_short_btree(
+    x: &Xfs,
+    agno: u64,
+    root: u64,
+    levels: u32,
+    rec: usize,
+    key_size: usize,
+    f: &mut dyn FnMut(&[u8]),
+) {
+    let mut cur = root;
+    // desce pela esquerda até a folha
+    for lvl in (1..levels).rev() {
+        let Ok(b) = read_vec(x.src, x.ag_off(agno) + cur * x.bs, x.bs as usize) else {
+            return;
+        };
+        if b.len() < 24 {
+            return;
+        }
+        let hdr = if x.v5 { 56 } else { 16 };
+        let maxrecs = (x.bs as usize - hdr) / (key_size + 4);
+        let ptrs = hdr + maxrecs * key_size;
+        let _ = lvl;
+        cur = be32(&b, ptrs) as u64;
+    }
+    let mut seen = HashSet::new();
+    while cur != 0 && cur != u32::MAX as u64 && seen.insert(cur) {
+        let Ok(b) = read_vec(x.src, x.ag_off(agno) + cur * x.bs, x.bs as usize) else {
+            return;
+        };
+        if b.len() < 24 {
+            return;
+        }
+        let hdr = if x.v5 { 56 } else { 16 };
+        let n = be16(&b, 6) as usize;
+        for i in 0..n {
+            if let Some(r) = b.get(hdr + i * rec..hdr + (i + 1) * rec) {
+                f(r);
+            }
+        }
+        cur = be32(&b, 12) as u64; // rightsib
+    }
+}
+
+pub fn scan(ctx: &mut Ctx, base: u64, part_len: u64) -> VolumeScan {
+    let _ = part_len;
+    let mut res = VolumeScan::default();
+    let Some(x) = Xfs::open(ctx.src, base) else {
+        return res;
+    };
+
+    // Espaço livre por grupo e inodes livres.
+    let mut free: Vec<Extent> = vec![];
+    let mut free_set: Vec<(u64, u64)> = vec![]; // (fsblock inicial, quantidade) para checar blocos
+    let mut chunks: Vec<(u64, u64, u64)> = vec![]; // (agno, startino, máscara livre)
+    for agno in 0..x.agcount {
+        if (ctx.cancelled)() {
+            return res;
+        }
+        let agf = read_vec(ctx.src, x.ag_off(agno) + x.sectsize, 64).unwrap_or_default();
+        if agf.len() >= 64 && &agf[0..4] == b"XAGF" {
+            let (root, levels) = (be32(&agf, 16) as u64, be32(&agf, 28));
+            walk_short_btree(&x, agno, root, levels, 8, 8, &mut |r| {
+                let (s, c) = (be32(r, 0) as u64, be32(r, 4) as u64);
+                free.push(Extent::new(x.ag_off(agno) + s * x.bs, c * x.bs));
+                free_set.push(((agno << x.agblklog) | s, c));
+            });
+        }
+        let agi = read_vec(ctx.src, x.ag_off(agno) + 2 * x.sectsize, 64).unwrap_or_default();
+        if agi.len() >= 64 && &agi[0..4] == b"XAGI" {
+            let (root, levels) = (be32(&agi, 20) as u64, be32(&agi, 24));
+            walk_short_btree(&x, agno, root, levels, 16, 4, &mut |r| {
+                chunks.push((agno, be32(r, 0) as u64, be64(r, 8)));
+            });
+        }
+        (ctx.progress)(agno, x.agcount);
+    }
+    free.sort_by_key(|e| e.offset);
+    let free = merge_extents(free);
+    res.free = Some(free.clone());
+    free_set.sort();
+    let is_free = |fsb: u64, count: u64| -> bool {
+        let i = free_set.partition_point(|&(s, c)| s + c <= fsb);
+        free_set
+            .get(i)
+            .is_some_and(|&(s, c)| s <= fsb && s + c >= fsb + count)
+    };
+
+    // Nomes: entradas de diretório liberadas (guardam o nome e os 4 bytes baixos do inode).
+    let (live_dirs, stale_names) = collect_names(&x, ctx);
+
+    // Inodes livres com a lista de extents ainda dentro do inode.
+    let max_blocks = x.dblocks;
+    let mut seen_first: HashSet<u64> = HashSet::new();
+    for (agno, startino, mask) in &chunks {
+        if (ctx.cancelled)() {
+            return res;
+        }
+        for i in 0..64u64 {
+            if mask >> i & 1 == 0 {
+                continue; // em uso
+            }
+            let ino = (agno << (x.agblklog + x.inopblog)) | (startino + i);
+            let Some(raw) = x.read_ino(ino) else { continue };
+            let mode = be16(&raw, 2);
+            if mode != 0 && be32(&raw, 16) != 0 {
+                continue;
+            }
+            // Só inodes que foram arquivos: o formato de extents continua gravado e há sobras.
+            if raw[5] != 2 {
+                continue;
+            }
+            let start = x.core_size(&raw);
+            let lit = &raw[start..];
+            // lê registros plausíveis em sequência
+            let mut ext: Vec<(u64, u64, u64)> = vec![];
+            let mut next_off = 0u64;
+            for k in 0..lit.len() / 16 {
+                let e = unpack_extent(&lit[k * 16..k * 16 + 16]);
+                let valid = e.2 > 0
+                    && e.2 < 1 << 21
+                    && e.0 == next_off
+                    && x.fsb_off(e.1).is_some()
+                    && (e.1 & ((1 << x.agblklog) - 1)) + e.2 <= x.agblocks;
+                if !valid {
+                    break;
+                }
+                next_off = e.0 + e.2;
+                ext.push(e);
+            }
+            if ext.is_empty() {
+                continue;
+            }
+            let total_blocks: u64 = ext.iter().map(|e| e.2).sum();
+            if total_blocks > max_blocks {
+                continue;
+            }
+            let all_free = ext.iter().all(|e| is_free(e.1, e.2));
+            let extents: Vec<Extent> = ext
+                .iter()
+                .filter_map(|e| x.fsb_off(e.1).map(|o| Extent::new(o, e.2 * x.bs)))
+                .collect();
+            if extents.is_empty() || !seen_first.insert(extents[0].offset) {
+                continue;
+            }
+            let mut size = total_blocks * x.bs;
+            let mut conf = if all_free {
+                Confidence::High
+            } else {
+                Confidence::Low
+            };
+            let mut note = if all_free {
+                "inode XFS liberado; lista de extents recuperada do próprio inode".to_string()
+            } else {
+                "blocos do arquivo já reaproveitados".to_string()
+            };
+            // tamanho exato: tenta achar o fim real pelo conteúdo
+            let mut est = true;
+            if let Some(h) = read_vec(ctx.src, extents[0].offset, 128)
+                .ok()
+                .and_then(|head| signatures::detect(ctx.src, extents[0].offset, &head, size))
+            {
+                if h.len > 0 && h.len <= size {
+                    size = h.len;
+                    est = false;
+                }
+            }
+            if est {
+                conf = conf.min(Confidence::Medium);
+                note.push_str("; tamanho exato perdido: usando todos os blocos");
+            }
+            let extents = super::fat::trim_extents(extents, size);
+            let low = ino & 0xFFFF_FFFF;
+            let (dir, name) = match stale_names.get(&low) {
+                Some((parent, n)) => (
+                    Some(live_dirs.get(parent).cloned().unwrap_or_default()),
+                    n.clone(),
+                ),
+                None => (None, format!("inode_{ino}")),
+            };
+            let ts = |s: u32| (s != 0).then_some(s as i64);
+            let nf = NewFound {
+                name,
+                dir,
+                size,
+                origin: Origin::Xfs,
+                data: DataLoc::Extents { extents },
+                modified: ts(be32(&raw, 40)),
+                created: if raw[4] >= 3 {
+                    ts(be32(&raw, 144))
+                } else {
+                    None
+                },
+                accessed: ts(be32(&raw, 32)),
+                base: conf,
+                note: Some(&note),
+            };
+            let f = make_found(ctx, nf);
+            (ctx.emit)(f);
+        }
+    }
+    res
+}
+
+/// Percorre os diretórios vivos; devolve (caminho de cada diretório por inode, nome liberado por inode baixo).
+fn collect_names(x: &Xfs, ctx: &Ctx) -> (HashMap<u64, String>, HashMap<u64, (u64, String)>) {
+    let mut paths: HashMap<u64, String> = HashMap::new();
+    let mut stale: HashMap<u64, (u64, String)> = HashMap::new();
+    let mut queue: Vec<(u64, String)> = vec![(x.root_ino, String::new())];
+    let mut seen: HashSet<u64> = HashSet::new();
+    while let Some((dino, path)) = queue.pop() {
+        if !seen.insert(dino) || (ctx.cancelled)() || seen.len() > 200_000 {
+            continue;
+        }
+        let Some(raw) = x.read_ino(dino) else {
+            continue;
+        };
+        if be16(&raw, 2) & 0o170000 != 0o040000 {
+            continue;
+        }
+        paths.insert(dino, path.clone());
+        let start = x.core_size(&raw);
+        match raw[5] {
+            1 => {
+                // pasta curta guardada no inode
+                let lit = &raw[start..];
+                let count = lit[0] as usize;
+                let i8 = lit[1] != 0;
+                let isz = if i8 { 8 } else { 4 };
+                let mut p = 2 + isz;
+                for _ in 0..count.max(lit[1] as usize) {
+                    if p + 3 > lit.len() {
+                        break;
+                    }
+                    let nl = lit[p] as usize;
+                    p += 3;
+                    let name =
+                        String::from_utf8_lossy(lit.get(p..p + nl).unwrap_or(&[])).to_string();
+                    p += nl + if x.ftype { 1 } else { 0 };
+                    let ino = if i8 {
+                        be64(lit, p)
+                    } else {
+                        be32(lit, p) as u64
+                    };
+                    p += isz;
+                    queue.push((ino, format!("{path}/{name}")));
+                }
+            }
+            2 | 3 => {
+                let size = be64(&raw, 56).min(64 << 20);
+                let ex = x.extents_of(&raw, 1 << 20);
+                let _ = size;
+                for (off, fsb, cnt) in ex {
+                    // blocos de dados de diretório ficam antes do offset de 32 GiB (depois vêm folhas e índice)
+                    if off * x.bs >= 32u64 << 30 {
+                        continue;
+                    }
+                    for k in 0..cnt.min(256) {
+                        let Some(o) = x.fsb_off(fsb + k) else {
+                            continue;
+                        };
+                        let Ok(b) = read_vec(x.src, o, x.bs as usize) else {
+                            continue;
+                        };
+                        parse_dir_block(x, &b, dino, &path, &mut queue, &mut stale);
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+    (paths, stale)
+}
+
+fn parse_dir_block(
+    x: &Xfs,
+    b: &[u8],
+    dino: u64,
+    path: &str,
+    queue: &mut Vec<(u64, String)>,
+    stale: &mut HashMap<u64, (u64, String)>,
+) {
+    let magic = &b[0..4];
+    let hdr = match magic {
+        b"XD2B" | b"XD2D" => 16,
+        b"XDB3" | b"XDD3" => 64,
+        _ => return,
+    };
+    let is_block = magic == b"XD2B" || magic == b"XDB3";
+    // em blocos únicos, o final tem a tabela de folhas
+    let end = if is_block {
+        let cnt = be32(b, b.len() - 8) as usize;
+        b.len().saturating_sub(8 + cnt * 8)
+    } else {
+        b.len()
+    };
+    let mut p = hdr;
+    while p + 8 <= end {
+        if be16(b, p) == 0xFFFF {
+            let len = be16(b, p + 2) as usize;
+            if len < 8 || p + len > end {
+                break;
+            }
+            // entrada liberada: sobraram (inode baixo, nome); outras ainda podem estar dentro da região
+            scan_free_region(x, &b[p..p + len], dino, stale);
+            p += len;
+            continue;
+        }
+        let ino = be64(b, p);
+        let nl = b[p + 8] as usize;
+        if nl == 0 {
+            break;
+        }
+        let ft = if x.ftype { 1 } else { 0 };
+        let size = (8 + 1 + nl + ft + 2).div_ceil(8) * 8;
+        if p + size > end {
+            break;
+        }
+        let name = String::from_utf8_lossy(&b[p + 9..p + 9 + nl]).to_string();
+        if name != "." && name != ".." {
+            queue.push((ino, format!("{path}/{name}")));
+        }
+        p += size;
+    }
+}
+
+fn scan_free_region(x: &Xfs, r: &[u8], dir_ino: u64, stale: &mut HashMap<u64, (u64, String)>) {
+    // 1) a primeira entrada perdeu só os 4 primeiros bytes do número do inode
+    let try_at = |p: usize, low: u64, stale: &mut HashMap<u64, (u64, String)>| -> Option<usize> {
+        let nl = *r.get(p + 8)? as usize;
+        let name = r.get(p + 9..p + 9 + nl)?;
+        if nl == 0 || name.iter().any(|&c| c < 0x20 || c == b'/' || c == 0x7F) {
+            return None;
+        }
+        stale
+            .entry(low)
+            .or_insert((dir_ino, String::from_utf8_lossy(name).to_string()));
+        Some((8 + 1 + nl + if x.ftype { 1 } else { 0 } + 2).div_ceil(8) * 8)
+    };
+    if r.len() >= 16 {
+        let low = be32(r, 4) as u64;
+        if let Some(sz) = try_at(0, low, stale) {
+            // entradas seguintes dentro da mesma região, com o inode inteiro
+            let mut p = sz;
+            while p + 16 <= r.len() {
+                let ino = be64(r, p);
+                if ino == 0 || ino > 1 << 56 {
+                    p += 8;
+                    continue;
+                }
+                match try_at(p, ino & 0xFFFF_FFFF, stale) {
+                    Some(s) => p += s,
+                    None => p += 8,
+                }
+            }
+        }
+    }
+}
@@ -15,6 +15,37 @@ pub struct Health {
    pub summary: String,
    pub details: Vec<(String, String)>,
    pub advice: Vec<String>,
+    /// Ficha do dispositivo, no estilo do CrystalDiskInfo (modelo, firmware, interface...).
+    pub info: Vec<(String, String)>,
+    /// Saúde estimada em % (SSD: vida útil restante). `None` em HD, que não informa isso.
+    pub health_pct: Option<u8>,
+    pub temperature_c: Option<i64>,
+    pub power_on_hours: Option<i64>,
+    pub power_cycles: Option<i64>,
+    /// Total lido e gravado pelo computador, em bytes, quando o disco informa.
+    pub host_reads: Option<u64>,
+    pub host_writes: Option<u64>,
+    /// Tabela completa de atributos SMART.
+    pub attributes: Vec<Attr>,
+    /// Caminho avaliado de fato (o disco inteiro, quando `path` é uma partição).
+    pub disk: String,
+    /// Partição pedida, quando a avaliação foi feita no disco que a contém.
+    pub partition: Option<String>,
+}
+
+/// Uma linha da tabela de atributos SMART.
+#[derive(Debug, Clone, Serialize, Default)]
+pub struct Attr {
+    /// Identificador em hexadecimal, como o CrystalDiskInfo mostra ("05", "C5").
+    pub id: String,
+    pub name: String,
+    /// Valores normalizados (ATA): atual, pior já visto e limite de falha.
+    pub value: Option<i64>,
+    pub worst: Option<i64>,
+    pub thresh: Option<i64>,
+    pub raw: String,
+    /// "ok", "warning" ou "failing".
+    pub status: String,
 }

 impl Health {
@@ -44,14 +75,47 @@ pub fn check(path: &str) -> Health {
    if !is_dev {
        return Health::unknown("Imagem de disco: não há SMART para avaliar.");
    }
-    let mut h = match run_smartctl(path) {
+    let disk = parent_disk(path);
+    let mut h = match run_smartctl(&disk) {
        Some(v) => parse_smartctl(&v),
        None => Health::unknown("O SMART não pôde ser lido. Instale o pacote smartmontools (comando smartctl) e rode como administrador para ver a saúde do disco."),
    };
    kernel_errors(path, &mut h);
+    if disk != path {
+        h.partition = Some(path.to_string());
+    }
+    h.disk = disk;
    h
 }

+/// O SMART é do disco, não da partição: `/dev/sda1` vira `/dev/sda`,
+/// `/dev/nvme0n1p2` vira `/dev/nvme0n1` e `/dev/disk2s1` vira `/dev/disk2`.
+pub fn parent_disk(path: &str) -> String {
+    #[cfg(target_os = "linux")]
+    {
+        let name = path.trim_start_matches("/dev/");
+        let sys = format!("/sys/class/block/{name}");
+        if std::path::Path::new(&format!("{sys}/partition")).exists() {
+            if let Ok(real) = std::fs::canonicalize(&sys) {
+                if let Some(p) = real.parent().and_then(|p| p.file_name()) {
+                    return format!("/dev/{}", p.to_string_lossy());
+                }
+            }
+        }
+    }
+    #[cfg(target_os = "macos")]
+    {
+        for pre in ["/dev/rdisk", "/dev/disk"] {
+            if let Some(rest) = path.strip_prefix(pre) {
+                if let Some(i) = rest.find('s') {
+                    return format!("{pre}{}", &rest[..i]);
+                }
+            }
+        }
+    }
+    path.to_string()
+}
+
 fn smartctl_name(path: &str) -> String {
    // Windows: \\.\PhysicalDriveN -> /dev/sdX (convenção do smartctl)
    if let Some(n) = path
@@ -70,7 +134,7 @@ fn smartctl_name(path: &str) -> String {
 fn run_smartctl(path: &str) -> Option<Value> {
    let dev = smartctl_name(path);
    let out = Command::new("smartctl")
-        .args(["--json=o", "-H", "-A", "-i", "-l", "error", &dev])
+        .args(["--json=o", "-a", &dev])
        .stdin(Stdio::null())
        .stderr(Stdio::null())
        .output()
@@ -111,6 +175,8 @@ pub fn parse_smartctl(v: &Value) -> Health {
        bad = bad.max(sev);
        h.details.push((k.to_string(), val));
    };
+    fill_info(v, &mut h);
+    fill_attributes(v, &mut h);
    if let Some(m) = v["model_name"].as_str() {
        h.details.push(("Modelo".into(), m.to_string()));
    }
@@ -225,6 +291,9 @@ pub fn parse_smartctl(v: &Value) -> Health {
            }
        }
    }
+    if h.attributes.iter().any(|a| a.status == "failing") {
+        bad = 2;
+    }
    match bad {
        2 => {
            h.status = "failing".into();
@@ -241,6 +310,225 @@ pub fn parse_smartctl(v: &Value) -> Health {
    h
 }

+fn s(v: &Value, p: &str) -> Option<String> {
+    v.pointer(p)
+        .and_then(|x| x.as_str())
+        .map(|x| x.trim().to_string())
+        .filter(|x| !x.is_empty())
+}
+fn n(v: &Value, p: &str) -> Option<i64> {
+    v.pointer(p).and_then(|x| x.as_i64())
+}
+
+/// Ficha do dispositivo e métricas gerais (temperatura, horas, total lido/gravado, saúde %).
+fn fill_info(v: &Value, h: &mut Health) {
+    let mut put = |k: &str, val: Option<String>| {
+        if let Some(val) = val {
+            h.info.push((k.to_string(), val));
+        }
+    };
+    put(
+        "Modelo",
+        s(v, "/model_name").or_else(|| {
+            let a = s(v, "/scsi_vendor")?;
+            Some(format!("{a} {}", s(v, "/scsi_product").unwrap_or_default()))
+        }),
+    );
+    put("Firmware", s(v, "/firmware_version"));
+    put("Nº de série", s(v, "/serial_number"));
+    put("Família", s(v, "/model_family"));
+    let proto = s(v, "/device/protocol");
+    let iface = s(v, "/sata_version/string").or_else(|| {
+        let sp = v
+            .pointer("/nvme_pci_vendor")
+            .map(|_| "NVM Express".to_string());
+        sp.or_else(|| proto.clone())
+    });
+    put("Interface", iface);
+    let speed = |p: &str| s(v, &format!("/interface_speed/{p}/string"));
+    put(
+        "Modo de transferência",
+        match (speed("current"), speed("max")) {
+            (Some(c), Some(m)) if c != m => Some(format!("{c} (máx. {m})")),
+            (Some(c), _) => Some(c),
+            (None, Some(m)) => Some(m),
+            _ => None,
+        },
+    );
+    put(
+        "Capacidade",
+        n(v, "/user_capacity/bytes")
+            .or_else(|| n(v, "/nvme_total_capacity"))
+            .map(|b| decimal_size(b as u64)),
+    );
+    put(
+        "Rotação",
+        n(v, "/rotation_rate").map(|r| {
+            if r == 0 {
+                "SSD (sem rotação)".into()
+            } else {
+                format!("{r} RPM")
+            }
+        }),
+    );
+    put("Formato", s(v, "/form_factor/name"));
+    let mut feats = Vec::new();
+    if v.pointer("/smart_support/enabled") == Some(&Value::Bool(true))
+        || v.get("nvme_smart_health_information_log").is_some()
+    {
+        feats.push("S.M.A.R.T.");
+    }
+    if v.pointer("/trim/supported") == Some(&Value::Bool(true)) {
+        feats.push("TRIM");
+    }
+    if v.pointer("/write_cache/enabled") == Some(&Value::Bool(true)) {
+        feats.push("Cache de gravação");
+    }
+    if v.get("ata_security").and_then(|x| x.get("enabled")) == Some(&Value::Bool(true)) {
+        feats.push("Segurança ATA");
+    }
+    if !feats.is_empty() {
+        put("Recursos", Some(feats.join(", ")));
+    }
+
+    h.temperature_c = n(v, "/temperature/current");
+    h.power_on_hours = n(v, "/power_on_time/hours");
+    h.power_cycles = n(v, "/power_cycle_count");
+    if let Some(l) = v.get("nvme_smart_health_information_log") {
+        // a unidade NVMe vale 1000 setores de 512 bytes
+        h.host_reads = l["data_units_read"].as_u64().map(|u| u * 512_000);
+        h.host_writes = l["data_units_written"].as_u64().map(|u| u * 512_000);
+        h.health_pct = l["percentage_used"]
+            .as_i64()
+            .map(|u| (100 - u.clamp(0, 100)) as u8);
+        h.power_cycles = h.power_cycles.or(l["power_cycles"].as_i64());
+    } else {
+        let lba = n(v, "/logical_block_size").unwrap_or(512) as u64;
+        h.host_reads = attr(v, 242).map(|x| x as u64 * lba);
+        h.host_writes = attr(v, 241).map(|x| x as u64 * lba);
+        // SSD SATA: vida útil restante no valor normalizado de um destes atributos
+        // (231 SSD Life Left, 233 Media Wearout, 177 Wear Leveling, 202 Percent Lifetime Remain)
+        h.health_pct = [231u64, 233, 177, 202, 169]
+            .iter()
+            .find_map(|&id| attr_field(v, id, "value"))
+            .filter(|_| n(v, "/rotation_rate") == Some(0))
+            .map(|x| x.clamp(0, 100) as u8);
+    }
+}
+
+/// Capacidade como o fabricante anuncia (base 1000): "500,1 GB".
+fn decimal_size(b: u64) -> String {
+    let units = ["B", "kB", "MB", "GB", "TB", "PB"];
+    let mut x = b as f64;
+    let mut i = 0;
+    while x >= 1000.0 && i < units.len() - 1 {
+        x /= 1000.0;
+        i += 1;
+    }
+    format!("{x:.1} {}", units[i]).replace('.', ",")
+}
+
+fn attr_field(v: &Value, id: u64, f: &str) -> Option<i64> {
+    v.pointer("/ata_smart_attributes/table")?
+        .as_array()?
+        .iter()
+        .find(|a| a["id"] == id)?
+        .get(f)?
+        .as_i64()
+}
+
+/// Atributos cujo valor bruto acima de zero já é motivo de atenção.
+const RAW_WARN: [u64; 5] = [5, 196, 197, 198, 187];
+
+fn fill_attributes(v: &Value, h: &mut Health) {
+    if let Some(t) = v
+        .pointer("/ata_smart_attributes/table")
+        .and_then(|t| t.as_array())
+    {
+        for a in t {
+            let id = a["id"].as_u64().unwrap_or(0);
+            let value = a["value"].as_i64();
+            let thresh = a["thresh"].as_i64();
+            let raw_n = a
+                .pointer("/raw/value")
+                .and_then(|x| x.as_i64())
+                .unwrap_or(0);
+            let failing = a
+                .pointer("/when_failed")
+                .and_then(|x| x.as_str())
+                .is_some_and(|w| w == "now")
+                || matches!((value, thresh), (Some(v), Some(t)) if t > 0 && v <= t);
+            let status = if failing {
+                "failing"
+            } else if RAW_WARN.contains(&id) && raw_n > 0 {
+                "warning"
+            } else {
+                "ok"
+            };
+            h.attributes.push(Attr {
+                id: format!("{id:02X}"),
+                name: a["name"]
+                    .as_str()
+                    .unwrap_or("Unknown_Attribute")
+                    .replace('_', " "),
+                value,
+                worst: a["worst"].as_i64(),
+                thresh,
+                raw: a
+                    .pointer("/raw/string")
+                    .and_then(|x| x.as_str())
+                    .map(str::to_string)
+                    .unwrap_or_else(|| raw_n.to_string()),
+                status: status.into(),
+            });
+        }
+    }
+    if let Some(l) = v.get("nvme_smart_health_information_log") {
+        // mesma ordem e nomes que o CrystalDiskInfo usa para NVMe
+        let rows: [(u8, &str, &str); 15] = [
+            (1, "Critical Warning", "critical_warning"),
+            (2, "Composite Temperature", "temperature"),
+            (3, "Available Spare", "available_spare"),
+            (4, "Available Spare Threshold", "available_spare_threshold"),
+            (5, "Percentage Used", "percentage_used"),
+            (6, "Data Units Read", "data_units_read"),
+            (7, "Data Units Written", "data_units_written"),
+            (8, "Host Read Commands", "host_reads"),
+            (9, "Host Write Commands", "host_writes"),
+            (10, "Controller Busy Time", "controller_busy_time"),
+            (11, "Power Cycles", "power_cycles"),
+            (12, "Power On Hours", "power_on_hours"),
+            (13, "Unsafe Shutdowns", "unsafe_shutdowns"),
+            (14, "Media and Data Integrity Errors", "media_errors"),
+            (
+                15,
+                "Number of Error Information Log Entries",
+                "num_err_log_entries",
+            ),
+        ];
+        let spare_low = matches!((l["available_spare"].as_i64(), l["available_spare_threshold"].as_i64()), (Some(s), Some(t)) if s < t);
+        for (id, name, key) in rows {
+            let Some(x) = l.get(key).and_then(|x| x.as_i64()) else {
+                continue;
+            };
+            let status = match key {
+                "critical_warning" | "media_errors" if x > 0 => "failing",
+                "available_spare" if spare_low => "failing",
+                "percentage_used" if x >= 100 => "failing",
+                "percentage_used" if x >= 90 => "warning",
+                _ => "ok",
+            };
+            h.attributes.push(Attr {
+                id: format!("{id:02X}"),
+                name: name.into(),
+                raw: x.to_string(),
+                status: status.into(),
+                ..Default::default()
+            });
+        }
+    }
+}
+
 /// Contadores de erro de E/S do kernel (Linux): reforçam o aviso do SMART.
 fn kernel_errors(path: &str, h: &mut Health) {
    #[cfg(target_os = "linux")]
@@ -24,6 +24,111 @@ pub struct ImageReport {
 const BLOCK: usize = 1 << 20;
 const SECTOR: usize = 512;

+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "lowercase")]
+pub enum ImageFormat {
+    #[default]
+    Raw,
+    /// Expert Witness (EnCase 6): `.E01`, dividido em segmentos.
+    E01 {
+        #[serde(default)]
+        case_number: String,
+        #[serde(default)]
+        description: String,
+        #[serde(default)]
+        evidence_number: String,
+        #[serde(default)]
+        examiner: String,
+        #[serde(default)]
+        notes: String,
+        /// Tamanho máximo de cada segmento em MiB (0 = um arquivo só).
+        #[serde(default = "default_segment_mib")]
+        segment_mib: u64,
+        /// 0 = sem compressão, 1 a 9 = deflate.
+        #[serde(default = "default_compression")]
+        compression: u32,
+    },
+    /// AFF4 (padrão v1.0, blocos snappy).
+    Aff4 {
+        #[serde(default)]
+        case_number: String,
+        #[serde(default)]
+        examiner: String,
+        #[serde(default)]
+        evidence_number: String,
+        #[serde(default)]
+        notes: String,
+    },
+}
+
+fn default_segment_mib() -> u64 {
+    1500
+}
+fn default_compression() -> u32 {
+    1
+}
+
+pub fn create_image_as(
+    src: &dyn Source,
+    dest: &Path,
+    format: &ImageFormat,
+    cancelled: &(dyn Fn() -> bool + Sync),
+    progress: &mut dyn FnMut(u64, u64),
+) -> Result<ImageReport> {
+    match format {
+        ImageFormat::Raw => create_image(src, dest, cancelled, progress),
+        ImageFormat::Aff4 {
+            case_number,
+            examiner,
+            evidence_number,
+            notes,
+        } => {
+            let opts = crate::aff4::Aff4Options {
+                case_name: case_number.clone(),
+                examiner: examiner.clone(),
+                notes: notes.clone(),
+                evidence_number: evidence_number.clone(),
+                ..Default::default()
+            };
+            let dest = if dest
+                .extension()
+                .is_some_and(|e| e.eq_ignore_ascii_case("aff4"))
+            {
+                dest.to_path_buf()
+            } else {
+                dest.with_extension("aff4")
+            };
+            crate::aff4::write_aff4(src, &dest, &opts, cancelled, progress)
+        }
+        ImageFormat::E01 {
+            case_number,
+            description,
+            evidence_number,
+            examiner,
+            notes,
+            segment_mib,
+            compression,
+        } => {
+            let opts = crate::ewf::E01Options {
+                case_number: case_number.clone(),
+                description: description.clone(),
+                evidence_number: evidence_number.clone(),
+                examiner: examiner.clone(),
+                notes: notes.clone(),
+                segment_size: segment_mib * 1024 * 1024,
+                compression: *compression,
+                ..Default::default()
+            };
+            // O destino pode vir com ou sem a extensão .E01.
+            let base = match dest.extension().and_then(|e| e.to_str()) {
+                Some(e) if e.eq_ignore_ascii_case("e01") => dest.with_extension(""),
+                _ => dest.to_path_buf(),
+            };
+            crate::ewf::write_e01(src, &base, &opts, cancelled, progress)
+        }
+    }
+}
+
 pub fn create_image(
    src: &dyn Source,
    dest: &Path,
@@ -0,0 +1,664 @@
+//! Decodificador de entropia de JPEG sequencial (Huffman, 8 bits), sem IDCT.
+//!
+//! Serve para validar se os bytes de um JPEG são realmente contínuos e para reconstruir arquivos
+//! fragmentados: o fluxo é decodificado MCU a MCU, guardando o DC de luminância (uma miniatura
+//! 1/8 da imagem) e pontos de retomada. Depois de uma quebra os bytes viram lixo, e a
+//! descontinuidade do DC (ou um erro de código) denuncia onde.
+
+#[derive(Clone, Debug)]
+struct Huff {
+    // decodificação canônica
+    mincode: [i32; 17],
+    maxcode: [i32; 18],
+    valptr: [i32; 17],
+    vals: Vec<u8>,
+}
+
+impl Huff {
+    fn new(counts: &[u8; 16], vals: Vec<u8>) -> Huff {
+        let mut h = Huff {
+            mincode: [0; 17],
+            maxcode: [-1; 18],
+            valptr: [0; 17],
+            vals,
+        };
+        let mut code = 0i32;
+        let mut k = 0i32;
+        for l in 1..=16 {
+            h.valptr[l] = k;
+            h.mincode[l] = code;
+            code += counts[l - 1] as i32;
+            k += counts[l - 1] as i32;
+            h.maxcode[l] = if counts[l - 1] > 0 { code - 1 } else { -1 };
+            code <<= 1;
+        }
+        h.maxcode[17] = i32::MAX;
+        h
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct Comp {
+    pub h: u8,
+    pub v: u8,
+    pub tq: usize,
+    pub dc_tbl: usize,
+    pub ac_tbl: usize,
+}
+
+#[derive(Clone, Debug)]
+pub struct Header {
+    pub width: u32,
+    pub height: u32,
+    pub comps: Vec<Comp>,
+    pub restart: u32,
+    pub mcus_x: u32,
+    pub mcus_y: u32,
+    /// Onde começam os dados entropy-coded (depois do SOS).
+    pub scan_start: usize,
+    /// Tabelas de quantização (ordem zigzag).
+    pub qt: [[u16; 64]; 4],
+    dc: [Option<Huff>; 4],
+    ac: [Option<Huff>; 4],
+}
+
+impl Header {
+    pub fn total_mcus(&self) -> u32 {
+        self.mcus_x * self.mcus_y
+    }
+}
+
+/// Lê os segmentos até o SOS. `None` se não for JPEG sequencial suportado.
+pub fn parse_header(d: &[u8]) -> Option<Header> {
+    if d.len() < 4 || d[0] != 0xFF || d[1] != 0xD8 {
+        return None;
+    }
+    let mut p = 2;
+    let mut dc: [Option<Huff>; 4] = Default::default();
+    let mut ac: [Option<Huff>; 4] = Default::default();
+    let mut sof: Option<(u32, u32, Vec<(u8, u8, usize)>)> = None;
+    let mut qt = [[1u16; 64]; 4];
+    let mut restart = 0u32;
+    while p + 4 <= d.len() {
+        if d[p] != 0xFF {
+            return None;
+        }
+        let m = d[p + 1];
+        if m == 0xFF {
+            p += 1;
+            continue;
+        }
+        if (0xD0..=0xD8).contains(&m) || m == 0x01 {
+            p += 2;
+            continue;
+        }
+        let len = u16::from_be_bytes([d[p + 2], d[p + 3]]) as usize;
+        if len < 2 || p + 2 + len > d.len() {
+            return None;
+        }
+        let seg = &d[p + 4..p + 2 + len];
+        match m {
+            0xC0 | 0xC1 => {
+                if seg.len() < 6 || seg[0] != 8 {
+                    return None;
+                }
+                let h = u16::from_be_bytes([seg[1], seg[2]]) as u32;
+                let w = u16::from_be_bytes([seg[3], seg[4]]) as u32;
+                let n = seg[5] as usize;
+                if n == 0 || n > 4 || seg.len() < 6 + n * 3 || w == 0 || h == 0 {
+                    return None;
+                }
+                let comps = (0..n)
+                    .map(|i| {
+                        (
+                            seg[7 + i * 3] >> 4,
+                            seg[7 + i * 3] & 15,
+                            seg[8 + i * 3] as usize & 3,
+                        )
+                    })
+                    .collect();
+                sof = Some((w, h, comps));
+            }
+            0xC2 | 0xC3 | 0xC5..=0xC7 | 0xC9..=0xCB | 0xCD..=0xCF => return None, // progressivo, aritmético etc.
+            0xC4 => {
+                let mut q = 0;
+                while q + 17 <= seg.len() {
+                    let (cls, id) = (seg[q] >> 4, (seg[q] & 15) as usize);
+                    let mut counts = [0u8; 16];
+                    counts.copy_from_slice(&seg[q + 1..q + 17]);
+                    let n: usize = counts.iter().map(|&c| c as usize).sum();
+                    if id > 3 || q + 17 + n > seg.len() || n > 256 {
+                        return None;
+                    }
+                    let h = Huff::new(&counts, seg[q + 17..q + 17 + n].to_vec());
+                    if cls == 0 {
+                        dc[id] = Some(h);
+                    } else {
+                        ac[id] = Some(h);
+                    }
+                    q += 17 + n;
+                }
+            }
+            0xDB => {
+                let mut q = 0;
+                while q < seg.len() {
+                    let (prec, id) = (seg[q] >> 4, (seg[q] & 15) as usize);
+                    q += 1;
+                    let n = if prec == 0 { 64 } else { 128 };
+                    if id > 3 || q + n > seg.len() {
+                        return None;
+                    }
+                    for i in 0..64 {
+                        qt[id][i] = if prec == 0 {
+                            seg[q + i] as u16
+                        } else {
+                            u16::from_be_bytes([seg[q + 2 * i], seg[q + 2 * i + 1]])
+                        };
+                    }
+                    q += n;
+                }
+            }
+            0xDD => {
+                if seg.len() >= 2 {
+                    restart = u16::from_be_bytes([seg[0], seg[1]]) as u32;
+                }
+            }
+            0xDA => {
+                let (w, h, comps) = sof?;
+                let ns = *seg.first()? as usize;
+                if ns != comps.len() || seg.len() < 1 + ns * 2 + 3 {
+                    return None; // varredura não intercalada
+                }
+                let mut cs = vec![];
+                for i in 0..ns {
+                    let t = seg[2 + i * 2];
+                    cs.push(Comp {
+                        h: comps[i].0,
+                        v: comps[i].1,
+                        tq: comps[i].2,
+                        dc_tbl: (t >> 4) as usize & 3,
+                        ac_tbl: (t & 15) as usize & 3,
+                    });
+                }
+                let hmax = cs.iter().map(|c| c.h).max()? as u32;
+                let vmax = cs.iter().map(|c| c.v).max()? as u32;
+                if hmax == 0 || vmax == 0 || hmax > 4 || vmax > 4 {
+                    return None;
+                }
+                for c in &cs {
+                    if c.h == 0 || c.v == 0 || dc[c.dc_tbl].is_none() || ac[c.ac_tbl].is_none() {
+                        return None;
+                    }
+                }
+                return Some(Header {
+                    width: w,
+                    height: h,
+                    comps: cs,
+                    restart,
+                    mcus_x: w.div_ceil(8 * hmax),
+                    mcus_y: h.div_ceil(8 * vmax),
+                    scan_start: p + 2 + len,
+                    qt,
+                    dc,
+                    ac,
+                });
+            }
+            _ => {}
+        }
+        p += 2 + len;
+    }
+    None
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Stop {
+    /// Todos os MCUs foram decodificados.
+    Done,
+    /// Marcador inesperado (inclusive EOI) na posição dada.
+    Marker(u8, usize),
+    /// Código inválido ou coeficiente fora do limite.
+    Error(usize),
+    /// Faltam bytes.
+    Truncated,
+}
+
+/// Estado completo do decodificador num limite de byte, para retomar com outros dados.
+#[derive(Clone, Debug)]
+pub struct State {
+    /// Próximo byte a buscar no fluxo.
+    pub pos: usize,
+    bitbuf: u32,
+    bitcnt: u32,
+    pred: [i32; 4],
+    pub mcu: u32,
+    rst_next: u8,
+    mcus_since_rst: u32,
+}
+
+impl State {
+    /// Último DC de luminância (preditor) no ponto de retomada.
+    pub fn luma_pred(&self) -> i32 {
+        self.pred[0]
+    }
+    pub fn start(h: &Header) -> State {
+        State {
+            pos: h.scan_start,
+            bitbuf: 0,
+            bitcnt: 0,
+            pred: [0; 4],
+            mcu: 0,
+            rst_next: 0,
+            mcus_since_rst: 0,
+        }
+    }
+}
+
+pub struct Decoded {
+    /// DC de luminância (absoluto) por MCU decodificado.
+    pub dc: Vec<i32>,
+    /// Estados guardados em intervalos (para retomada): (MCU, estado ao fim dele).
+    pub snaps: Vec<State>,
+    pub stop: Stop,
+    pub state: State,
+}
+
+struct Bits<'a> {
+    d: &'a [u8],
+    st: State,
+    marker: Option<(u8, usize)>,
+}
+
+impl Bits<'_> {
+    fn fill(&mut self) {
+        while self.st.bitcnt <= 24 && self.marker.is_none() {
+            let Some(&b) = self.d.get(self.st.pos) else {
+                break;
+            };
+            if b == 0xFF {
+                match self.d.get(self.st.pos + 1) {
+                    Some(0) => {
+                        self.st.bitbuf |= 0xFF << (24 - self.st.bitcnt);
+                        self.st.bitcnt += 8;
+                        self.st.pos += 2;
+                    }
+                    Some(&m) => {
+                        self.marker = Some((m, self.st.pos));
+                    }
+                    None => break,
+                }
+            } else {
+                self.st.bitbuf |= (b as u32) << (24 - self.st.bitcnt);
+                self.st.bitcnt += 8;
+                self.st.pos += 1;
+            }
+        }
+    }
+    fn get(&mut self, n: u32) -> Option<u32> {
+        if n == 0 {
+            return Some(0);
+        }
+        if self.st.bitcnt < n {
+            self.fill();
+            if self.st.bitcnt < n {
+                return None;
+            }
+        }
+        let v = self.st.bitbuf >> (32 - n);
+        self.st.bitbuf <<= n;
+        self.st.bitcnt -= n;
+        Some(v)
+    }
+    fn huff(&mut self, h: &Huff) -> Option<u8> {
+        self.fill();
+        let mut code = 0i32;
+        for l in 1..=16u32 {
+            if self.st.bitcnt < l {
+                return None;
+            }
+            code = (self.st.bitbuf >> (32 - l)) as i32;
+            if h.maxcode[l as usize] >= 0
+                && code <= h.maxcode[l as usize]
+                && code >= h.mincode[l as usize]
+            {
+                self.st.bitbuf <<= l;
+                self.st.bitcnt -= l;
+                let idx = h.valptr[l as usize] + code - h.mincode[l as usize];
+                return h.vals.get(idx as usize).copied();
+            }
+        }
+        let _ = code;
+        None
+    }
+}
+
+fn extend(v: u32, t: u32) -> i32 {
+    if t == 0 {
+        0
+    } else if v < (1 << (t - 1)) {
+        v as i32 - (1 << t) + 1
+    } else {
+        v as i32
+    }
+}
+
+/// Decodifica até `max_mcus` MCUs a partir de `state`, sobre `data` (fluxo bruto com FF00).
+/// `snap_every` > 0 guarda estados a cada tantos bytes consumidos.
+pub fn decode(h: &Header, data: &[u8], state: State, max_mcus: u32, snap_every: usize) -> Decoded {
+    decode_hook(h, data, state, max_mcus, snap_every, None)
+}
+
+/// Como `decode`, mas entrega os coeficientes (zigzag) dos blocos de luminância de cada MCU.
+pub fn decode_hook(
+    h: &Header,
+    data: &[u8],
+    state: State,
+    max_mcus: u32,
+    snap_every: usize,
+    mut hook: Option<&mut dyn FnMut(u32, &[[i32; 64]])>,
+) -> Decoded {
+    let mut lblocks: Vec<[i32; 64]> = Vec::new();
+    let mut b = Bits {
+        d: data,
+        st: state,
+        marker: None,
+    };
+    let total = h.total_mcus();
+    let mut dc_out = Vec::new();
+    let mut snaps = Vec::new();
+    let mut last_snap = b.st.pos;
+    let mut stop = Stop::Done;
+    let mut decoded = 0u32;
+    'mcu: while b.st.mcu < total && decoded < max_mcus {
+        // Marcador de reinício entre MCUs.
+        if h.restart > 0 && b.st.mcus_since_rst == h.restart {
+            // descarta bits de preenchimento e espera RSTn
+            b.st.bitbuf = 0;
+            b.st.bitcnt = 0;
+            let p = b.st.pos;
+            match (data.get(p), data.get(p + 1)) {
+                (Some(0xFF), Some(&m)) if m == 0xD0 + b.st.rst_next => {
+                    b.st.pos += 2;
+                    b.st.rst_next = (b.st.rst_next + 1) & 7;
+                    b.st.mcus_since_rst = 0;
+                    b.st.pred = [0; 4];
+                    b.marker = None;
+                }
+                (Some(0xFF), Some(&m)) => {
+                    stop = Stop::Marker(m, p);
+                    break 'mcu;
+                }
+                (None, _) | (_, None) => {
+                    stop = Stop::Truncated;
+                    break 'mcu;
+                }
+                _ => {
+                    stop = Stop::Error(p);
+                    break 'mcu;
+                }
+            }
+        }
+        let mut luma_dc = 0;
+        lblocks.clear();
+        for (ci, c) in h.comps.iter().enumerate() {
+            let dct = h.dc[c.dc_tbl].as_ref().unwrap();
+            let act = h.ac[c.ac_tbl].as_ref().unwrap();
+            for blk in 0..(c.h as u32 * c.v as u32) {
+                let Some(t) = b.huff(dct) else {
+                    stop = fail(&b, data);
+                    break 'mcu;
+                };
+                if t > 11 {
+                    stop = Stop::Error(b.st.pos);
+                    break 'mcu;
+                }
+                let Some(bits) = b.get(t as u32) else {
+                    stop = fail(&b, data);
+                    break 'mcu;
+                };
+                b.st.pred[ci] += extend(bits, t as u32);
+                if ci == 0 && blk == 0 {
+                    luma_dc = b.st.pred[0];
+                }
+                let mut coef = [0i32; 64];
+                if ci == 0 {
+                    coef[0] = b.st.pred[0];
+                }
+                let mut k = 1;
+                while k < 64 {
+                    let Some(rs) = b.huff(act) else {
+                        stop = fail(&b, data);
+                        break 'mcu;
+                    };
+                    let (r, s) = ((rs >> 4) as usize, (rs & 15) as u32);
+                    if s == 0 {
+                        if r == 15 {
+                            k += 16;
+                            continue;
+                        }
+                        break;
+                    }
+                    k += r;
+                    if k > 63 {
+                        stop = Stop::Error(b.st.pos);
+                        break 'mcu;
+                    }
+                    let Some(vbits) = b.get(s) else {
+                        stop = fail(&b, data);
+                        break 'mcu;
+                    };
+                    if ci == 0 && hook.is_some() {
+                        coef[k] = extend(vbits, s);
+                    }
+                    k += 1;
+                }
+                if ci == 0 && hook.is_some() {
+                    lblocks.push(coef);
+                }
+            }
+        }
+        if let Some(hk) = hook.as_mut() {
+            hk(b.st.mcu, &lblocks);
+        }
+        dc_out.push(luma_dc);
+        b.st.mcu += 1;
+        b.st.mcus_since_rst += 1;
+        decoded += 1;
+        if snap_every > 0 && b.st.pos >= last_snap + snap_every {
+            snaps.push(b.st.clone());
+            last_snap = b.st.pos;
+        }
+    }
+    Decoded {
+        dc: dc_out,
+        snaps,
+        stop,
+        state: b.st,
+    }
+}
+
+fn fail(b: &Bits, data: &[u8]) -> Stop {
+    if let Some((m, p)) = b.marker {
+        Stop::Marker(m, p)
+    } else if b.st.pos >= data.len() {
+        Stop::Truncated
+    } else {
+        Stop::Error(b.st.pos)
+    }
+}
+
+/// Primeiro MCU suspeito: janela de `win` MCUs cuja diferença média de DC é anormalmente alta.
+/// Devolve o índice do MCU onde a janela começa.
+pub fn first_discontinuity(h: &Header, dc: &[i32]) -> Option<usize> {
+    let mx = h.mcus_x as usize;
+    let d: Vec<f64> = (0..dc.len())
+        .map(|i| {
+            if i % mx > 0 {
+                (dc[i] - dc[i - 1]).abs() as f64
+            } else if i >= mx {
+                (dc[i] - dc[i - mx]).abs() as f64
+            } else {
+                0.0
+            }
+        })
+        .collect();
+    let win = 24usize;
+    if d.len() < win * 2 {
+        return None;
+    }
+    // Referência: mediana das diferenças vistas até aqui (histograma, robusta a bordas).
+    let mut hist = vec![0u32; 2048];
+    let mut seen = 0u32;
+    let mut sum: f64 = d[..win].iter().sum();
+    for x in &d[..win] {
+        hist[(*x as usize).min(2047)] += 1;
+        seen += 1;
+    }
+    for i in win..d.len() {
+        sum += d[i] - d[i - win];
+        if i >= 64 + win && i % 8 == 0 {
+            let mut acc = 0u32;
+            let mut med = 0usize;
+            for (v, &c) in hist.iter().enumerate() {
+                acc += c;
+                if acc * 2 >= seen {
+                    med = v;
+                    break;
+                }
+            }
+            if sum / win as f64 > (6.0 * med as f64).max(40.0) {
+                return Some(i + 1 - win);
+            }
+        }
+        // Só entra na referência o que ainda parece normal.
+        if i < win * 3 || d[i] < 300.0 {
+            hist[(d[i] as usize).min(2047)] += 1;
+            seen += 1;
+        }
+    }
+    None
+}
+
+// --------------------------------------------------------------- pixels
+
+const ZIGZAG: [usize; 64] = [
+    0, 1, 8, 16, 9, 2, 3, 10, 17, 24, 32, 25, 18, 11, 4, 5, 12, 19, 26, 33, 40, 48, 41, 34, 27, 20,
+    13, 6, 7, 14, 21, 28, 35, 42, 49, 56, 57, 50, 43, 36, 29, 22, 15, 23, 30, 37, 44, 51, 58, 59,
+    52, 45, 38, 31, 39, 46, 53, 60, 61, 54, 47, 55, 62, 63,
+];
+
+fn cos_table() -> &'static [[f32; 8]; 8] {
+    static T: std::sync::OnceLock<[[f32; 8]; 8]> = std::sync::OnceLock::new();
+    T.get_or_init(|| {
+        let mut t = [[0f32; 8]; 8];
+        for x in 0..8 {
+            for u in 0..8 {
+                let cu = if u == 0 {
+                    std::f32::consts::FRAC_1_SQRT_2
+                } else {
+                    1.0
+                };
+                t[x][u] = 0.5
+                    * cu
+                    * (((2 * x + 1) as f32 * u as f32 * std::f32::consts::PI) / 16.0).cos();
+            }
+        }
+        t
+    })
+}
+
+/// IDCT de um bloco (coeficientes em zigzag, quantizados) para 8x8 pixels de luminância.
+pub fn idct_block(coef: &[i32; 64], qt: &[u16; 64]) -> [u8; 64] {
+    let mut f = [[0f32; 8]; 8];
+    for z in 0..64 {
+        let n = ZIGZAG[z];
+        f[n / 8][n % 8] = (coef[z] * qt[z] as i32) as f32;
+    }
+    let t = cos_table();
+    // linhas
+    let mut tmp = [[0f32; 8]; 8];
+    for v in 0..8 {
+        for x in 0..8 {
+            let mut s = 0.0;
+            for u in 0..8 {
+                s += t[x][u] * f[v][u];
+            }
+            tmp[v][x] = s;
+        }
+    }
+    let mut out = [0u8; 64];
+    for y in 0..8 {
+        for x in 0..8 {
+            let mut s = 0.0;
+            for v in 0..8 {
+                s += t[y][v] * tmp[v][x];
+            }
+            out[y * 8 + x] = (s + 128.0).round().clamp(0.0, 255.0) as u8;
+        }
+    }
+    out
+}
+
+/// Luminância de um MCU (blocos `h` x `v` da primeira componente) como imagem (8h x 8v).
+pub fn mcu_luma(h: &Header, blocks: &[[i32; 64]]) -> Vec<u8> {
+    let c = &h.comps[0];
+    let (bw, bh) = (c.h as usize, c.v as usize);
+    let w = bw * 8;
+    let mut out = vec![0u8; w * bh * 8];
+    for (i, blk) in blocks.iter().enumerate().take(bw * bh) {
+        let px = idct_block(blk, &h.qt[c.tq]);
+        let (bx, by) = (i % bw, i / bw);
+        for y in 0..8 {
+            out[(by * 8 + y) * w + bx * 8..(by * 8 + y) * w + bx * 8 + 8]
+                .copy_from_slice(&px[y * 8..y * 8 + 8]);
+        }
+    }
+    out
+}
+
+/// Plano de luminância do que já foi decodificado.
+pub struct Plane {
+    pub w: usize,
+    pub h: usize,
+    pub px: Vec<u8>,
+    pub mw: usize,
+    pub mh: usize,
+    pub have: u32,
+}
+
+impl Plane {
+    pub fn new(h: &Header) -> Plane {
+        let c = &h.comps[0];
+        let (mw, mh) = (c.h as usize * 8, c.v as usize * 8);
+        Plane {
+            w: mw * h.mcus_x as usize,
+            h: mh * h.mcus_y as usize,
+            px: vec![0; mw * h.mcus_x as usize * mh * h.mcus_y as usize],
+            mw,
+            mh,
+            have: 0,
+        }
+    }
+    pub fn put(&mut self, h: &Header, mcu: u32, luma: &[u8]) {
+        let (mx, my) = ((mcu % h.mcus_x) as usize, (mcu / h.mcus_x) as usize);
+        for y in 0..self.mh {
+            let dst = (my * self.mh + y) * self.w + mx * self.mw;
+            self.px[dst..dst + self.mw].copy_from_slice(&luma[y * self.mw..(y + 1) * self.mw]);
+        }
+        self.have = self.have.max(mcu + 1);
+    }
+}
+
+/// Decodifica e preenche o plano com as luminâncias.
+pub fn decode_plane(
+    h: &Header,
+    data: &[u8],
+    state: State,
+    max_mcus: u32,
+    plane: &mut Plane,
+) -> Decoded {
+    let mut hook = |mcu: u32, blocks: &[[i32; 64]]| {
+        let l = mcu_luma(h, blocks);
+        plane.put(h, mcu, &l);
+    };
+    decode_hook(h, data, state, max_mcus, 512, Some(&mut hook))
+}
@@ -1,22 +1,40 @@
+#![allow(
+    clippy::type_complexity,
+    clippy::too_many_arguments,
+    clippy::if_same_then_else,
+    clippy::large_enum_variant,
+    clippy::needless_range_loop
+)]
 //! Guará: núcleo de recuperação de arquivos.
 //!
 //! Princípio central: a origem é aberta **somente para leitura**; nada neste
 //! crate escreve no dispositivo que está sendo recuperado.

+pub mod aff4;
+pub mod assemble;
 pub mod carve;
+pub mod crypt;
+pub mod defrag;
 pub mod device;
 pub mod error;
+pub mod ewf;
 pub mod explorer;
 pub mod external;
+pub mod formats;
 pub mod fs;
 pub mod hashing;
 pub mod health;
 pub mod http;
 pub mod image;
+pub mod jpegscan;
+pub mod lvm;
 pub mod meta;
+pub mod mp4rebuild;
 pub mod notify;
 pub mod owner;
 pub mod partition;
+pub mod raid;
+pub mod raid_detect;
 pub mod reconnect;
 pub mod recover;
 pub mod report;
@@ -29,6 +47,7 @@ pub mod source;
 pub mod sqlite;
 pub mod thumb;
 pub mod types;
+pub mod volume;

 pub use error::{Error, Result};
 pub use types::*;
@@ -0,0 +1,612 @@
+//! LVM2: lê o rótulo do volume físico (PV) e o texto de metadados, e remonta os volumes
+//! lógicos (lineares, em faixas, espelhados e RAID 0/1/5/6/10 do LVM).
+
+use crate::raid::{Layout, Level, Member, RaidParams, RaidSource};
+use crate::source::{read_vec, Source};
+use std::collections::BTreeMap;
+use std::io;
+use std::sync::Arc;
+
+const MDA_MAGIC: &[u8; 16] = b" LVM2 x[5A%r0N*>";
+
+#[derive(Clone, Debug)]
+pub struct PvInfo {
+    /// UUID de 32 caracteres, sem hífens.
+    pub uuid: String,
+    pub size: u64,
+    pub seqno: u64,
+    pub vg_name: String,
+    pub text: String,
+}
+
+/// Lê rótulo + metadados de um PV.
+pub fn read_pv(src: &dyn Source) -> Option<PvInfo> {
+    let head = read_vec(src, 0, 2048).ok()?;
+    if head.len() < 2048 {
+        return None;
+    }
+    let sector = (0..4).find(|&s| &head[s * 512..s * 512 + 8] == b"LABELONE")?;
+    let lab = &head[sector * 512..(sector + 1) * 512];
+    if &lab[24..32] != b"LVM2 001" {
+        return None;
+    }
+    let off = u32::from_le_bytes(lab[20..24].try_into().ok()?) as usize;
+    let pv = lab.get(off..)?;
+    let uuid = String::from_utf8_lossy(pv.get(..32)?).to_string();
+    let size = u64::from_le_bytes(pv.get(32..40)?.try_into().ok()?);
+    // Lista de áreas de dados, depois de áreas de metadados; cada lista termina em (0,0).
+    let mut o = 40;
+    let rd = |o: usize| -> Option<(u64, u64)> {
+        Some((
+            u64::from_le_bytes(pv.get(o..o + 8)?.try_into().ok()?),
+            u64::from_le_bytes(pv.get(o + 8..o + 16)?.try_into().ok()?),
+        ))
+    };
+    loop {
+        let (a, b) = rd(o)?;
+        o += 16;
+        if a == 0 && b == 0 {
+            break;
+        }
+    }
+    let mut mdas = vec![];
+    loop {
+        let (a, b) = rd(o)?;
+        o += 16;
+        if a == 0 && b == 0 {
+            break;
+        }
+        mdas.push((a, b));
+    }
+    let mut best: Option<PvInfo> = None;
+    for (mda_off, mda_size) in mdas {
+        let Ok(h) = read_vec(src, mda_off, 512) else {
+            continue;
+        };
+        if h.len() < 512 || &h[4..20] != MDA_MAGIC {
+            continue;
+        }
+        // raw_locn[0]
+        let loc_off = u64::from_le_bytes(h[40..48].try_into().unwrap());
+        let loc_size = u64::from_le_bytes(h[48..56].try_into().unwrap());
+        if loc_size == 0 || loc_size > 16 << 20 || mda_size < 1024 {
+            continue;
+        }
+        let mut text = vec![];
+        if loc_off + loc_size <= mda_size {
+            if let Ok(t) = read_vec(src, mda_off + loc_off, loc_size as usize) {
+                text = t;
+            }
+        } else {
+            // O texto dá a volta no anel.
+            let first = mda_size - loc_off;
+            if let (Ok(a), Ok(b)) = (
+                read_vec(src, mda_off + loc_off, first as usize),
+                read_vec(src, mda_off + 512, (loc_size - first) as usize),
+            ) {
+                text = [a, b].concat();
+            }
+        }
+        let s = String::from_utf8_lossy(&text)
+            .trim_end_matches('\0')
+            .to_string();
+        let Some(tree) = parse(&s) else { continue };
+        let Some((vg_name, vg)) = tree
+            .sections
+            .iter()
+            .find(|(_, sec)| sec.values.contains_key("extent_size"))
+        else {
+            continue;
+        };
+        let seqno = vg.int("seqno").unwrap_or(0);
+        let cand = PvInfo {
+            uuid: uuid.clone(),
+            size,
+            seqno,
+            vg_name: vg_name.clone(),
+            text: s.clone(),
+        };
+        if best.as_ref().map(|b| cand.seqno > b.seqno).unwrap_or(true) {
+            best = Some(cand);
+        }
+    }
+    best
+}
+
+// ------------------------------------------------------------------ texto
+
+#[derive(Clone, Debug)]
+pub enum Val {
+    Int(i64),
+    Str(String),
+    List(Vec<Val>),
+}
+
+#[derive(Clone, Debug, Default)]
+pub struct Section {
+    pub values: BTreeMap<String, Val>,
+    /// Subseções na ordem do arquivo.
+    pub sections: Vec<(String, Section)>,
+}
+
+impl Section {
+    pub fn int(&self, k: &str) -> Option<u64> {
+        match self.values.get(k)? {
+            Val::Int(i) => Some(*i as u64),
+            _ => None,
+        }
+    }
+    pub fn str(&self, k: &str) -> Option<&str> {
+        match self.values.get(k)? {
+            Val::Str(s) => Some(s),
+            _ => None,
+        }
+    }
+    pub fn list(&self, k: &str) -> Option<&[Val]> {
+        match self.values.get(k)? {
+            Val::List(l) => Some(l),
+            _ => None,
+        }
+    }
+    pub fn sub(&self, name: &str) -> Option<&Section> {
+        self.sections
+            .iter()
+            .find(|(n, _)| n == name)
+            .map(|(_, s)| s)
+    }
+}
+
+struct Lexer<'a> {
+    b: &'a [u8],
+    i: usize,
+}
+
+impl Lexer<'_> {
+    fn skip(&mut self) {
+        loop {
+            while self.i < self.b.len()
+                && (self.b[self.i].is_ascii_whitespace() || self.b[self.i] == b',')
+            {
+                self.i += 1;
+            }
+            if self.i < self.b.len() && self.b[self.i] == b'#' {
+                while self.i < self.b.len() && self.b[self.i] != b'\n' {
+                    self.i += 1;
+                }
+            } else {
+                break;
+            }
+        }
+    }
+    fn ident(&mut self) -> Option<String> {
+        self.skip();
+        let s = self.i;
+        while self.i < self.b.len()
+            && !self.b[self.i].is_ascii_whitespace()
+            && !matches!(
+                self.b[self.i],
+                b'=' | b'{' | b'}' | b'[' | b']' | b'"' | b'#'
+            )
+        {
+            self.i += 1;
+        }
+        (self.i > s).then(|| String::from_utf8_lossy(&self.b[s..self.i]).to_string())
+    }
+    fn value(&mut self) -> Option<Val> {
+        self.skip();
+        match *self.b.get(self.i)? {
+            b'"' => {
+                self.i += 1;
+                let s = self.i;
+                while self.i < self.b.len() && self.b[self.i] != b'"' {
+                    if self.b[self.i] == b'\\' {
+                        self.i += 1;
+                    }
+                    self.i += 1;
+                }
+                let v = String::from_utf8_lossy(&self.b[s..self.i.min(self.b.len())]).to_string();
+                self.i += 1;
+                Some(Val::Str(v))
+            }
+            b'[' => {
+                self.i += 1;
+                let mut l = vec![];
+                loop {
+                    self.skip();
+                    if *self.b.get(self.i)? == b']' {
+                        self.i += 1;
+                        break;
+                    }
+                    l.push(self.value()?);
+                }
+                Some(Val::List(l))
+            }
+            _ => {
+                let s = self.i;
+                while self.i < self.b.len()
+                    && (self.b[self.i].is_ascii_digit() || self.b[self.i] == b'-')
+                {
+                    self.i += 1;
+                }
+                if self.i == s {
+                    return None;
+                }
+                std::str::from_utf8(&self.b[s..self.i])
+                    .ok()?
+                    .parse()
+                    .ok()
+                    .map(Val::Int)
+            }
+        }
+    }
+    fn section(&mut self, top: bool) -> Option<Section> {
+        let mut sec = Section::default();
+        loop {
+            self.skip();
+            if self.i >= self.b.len() {
+                return top.then_some(sec);
+            }
+            if self.b[self.i] == b'}' {
+                self.i += 1;
+                return (!top).then_some(sec);
+            }
+            let name = self.ident()?;
+            self.skip();
+            match *self.b.get(self.i)? {
+                b'=' => {
+                    self.i += 1;
+                    let v = self.value()?;
+                    sec.values.insert(name, v);
+                }
+                b'{' => {
+                    self.i += 1;
+                    let s = self.section(false)?;
+                    sec.sections.push((name, s));
+                }
+                _ => return None,
+            }
+        }
+    }
+}
+
+pub fn parse(text: &str) -> Option<Section> {
+    Lexer {
+        b: text.as_bytes(),
+        i: 0,
+    }
+    .section(true)
+}
+
+// ------------------------------------------------------------- montagem
+
+fn dashed(u: &str) -> String {
+    if u.len() != 32 {
+        return u.to_string();
+    }
+    format!(
+        "{}-{}-{}-{}-{}-{}-{}",
+        &u[0..6],
+        &u[6..10],
+        &u[10..14],
+        &u[14..18],
+        &u[18..22],
+        &u[22..26],
+        &u[26..32]
+    )
+}
+
+#[derive(Clone)]
+enum Map {
+    /// Lê de `src` a partir de `base` (linear).
+    Linear {
+        src: Option<Arc<dyn Source>>,
+        base: u64,
+    },
+    Striped {
+        srcs: Vec<(Option<Arc<dyn Source>>, u64)>,
+        stripe: u64,
+    },
+    Mirror {
+        legs: Vec<(Option<Arc<dyn Source>>, u64)>,
+    },
+    Raid(Arc<RaidSource>),
+}
+
+struct Seg {
+    start: u64,
+    len: u64,
+    map: Map,
+}
+
+pub struct LvSource {
+    segs: Vec<Seg>,
+    size: u64,
+}
+
+impl Source for LvSource {
+    fn size(&self) -> u64 {
+        self.size
+    }
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<usize> {
+        if offset >= self.size || buf.is_empty() {
+            return Ok(0);
+        }
+        let want = buf.len().min((self.size - offset) as usize);
+        let mut done = 0;
+        while done < want {
+            let pos = offset + done as u64;
+            let i = self.segs.partition_point(|s| s.start + s.len <= pos);
+            let Some(s) = self.segs.get(i) else { break };
+            let rel = pos - s.start;
+            let mut n = ((s.len - rel) as usize).min(want - done);
+            let dst = &mut buf[done..done + n];
+            match &s.map {
+                Map::Linear { src, base } => match src {
+                    Some(src) => n = read_full(src.as_ref(), base + rel, dst)?,
+                    None => dst.fill(0),
+                },
+                Map::Striped { srcs, stripe } => {
+                    let ns = srcs.len() as u64;
+                    let (idx, within) = (rel / stripe, rel % stripe);
+                    n = n.min((stripe - within) as usize);
+                    let (src, base) = &srcs[(idx % ns) as usize];
+                    let off = base + (idx / ns) * stripe + within;
+                    match src {
+                        Some(src) => n = read_full(src.as_ref(), off, &mut dst[..n])?,
+                        None => dst[..n].fill(0),
+                    }
+                }
+                Map::Mirror { legs } => {
+                    let mut ok = false;
+                    for (src, base) in legs {
+                        if let Some(src) = src {
+                            if let Ok(g) = read_full(src.as_ref(), base + rel, dst) {
+                                n = g;
+                                ok = true;
+                                break;
+                            }
+                        }
+                    }
+                    if !ok {
+                        dst.fill(0);
+                    }
+                }
+                Map::Raid(r) => n = read_full(r.as_ref(), rel, dst)?,
+            }
+            if n == 0 {
+                break;
+            }
+            done += n;
+        }
+        Ok(done)
+    }
+}
+
+fn read_full(src: &dyn Source, off: u64, buf: &mut [u8]) -> io::Result<usize> {
+    let mut got = 0;
+    while got < buf.len() {
+        let n = src.read_at(off + got as u64, &mut buf[got..])?;
+        if n == 0 {
+            buf[got..].fill(0);
+            return Ok(buf.len());
+        }
+        got += n;
+    }
+    Ok(got)
+}
+
+pub struct VgResult {
+    pub name: String,
+    pub lvs: Vec<(String, Arc<dyn Source>)>,
+    pub warnings: Vec<String>,
+}
+
+fn mk_stripes(list: &[Val]) -> Vec<(String, u64)> {
+    let mut out = vec![];
+    for pair in list.chunks(2) {
+        if let [Val::Str(n), Val::Int(e)] = pair {
+            out.push((n.clone(), *e as u64));
+        }
+    }
+    out
+}
+
+struct Ctx<'a> {
+    ext: u64,
+    pvs: BTreeMap<String, (Option<Arc<dyn Source>>, u64)>, // nome -> (origem, pe_start em bytes)
+    lvs: &'a Section,
+    cache: BTreeMap<String, Option<Arc<dyn Source>>>,
+    warnings: Vec<String>,
+}
+
+impl Ctx<'_> {
+    fn build(&mut self, name: &str, depth: u32) -> Option<Arc<dyn Source>> {
+        if let Some(c) = self.cache.get(name) {
+            return c.clone();
+        }
+        if depth > 6 {
+            return None;
+        }
+        let lv = self.lvs.sub(name)?.clone();
+        let nsegs = lv.int("segment_count").unwrap_or(0);
+        let mut segs: Vec<Seg> = vec![];
+        for i in 1..=nsegs {
+            let Some(seg) = lv.sub(&format!("segment{i}")) else {
+                self.warnings.push(format!("{name}: segmento {i} ausente"));
+                return None;
+            };
+            let start = seg.int("start_extent").unwrap_or(0) * self.ext;
+            let len = seg.int("extent_count").unwrap_or(0) * self.ext;
+            let ty = seg.str("type").unwrap_or("").to_string();
+            let map = match ty.as_str() {
+                "striped" => {
+                    let st = mk_stripes(seg.list("stripes").unwrap_or(&[]));
+                    let srcs: Vec<(Option<Arc<dyn Source>>, u64)> = st
+                        .iter()
+                        .map(|(pv, e)| match self.pvs.get(pv) {
+                            Some((s, pe)) => (s.clone(), pe + e * self.ext),
+                            None => (None, 0),
+                        })
+                        .collect();
+                    if srcs.iter().any(|(s, _)| s.is_none()) {
+                        self.warnings.push(format!(
+                            "{name}: falta um volume físico; as áreas dele aparecem zeradas"
+                        ));
+                    }
+                    if srcs.len() == 1 {
+                        let (src, base) = srcs.into_iter().next().unwrap();
+                        Map::Linear { src, base }
+                    } else {
+                        Map::Striped {
+                            srcs,
+                            stripe: seg.int("stripe_size").unwrap_or(128) * 512,
+                        }
+                    }
+                }
+                "mirror" => {
+                    let st = mk_stripes(seg.list("mirrors").unwrap_or(&[]));
+                    let legs = st
+                        .iter()
+                        .filter_map(|(pv, e)| {
+                            self.pvs
+                                .get(pv)
+                                .map(|(s, pe)| (s.clone(), pe + e * self.ext))
+                        })
+                        .collect();
+                    Map::Mirror { legs }
+                }
+                t if t.starts_with("raid") => {
+                    let raids = seg.list("raids").unwrap_or(&[]);
+                    let imgs: Vec<String> = raids
+                        .iter()
+                        .filter_map(|v| {
+                            if let Val::Str(s) = v {
+                                Some(s.clone())
+                            } else {
+                                None
+                            }
+                        })
+                        .collect();
+                    // Pares (rimage, rmeta) ou lista só de imagens.
+                    let data_lvs: Vec<&String> =
+                        imgs.iter().filter(|n| n.contains("_rimage_")).collect();
+                    let mut members: Vec<Option<Member>> = vec![];
+                    for n in &data_lvs {
+                        members.push(self.build(n, depth + 1).map(|src| Member {
+                            src,
+                            data_offset: 0,
+                        }));
+                    }
+                    let chunk = seg.int("stripe_size").unwrap_or(128) * 512;
+                    let (level, layout) = match t {
+                        "raid1" => (Level::R1, Layout::LeftSymmetric),
+                        "raid0" | "raid0_meta" => (Level::R0, Layout::LeftSymmetric),
+                        "raid4" | "raid5_n" => (Level::R4, Layout::ParityLast),
+                        "raid5" | "raid5_ls" => (Level::R5, Layout::LeftSymmetric),
+                        "raid5_la" => (Level::R5, Layout::LeftAsymmetric),
+                        "raid5_rs" => (Level::R5, Layout::RightSymmetric),
+                        "raid5_ra" => (Level::R5, Layout::RightAsymmetric),
+                        "raid6" | "raid6_zr" | "raid6_ls_6" => (Level::R6, Layout::LeftSymmetric),
+                        "raid6_nr" => (Level::R6, Layout::LeftAsymmetric),
+                        "raid6_nc" | "raid6_n_6" => (Level::R6, Layout::ParityLast),
+                        "raid10" => (Level::R10, Layout::LeftSymmetric),
+                        other => {
+                            self.warnings
+                                .push(format!("{name}: tipo {other} não suportado"));
+                            return None;
+                        }
+                    };
+                    let mut p = RaidParams::simple(level, chunk.max(512), layout, members);
+                    p.near = 2;
+                    p.far = 1;
+                    match RaidSource::new(p) {
+                        Ok(r) => Map::Raid(Arc::new(r)),
+                        Err(e) => {
+                            self.warnings.push(format!("{name}: {e}"));
+                            return None;
+                        }
+                    }
+                }
+                other => {
+                    self.warnings.push(format!(
+                        "{name}: tipo de segmento \"{other}\" não suportado"
+                    ));
+                    return None;
+                }
+            };
+            segs.push(Seg { start, len, map });
+        }
+        segs.sort_by_key(|s| s.start);
+        let size = segs.iter().map(|s| s.start + s.len).max().unwrap_or(0);
+        let src: Arc<dyn Source> = Arc::new(LvSource { segs, size });
+        self.cache.insert(name.to_string(), Some(src.clone()));
+        Some(src)
+    }
+}
+
+/// Monta os volumes lógicos de cada grupo de volumes presente nos PVs fornecidos.
+pub fn assemble_vgs(pvs: Vec<(Arc<dyn Source>, PvInfo)>) -> Vec<VgResult> {
+    let mut by_vg: BTreeMap<String, Vec<(Arc<dyn Source>, PvInfo)>> = BTreeMap::new();
+    for (s, p) in pvs {
+        by_vg.entry(p.vg_name.clone()).or_default().push((s, p));
+    }
+    let mut out = vec![];
+    for (vg_name, list) in by_vg {
+        let newest = list.iter().max_by_key(|(_, p)| p.seqno).unwrap();
+        let Some(tree) = parse(&newest.1.text) else {
+            continue;
+        };
+        let Some(vg) = tree.sub(&vg_name) else {
+            continue;
+        };
+        let ext = vg.int("extent_size").unwrap_or(8192) * 512;
+        let mut pvmap = BTreeMap::new();
+        let mut warnings = vec![];
+        if let Some(pvsec) = vg.sub("physical_volumes") {
+            for (pvname, def) in &pvsec.sections {
+                let id = def.str("id").unwrap_or("").to_string();
+                let found = list
+                    .iter()
+                    .find(|(_, p)| dashed(&p.uuid) == id)
+                    .map(|(s, _)| s.clone());
+                if found.is_none() {
+                    warnings.push(format!("volume físico {pvname} ({id}) não foi fornecido"));
+                }
+                pvmap.insert(
+                    pvname.clone(),
+                    (found, def.int("pe_start").unwrap_or(2048) * 512),
+                );
+            }
+        }
+        let Some(lvsec) = vg.sub("logical_volumes") else {
+            continue;
+        };
+        let mut ctx = Ctx {
+            ext,
+            pvs: pvmap,
+            lvs: lvsec,
+            cache: BTreeMap::new(),
+            warnings,
+        };
+        let mut lvs = vec![];
+        for (name, def) in &lvsec.sections {
+            // Imagens internas do RAID e metadados não são volumes de usuário.
+            let hidden = def
+                .list("status")
+                .map(|l| !l.iter().any(|v| matches!(v, Val::Str(s) if s == "VISIBLE")))
+                .unwrap_or(false);
+            if hidden {
+                continue;
+            }
+            if let Some(src) = ctx.build(name, 0) {
+                lvs.push((name.clone(), src));
+            }
+        }
+        out.push(VgResult {
+            name: vg_name,
+            lvs,
+            warnings: ctx.warnings,
+        });
+    }
+    out
+}
@@ -13,7 +13,24 @@ pub fn detect_fs(src: &dyn Source, start: u64) -> Option<(FsKind, Option<u64>)>
    if b.len() < 1100 {
        return None;
    }
-    detect_fs_in(&b)
+    if let Some(r) = detect_fs_in(&b) {
+        return Some(r);
+    }
+    // Assinaturas mais adiante no volume: Btrfs (64 KiB) e RAID mdadm 1.2 (4 KiB).
+    if let Ok(h) = read_vec(src, start + 0x10000, 0x100) {
+        if h.len() >= 0x80 && &h[0x40..0x48] == b"_BHRfS_M" {
+            return Some((
+                FsKind::Btrfs,
+                Some(u64::from_le_bytes(h[0x70..0x78].try_into().unwrap())),
+            ));
+        }
+    }
+    if let Ok(h) = read_vec(src, start + 4096, 16) {
+        if h.len() >= 4 && h[..4] == [0xFC, 0x4E, 0x2B, 0xA9] {
+            return Some((FsKind::Raid, None));
+        }
+    }
+    None
 }

 /// Mesma detecção sobre um buffer que começa no setor candidato (>= 1100 bytes).
@@ -35,7 +52,31 @@ pub fn detect_fs_in(b: &[u8]) -> Option<(FsKind, Option<u64>)> {
            return Some((FsKind::Exfat, Some(vol << shift)));
        }
    }
-    if &b[3..11] == b"-FVE-FS-" {
+    if b.len() >= 520 && &b[512..520] == b"LABELONE" {
+        return Some((FsKind::Lvm, None));
+    }
+    if b[..4] == [0xFC, 0x4E, 0x2B, 0xA9] {
+        return Some((FsKind::Raid, None));
+    }
+    if &b[0..4] == b"XFSB" {
+        let bs = u32::from_be_bytes(b[4..8].try_into().unwrap()) as u64;
+        let blocks = u64::from_be_bytes(b[8..16].try_into().unwrap());
+        if bs.is_power_of_two() && (512..=65536).contains(&bs) {
+            return Some((FsKind::Xfs, Some(bs * blocks)));
+        }
+    }
+    if &b[3..7] == b"ReFS" && &b[16..20] == b"FSRS" {
+        let sectors = u64::from_le_bytes(b[24..32].try_into().unwrap());
+        let bps = u32::from_le_bytes(b[32..36].try_into().unwrap()) as u64;
+        return Some((FsKind::Refs, Some(sectors * bps)));
+    }
+    if crate::crypt::filevault::detect(b) {
+        return Some((
+            FsKind::Corestorage,
+            Some(u64::from_le_bytes(b[64..72].try_into().unwrap())),
+        ));
+    }
+    if crate::crypt::bitlocker::detect(b) {
        return Some((FsKind::Bitlocker, None));
    }
    if b.starts_with(b"LUKS\xBA\xBE") {
@@ -213,7 +254,7 @@ pub fn analyze(src: &dyn Source, search_lost: bool) -> DiskLayout {
    for p in &layout.partitions {
        if let Some(e) = &p.encrypted {
            layout.warnings.push(format!(
-                "Partição {} está cifrada com {}: o Guará só detecta cifragem na v1 e não varre esse volume sem a chave.",
+                "Partição {} está cifrada com {}: informe a senha, a chave de recuperação ou o arquivo de chave para abrir e varrer o conteúdo.",
                p.index + 1,
                e
            ));
@@ -0,0 +1,759 @@
+//! RAID por software: linear, 0, 1, 4, 5, 6 e 10, a partir dos discos soltos.
+//!
+//! Lê os metadados do mdadm (superbloco 0.90 e 1.x) para montar sozinho; sem metadados, o
+//! módulo `raid_detect` descobre ordem, tamanho de faixa e layout. Se faltarem discos, o
+//! array é lido em modo degradado (paridade reconstrói o que faltar).
+
+use crate::source::{read_vec, Source};
+use std::io;
+use std::sync::Arc;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Level {
+    Linear,
+    R0,
+    R1,
+    R4,
+    R5,
+    R6,
+    R10,
+}
+
+impl Level {
+    pub fn name(self) -> &'static str {
+        match self {
+            Level::Linear => "linear",
+            Level::R0 => "RAID 0",
+            Level::R1 => "RAID 1",
+            Level::R4 => "RAID 4",
+            Level::R5 => "RAID 5",
+            Level::R6 => "RAID 6",
+            Level::R10 => "RAID 10",
+        }
+    }
+}
+
+/// Posição da paridade e ordem dos dados, como no driver md do Linux.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum Layout {
+    LeftAsymmetric,
+    RightAsymmetric,
+    LeftSymmetric,
+    RightSymmetric,
+    /// RAID 4 e variantes "parity-0"/"parity-n".
+    ParityFirst,
+    ParityLast,
+}
+
+impl Layout {
+    pub fn from_md(v: u32) -> Layout {
+        match v {
+            0 => Layout::LeftAsymmetric,
+            1 => Layout::RightAsymmetric,
+            2 => Layout::LeftSymmetric,
+            3 => Layout::RightSymmetric,
+            4 => Layout::ParityFirst,
+            5 => Layout::ParityLast,
+            _ => Layout::LeftSymmetric,
+        }
+    }
+    pub fn all_raid5() -> [Layout; 4] {
+        [
+            Layout::LeftSymmetric,
+            Layout::LeftAsymmetric,
+            Layout::RightSymmetric,
+            Layout::RightAsymmetric,
+        ]
+    }
+}
+
+#[derive(Clone)]
+pub struct Member {
+    pub src: Arc<dyn Source>,
+    /// Onde começam os dados dentro do membro.
+    pub data_offset: u64,
+}
+
+#[derive(Clone)]
+pub struct RaidParams {
+    pub level: Level,
+    /// Tamanho da faixa por disco, em bytes.
+    pub chunk: u64,
+    pub layout: Layout,
+    /// Membros na ordem do array; `None` = disco ausente.
+    pub members: Vec<Option<Member>>,
+    /// RAID 10: cópias "perto" (near) e "longe" (far).
+    pub near: u32,
+    pub far: u32,
+    pub far_offset: bool,
+    /// Bytes úteis por membro (0 = até o fim do menor).
+    pub per_member: u64,
+}
+
+impl RaidParams {
+    pub fn simple(level: Level, chunk: u64, layout: Layout, members: Vec<Option<Member>>) -> Self {
+        Self {
+            level,
+            chunk,
+            layout,
+            members,
+            near: 2,
+            far: 1,
+            far_offset: false,
+            per_member: 0,
+        }
+    }
+}
+
+pub struct RaidSource {
+    p: RaidParams,
+    size: u64,
+    per_member: u64,
+}
+
+// ------------------------------------------------------------ GF(2^8) para RAID 6
+
+fn gf_mul(mut a: u8, mut b: u8) -> u8 {
+    let mut r = 0u8;
+    while b != 0 {
+        if b & 1 != 0 {
+            r ^= a;
+        }
+        let hi = a & 0x80;
+        a <<= 1;
+        if hi != 0 {
+            a ^= 0x1d;
+        }
+        b >>= 1;
+    }
+    r
+}
+
+fn gf_pow2(n: usize) -> u8 {
+    let mut r = 1u8;
+    for _ in 0..n % 255 {
+        r = gf_mul(r, 2);
+    }
+    r
+}
+
+fn gf_inv(a: u8) -> u8 {
+    // a^254
+    let mut r = 1u8;
+    let mut base = a;
+    let mut e = 254u32;
+    while e > 0 {
+        if e & 1 != 0 {
+            r = gf_mul(r, base);
+        }
+        base = gf_mul(base, base);
+        e >>= 1;
+    }
+    r
+}
+
+impl RaidSource {
+    pub fn new(p: RaidParams) -> Result<Self, String> {
+        let n = p.members.len();
+        if n == 0 {
+            return Err("RAID sem membros".into());
+        }
+        let present: Vec<&Member> = p.members.iter().flatten().collect();
+        let min = |f: &dyn Fn(&Member) -> u64| present.iter().map(|m| f(m)).min().unwrap_or(0);
+        let avail = min(&|m| m.src.size().saturating_sub(m.data_offset));
+        let mut per_member = if p.per_member > 0 {
+            p.per_member.min(avail)
+        } else {
+            avail
+        };
+        if p.level != Level::Linear {
+            per_member = per_member / p.chunk.max(512) * p.chunk.max(512);
+        }
+        let missing = n - present.len();
+        let need = match p.level {
+            Level::Linear | Level::R0 => 0,
+            Level::R1 => n - 1,
+            Level::R4 | Level::R5 => 1,
+            Level::R6 => 2,
+            Level::R10 => (p.near.max(1) as usize).saturating_sub(1).min(1),
+        };
+        if missing > need && p.level != Level::R10 {
+            return Err(format!(
+                "faltam {missing} membro(s); {} tolera no máximo {need}",
+                p.level.name()
+            ));
+        }
+        if matches!(p.level, Level::R4 | Level::R5) && n < 3 || p.level == Level::R6 && n < 4 {
+            return Err("poucos membros para o nível".into());
+        }
+        if p.level == Level::R10 && (n < 2 || p.near as usize * p.far as usize > n.max(2)) {
+            return Err("parâmetros de RAID 10 inválidos".into());
+        }
+        let size = match p.level {
+            Level::Linear => present
+                .iter()
+                .map(|m| m.src.size().saturating_sub(m.data_offset))
+                .sum(),
+            Level::R0 => per_member * n as u64,
+            Level::R1 => per_member,
+            Level::R4 | Level::R5 => per_member * (n as u64 - 1),
+            Level::R6 => per_member * (n as u64 - 2),
+            Level::R10 => per_member * n as u64 / (p.near.max(1) * p.far.max(1)) as u64,
+        };
+        Ok(Self {
+            p,
+            size,
+            per_member,
+        })
+    }
+
+    pub fn params(&self) -> &RaidParams {
+        &self.p
+    }
+
+    fn read_member(&self, i: usize, off: u64, buf: &mut [u8]) -> io::Result<()> {
+        let m = self.p.members[i]
+            .as_ref()
+            .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "membro ausente"))?;
+        let mut done = 0;
+        while done < buf.len() {
+            let n = m
+                .src
+                .read_at(m.data_offset + off + done as u64, &mut buf[done..])?;
+            if n == 0 {
+                buf[done..].fill(0);
+                break;
+            }
+            done += n;
+        }
+        Ok(())
+    }
+
+    /// (disco de paridade P, disco de paridade Q, disco que guarda o dado `d` da linha `row`)
+    fn raid5_map(&self, row: u64, d: usize) -> (usize, usize) {
+        let n = self.p.members.len();
+        let r = (row % n as u64) as usize;
+        match self.p.layout {
+            Layout::LeftAsymmetric | Layout::LeftSymmetric => {
+                let pd = n - 1 - r;
+                let disk = if self.p.layout == Layout::LeftSymmetric {
+                    (pd + 1 + d) % n
+                } else if d >= pd {
+                    d + 1
+                } else {
+                    d
+                };
+                (pd, disk)
+            }
+            Layout::RightAsymmetric | Layout::RightSymmetric => {
+                let pd = r;
+                let disk = if self.p.layout == Layout::RightSymmetric {
+                    (pd + 1 + d) % n
+                } else if d >= pd {
+                    d + 1
+                } else {
+                    d
+                };
+                (pd, disk)
+            }
+            Layout::ParityFirst => (0, d + 1),
+            Layout::ParityLast => (n - 1, d),
+        }
+    }
+
+    fn raid6_map(&self, row: u64, d: usize) -> (usize, usize, usize) {
+        let n = self.p.members.len();
+        let r = (row % n as u64) as usize;
+        match self.p.layout {
+            Layout::LeftAsymmetric | Layout::LeftSymmetric => {
+                let pd = n - 1 - r;
+                let qd = (pd + 1) % n;
+                let disk = if self.p.layout == Layout::LeftSymmetric {
+                    (pd + 2 + d) % n
+                } else {
+                    // assimétrico: dados em ordem pulando P e Q
+                    let mut k = d;
+                    for skip in sorted2(pd, qd) {
+                        if k >= skip {
+                            k += 1;
+                        }
+                    }
+                    k
+                };
+                (pd, qd, disk)
+            }
+            Layout::RightAsymmetric | Layout::RightSymmetric => {
+                let pd = r;
+                let qd = (pd + 1) % n;
+                let disk = if self.p.layout == Layout::RightSymmetric {
+                    (pd + 2 + d) % n
+                } else {
+                    let mut k = d;
+                    for skip in sorted2(pd, qd) {
+                        if k >= skip {
+                            k += 1;
+                        }
+                    }
+                    k
+                };
+                (pd, qd, disk)
+            }
+            Layout::ParityFirst => (0, 1, d + 2),
+            Layout::ParityLast => (n - 2, n - 1, d),
+        }
+    }
+
+    /// Lê `buf.len()` bytes dentro de um único chunk lógico.
+    fn read_in_chunk(&self, chunk_idx: u64, within: u64, buf: &mut [u8]) -> io::Result<()> {
+        let n = self.p.members.len();
+        let c = self.p.chunk;
+        match self.p.level {
+            Level::Linear => unreachable!(),
+            Level::R0 => {
+                let (row, disk) = (chunk_idx / n as u64, (chunk_idx % n as u64) as usize);
+                self.read_member(disk, row * c + within, buf)
+            }
+            Level::R1 => {
+                for i in 0..n {
+                    if self.p.members[i].is_some()
+                        && self.read_member(i, chunk_idx * c + within, buf).is_ok()
+                    {
+                        return Ok(());
+                    }
+                }
+                Err(io::Error::other("nenhuma cópia legível"))
+            }
+            Level::R4 | Level::R5 => {
+                let dd = n - 1;
+                let (row, d) = (chunk_idx / dd as u64, (chunk_idx % dd as u64) as usize);
+                let (pd, disk) = self.raid5_map(row, d);
+                let off = row * c + within;
+                if self.p.members[disk].is_some() {
+                    return self.read_member(disk, off, buf);
+                }
+                // Reconstrói por XOR de todos os outros (dados + paridade) da linha.
+                buf.fill(0);
+                let mut tmp = vec![0u8; buf.len()];
+                for i in 0..n {
+                    if i == disk {
+                        continue;
+                    }
+                    let _ = pd;
+                    self.read_member(i, off, &mut tmp)?;
+                    for (a, b) in buf.iter_mut().zip(&tmp) {
+                        *a ^= *b;
+                    }
+                }
+                Ok(())
+            }
+            Level::R6 => {
+                let dd = n - 2;
+                let (row, d) = (chunk_idx / dd as u64, (chunk_idx % dd as u64) as usize);
+                let (_, _, disk) = self.raid6_map(row, d);
+                let off = row * c + within;
+                if self.p.members[disk].is_some() {
+                    return self.read_member(disk, off, buf);
+                }
+                self.raid6_rebuild(row, d, off, buf)
+            }
+            Level::R10 => {
+                let mut last = None;
+                for (disk, off) in self.r10_locations(chunk_idx) {
+                    if self.p.members[disk].is_some() {
+                        match self.read_member(disk, off + within, buf) {
+                            Ok(()) => return Ok(()),
+                            Err(e) => last = Some(e),
+                        }
+                    }
+                }
+                Err(last
+                    .unwrap_or_else(|| io::Error::new(io::ErrorKind::NotFound, "cópias ausentes")))
+            }
+        }
+    }
+
+    /// Onde ficam todas as cópias de um chunk lógico (como `raid10_find_phys` do kernel).
+    fn r10_locations(&self, chunk_idx: u64) -> Vec<(usize, u64)> {
+        let n = self.p.members.len() as u64;
+        let c = self.p.chunk;
+        let near = self.p.near.max(1) as u64;
+        let far = self.p.far.max(1) as u64;
+        let slot0 = chunk_idx * near;
+        let (mut stripe, dev) = (slot0 / n, slot0 % n);
+        if self.p.far_offset {
+            stripe *= far;
+        }
+        let stride = if self.p.far_offset {
+            c
+        } else {
+            (self.per_member / far) / c * c
+        };
+        let mut out = vec![];
+        let mut d = dev;
+        let mut off = stripe * c;
+        let mut firsts = vec![];
+        for _ in 0..near {
+            firsts.push((d, off));
+            out.push((d as usize, off));
+            d += 1;
+            if d >= n {
+                d = 0;
+                off += c;
+            }
+        }
+        for f in 1..far {
+            for &(dv, of) in &firsts {
+                out.push((((dv + near * f) % n) as usize, of + stride * f));
+            }
+        }
+        out
+    }
+
+    fn raid6_rebuild(&self, row: u64, d: usize, off: u64, buf: &mut [u8]) -> io::Result<()> {
+        let n = self.p.members.len();
+        let dd = n - 2;
+        let (pd, qd, _) = self.raid6_map(row, 0);
+        let len = buf.len();
+        // Estado de cada dado da linha.
+        let disks: Vec<usize> = (0..dd).map(|k| self.raid6_map(row, k).2).collect();
+        let missing_data: Vec<usize> = (0..dd)
+            .filter(|&k| self.p.members[disks[k]].is_none())
+            .collect();
+        let p_ok = self.p.members[pd].is_some();
+        let q_ok = self.p.members[qd].is_some();
+        let mut data: Vec<Option<Vec<u8>>> = vec![None; dd];
+        for k in 0..dd {
+            if self.p.members[disks[k]].is_some() {
+                let mut v = vec![0u8; len];
+                self.read_member(disks[k], off, &mut v)?;
+                data[k] = Some(v);
+            }
+        }
+        let rd = |disk: usize| -> io::Result<Vec<u8>> {
+            let mut v = vec![0u8; len];
+            self.read_member(disk, off, &mut v)?;
+            Ok(v)
+        };
+        if missing_data.len() == 1 && p_ok {
+            let p = rd(pd)?;
+            let mut acc = p;
+            for v in data.iter().flatten() {
+                for (a, b) in acc.iter_mut().zip(v) {
+                    *a ^= *b;
+                }
+            }
+            buf.copy_from_slice(&acc);
+            return Ok(());
+        }
+        if missing_data.len() == 1 && q_ok {
+            let q = rd(qd)?;
+            let x = missing_data[0];
+            let mut acc = q;
+            for (k, v) in data.iter().enumerate() {
+                if let Some(v) = v {
+                    let g = gf_pow2(k);
+                    for (a, b) in acc.iter_mut().zip(v) {
+                        *a ^= gf_mul(g, *b);
+                    }
+                }
+            }
+            let inv = gf_inv(gf_pow2(x));
+            for (o, a) in buf.iter_mut().zip(&acc) {
+                *o = gf_mul(inv, *a);
+            }
+            return Ok(());
+        }
+        if missing_data.len() == 2 && p_ok && q_ok {
+            let (x, y) = (missing_data[0], missing_data[1]);
+            let p = rd(pd)?;
+            let q = rd(qd)?;
+            let (mut pxy, mut qxy) = (p, q);
+            for (k, v) in data.iter().enumerate() {
+                if let Some(v) = v {
+                    let g = gf_pow2(k);
+                    for i in 0..len {
+                        pxy[i] ^= v[i];
+                        qxy[i] ^= gf_mul(g, v[i]);
+                    }
+                }
+            }
+            // Dx ^ Dy = pxy ; g^x Dx ^ g^y Dy = qxy
+            let (gx, gy) = (gf_pow2(x), gf_pow2(y));
+            let denom_inv = gf_inv(gx ^ gy);
+            let target = if d == x { x } else { y };
+            for i in 0..len {
+                // Dx = (qxy ^ gy*pxy) / (gx ^ gy)
+                let dx = gf_mul(denom_inv, qxy[i] ^ gf_mul(gy, pxy[i]));
+                buf[i] = if target == x { dx } else { pxy[i] ^ dx };
+            }
+            return Ok(());
+        }
+        Err(io::Error::other(
+            "RAID 6 sem redundância suficiente nesta linha",
+        ))
+    }
+}
+
+fn sorted2(a: usize, b: usize) -> [usize; 2] {
+    if a < b {
+        [a, b]
+    } else {
+        [b, a]
+    }
+}
+
+impl Source for RaidSource {
+    fn size(&self) -> u64 {
+        self.size
+    }
+
+    fn read_at(&self, offset: u64, buf: &mut [u8]) -> io::Result<usize> {
+        if offset >= self.size || buf.is_empty() {
+            return Ok(0);
+        }
+        let want = buf.len().min((self.size - offset) as usize);
+        let mut done = 0usize;
+        if self.p.level == Level::Linear {
+            let mut base = 0u64;
+            for m in self.p.members.iter().flatten() {
+                let len = m.src.size().saturating_sub(m.data_offset);
+                if offset + done as u64 >= base && offset + (done as u64) < base + len {
+                    let rel = offset + done as u64 - base;
+                    let n = ((len - rel) as usize).min(want - done);
+                    let got = m
+                        .src
+                        .read_at(m.data_offset + rel, &mut buf[done..done + n])?;
+                    if got == 0 {
+                        break;
+                    }
+                    done += got;
+                    if done >= want {
+                        break;
+                    }
+                }
+                base += len;
+            }
+            return Ok(done);
+        }
+        let c = self.p.chunk;
+        while done < want {
+            let pos = offset + done as u64;
+            let (idx, within) = (pos / c, pos % c);
+            let n = ((c - within) as usize).min(want - done);
+            self.read_in_chunk(idx, within, &mut buf[done..done + n])?;
+            done += n;
+        }
+        Ok(done)
+    }
+}
+
+// ============================================================ metadados do mdadm
+
+#[derive(Clone, Debug)]
+pub struct MdSuper {
+    pub version: String,
+    pub uuid: [u8; 16],
+    pub name: String,
+    pub level: Level,
+    pub layout: u32,
+    pub chunk: u64,
+    pub raid_disks: u32,
+    /// Papel deste disco no array (None = reserva/falho).
+    pub role: Option<u32>,
+    pub data_offset: u64,
+    /// Bytes de dados por membro.
+    pub data_size: u64,
+    pub events: u64,
+    pub array_size: u64,
+}
+
+fn le32(b: &[u8], o: usize) -> u32 {
+    u32::from_le_bytes(b[o..o + 4].try_into().unwrap())
+}
+fn le64(b: &[u8], o: usize) -> u64 {
+    u64::from_le_bytes(b[o..o + 8].try_into().unwrap())
+}
+
+fn level_from(v: i32) -> Option<Level> {
+    Some(match v {
+        -1 => Level::Linear,
+        0 => Level::R0,
+        1 => Level::R1,
+        4 => Level::R4,
+        5 => Level::R5,
+        6 => Level::R6,
+        10 => Level::R10,
+        _ => return None,
+    })
+}
+
+/// Procura um superbloco md nas posições possíveis de `src` (um disco ou partição).
+pub fn read_md_super(src: &dyn Source) -> Option<MdSuper> {
+    let size = src.size();
+    // 1.1 no início, 1.2 a 4 KiB, 1.0 a 8 KiB do fim.
+    let mut cands: Vec<(u64, &str)> = vec![(0, "1.1"), (4096, "1.2")];
+    if size > 16384 {
+        cands.push(((size & !4095) - 8192, "1.0"));
+    }
+    for (off, ver) in cands {
+        let Ok(b) = read_vec(src, off, 4096) else {
+            continue;
+        };
+        if b.len() < 4096 || le32(&b, 0) != 0xA92B_4EFC || le32(&b, 4) != 1 {
+            continue;
+        }
+        let level = level_from(le32(&b, 72) as i32)?;
+        let max_dev = le32(&b, 220) as usize;
+        let dev_number = le32(&b, 160) as usize;
+        let role = if dev_number < max_dev.min(1024) && 256 + dev_number * 2 + 2 <= b.len() {
+            let r = u16::from_le_bytes([b[256 + dev_number * 2], b[256 + dev_number * 2 + 1]]);
+            (r < 0xFFFE).then_some(r as u32)
+        } else {
+            None
+        };
+        let mut uuid = [0u8; 16];
+        uuid.copy_from_slice(&b[16..32]);
+        let name = String::from_utf8_lossy(&b[32..64])
+            .trim_end_matches('\0')
+            .to_string();
+        let data_offset = le64(&b, 128) * 512;
+        let data_size = le64(&b, 136) * 512;
+        let raid_disks = le32(&b, 92);
+        let chunk = le32(&b, 88) as u64 * 512;
+        let used = le64(&b, 80) * 512;
+        let array_size = match level {
+            Level::R0 => used * raid_disks as u64,
+            Level::R5 | Level::R4 => used * (raid_disks as u64).saturating_sub(1),
+            Level::R6 => used * (raid_disks as u64).saturating_sub(2),
+            _ => used,
+        };
+        return Some(MdSuper {
+            version: ver.into(),
+            uuid,
+            name,
+            level,
+            layout: le32(&b, 76),
+            chunk,
+            raid_disks,
+            role,
+            data_offset,
+            data_size,
+            events: le64(&b, 200),
+            array_size,
+        });
+    }
+    // 0.90: no fim, alinhado a 64 KiB.
+    if size > 131072 {
+        let off = (size & !65535) - 65536;
+        if let Ok(b) = read_vec(src, off, 4096) {
+            if b.len() >= 1024 && le32(&b, 0) == 0xA92B_4EFC && le32(&b, 4) == 0 {
+                let level = level_from(le32(&b, 28) as i32)?;
+                let mut uuid = [0u8; 16];
+                uuid[0..4].copy_from_slice(&b[20..24]);
+                uuid[4..16].copy_from_slice(&b[52..64]);
+                let role = {
+                    let r = le32(&b, 768 + 12);
+                    (r < 0xFFFE).then_some(r)
+                };
+                let raid_disks = le32(&b, 40);
+                let used = le32(&b, 32) as u64 * 1024;
+                return Some(MdSuper {
+                    version: "0.90".into(),
+                    uuid,
+                    name: String::new(),
+                    level,
+                    layout: le32(&b, 256),
+                    chunk: le32(&b, 260) as u64,
+                    raid_disks,
+                    role,
+                    data_offset: 0,
+                    data_size: used,
+                    events: ((le32(&b, 39 * 4) as u64) << 32) | le32(&b, 40 * 4) as u64,
+                    array_size: match level {
+                        Level::R0 => used * raid_disks as u64,
+                        Level::R5 | Level::R4 => used * (raid_disks as u64).saturating_sub(1),
+                        Level::R6 => used * (raid_disks as u64).saturating_sub(2),
+                        _ => used,
+                    },
+                });
+            }
+        }
+    }
+    None
+}
+
+fn uuid_str(u: &[u8; 16]) -> String {
+    u.iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// Um array reconhecido pelos superblocos dos discos fornecidos.
+pub struct FoundArray {
+    pub uuid: String,
+    pub name: String,
+    pub info: MdSuper,
+    pub source: Arc<RaidSource>,
+    pub missing: usize,
+}
+
+/// Agrupa membros por UUID e monta cada array (degradado se for possível).
+pub fn assemble_md(members: Vec<(Arc<dyn Source>, MdSuper)>) -> Vec<Result<FoundArray, String>> {
+    let mut groups: Vec<(String, Vec<(Arc<dyn Source>, MdSuper)>)> = vec![];
+    for (s, m) in members {
+        let key = uuid_str(&m.uuid);
+        match groups.iter_mut().find(|g| g.0 == key) {
+            Some(g) => g.1.push((s, m)),
+            None => groups.push((key, vec![(s, m)])),
+        }
+    }
+    let mut out = vec![];
+    for (uuid, mut list) in groups {
+        // O membro com mais eventos manda; membros desatualizados são tratados como ausentes.
+        list.sort_by_key(|(_, m)| std::cmp::Reverse(m.events));
+        let top = list[0].1.clone();
+        let n = top.raid_disks as usize;
+        let mut slots: Vec<Option<Member>> = vec![None; n];
+        let mut stale = 0;
+        for (s, m) in &list {
+            if let Some(r) = m.role {
+                if (r as usize) < n && slots[r as usize].is_none() {
+                    if m.events + 1 < top.events && top.events > 0 {
+                        stale += 1;
+                        continue;
+                    }
+                    slots[r as usize] = Some(Member {
+                        src: s.clone(),
+                        data_offset: m.data_offset,
+                    });
+                }
+            }
+        }
+        let missing = slots.iter().filter(|s| s.is_none()).count();
+        let mut p = RaidParams::simple(
+            top.level,
+            top.chunk.max(512),
+            Layout::from_md(top.layout),
+            slots,
+        );
+        if top.level == Level::R10 {
+            p.near = top.layout & 0xff;
+            p.far = (top.layout >> 8) & 0xff;
+            p.far_offset = top.layout & 0x10000 != 0;
+        }
+        if top.data_size > 0 {
+            p.per_member = top.data_size;
+        }
+        match RaidSource::new(p) {
+            Ok(src) => out.push(Ok(FoundArray {
+                uuid: uuid.clone(),
+                name: top.name.clone(),
+                info: top,
+                source: Arc::new(src),
+                missing: missing + stale,
+            })),
+            Err(e) => out.push(Err(format!("array {uuid}: {e}"))),
+        }
+    }
+    out
+}
@@ -0,0 +1,282 @@
+//! Descobre sozinho nível, ordem dos discos, tamanho de faixa e layout de um RAID sem
+//! metadados, testando as combinações e medindo a coerência do sistema de arquivos que sai.
+
+use crate::partition;
+use crate::raid::{Layout, Level, Member, RaidParams, RaidSource};
+use crate::source::{read_vec, MemSource, Source};
+use crate::types::FsKind;
+use std::sync::Arc;
+
+#[derive(Clone, Debug)]
+pub struct Candidate {
+    pub level: Level,
+    pub chunk: u64,
+    pub layout: Layout,
+    /// Índices dos membros fornecidos, na ordem do array.
+    pub order: Vec<usize>,
+    pub score: f64,
+}
+
+impl Candidate {
+    pub fn params(&self, members: &[Arc<dyn Source>]) -> RaidParams {
+        RaidParams::simple(
+            self.level,
+            self.chunk,
+            self.layout,
+            self.order
+                .iter()
+                .map(|&i| {
+                    Some(Member {
+                        src: members[i].clone(),
+                        data_offset: 0,
+                    })
+                })
+                .collect(),
+        )
+    }
+}
+
+const PREFIX: u64 = 24 << 20;
+const CHUNKS: [u64; 9] = [
+    4096, 8192, 16384, 32768, 65536, 131072, 262144, 524288, 1048576,
+];
+
+fn permutations(n: usize) -> Vec<Vec<usize>> {
+    fn rec(cur: &mut Vec<usize>, used: &mut Vec<bool>, n: usize, out: &mut Vec<Vec<usize>>) {
+        if cur.len() == n {
+            out.push(cur.clone());
+            return;
+        }
+        for i in 0..n {
+            if !used[i] {
+                used[i] = true;
+                cur.push(i);
+                rec(cur, used, n, out);
+                cur.pop();
+                used[i] = false;
+            }
+        }
+    }
+    let mut out = vec![];
+    rec(&mut vec![], &mut vec![false; n], n, &mut out);
+    out
+}
+
+fn ntfs_score(src: &dyn Source, start: u64) -> f64 {
+    let Ok(b) = read_vec(src, start, 512) else {
+        return 0.0;
+    };
+    if b.len() < 512 || &b[3..11] != b"NTFS    " {
+        return 0.0;
+    }
+    let bps = u16::from_le_bytes([b[11], b[12]]) as u64;
+    let spc = b[13] as u64;
+    let mft = u64::from_le_bytes(b[0x30..0x38].try_into().unwrap());
+    let rs = b[0x40] as i8;
+    let rec = if rs > 0 {
+        rs as u64 * bps * spc
+    } else {
+        1u64 << (-rs)
+    };
+    if bps == 0 || spc == 0 || rec == 0 || rec > 65536 {
+        return 0.0;
+    }
+    let mft_off = start + mft * bps * spc;
+    let (mut ok, mut total) = (0, 0);
+    for k in [
+        0u64, 1, 2, 3, 5, 11, 16, 24, 40, 100, 250, 600, 1500, 3000, 6000, 12000, 24000, 50000,
+    ] {
+        let off = mft_off + k * rec;
+        if off + rec > src.size() {
+            break;
+        }
+        let Ok(r) = read_vec(src, off, 64) else {
+            continue;
+        };
+        if r.len() < 64 {
+            continue;
+        }
+        // Registros além do fim do MFT estão zerados: não contam contra.
+        if r.iter().all(|&x| x == 0) {
+            continue;
+        }
+        total += 1;
+        if &r[..4] == b"FILE" && u32::from_le_bytes(r[0x2C..0x30].try_into().unwrap()) as u64 == k {
+            ok += 1;
+        }
+    }
+    if total == 0 {
+        1.0
+    } else {
+        1.0 + 10.0 * ok as f64 / total as f64
+    }
+}
+
+/// Coerência do volume que começa em `start`.
+fn volume_score(src: &dyn Source, start: u64, fs: FsKind) -> f64 {
+    match fs {
+        FsKind::Ntfs => ntfs_score(src, start),
+        FsKind::Ext => crate::fs::ext::consistency_score(src, start).unwrap_or(0.5),
+        FsKind::Unknown => 0.0,
+        _ => 1.0,
+    }
+}
+
+pub fn fs_score(src: &dyn Source) -> f64 {
+    let layout = partition::analyze(src, false);
+    let mut best = 0.0f64;
+    for p in &layout.partitions {
+        best = best.max(
+            volume_score(src, p.start, p.fs) + if p.fs != FsKind::Unknown { 0.5 } else { 0.0 },
+        );
+    }
+    best
+}
+
+fn first_sector_plausible(src: &dyn Source) -> bool {
+    let Ok(b) = read_vec(src, 0, 4096) else {
+        return false;
+    };
+    b.len() >= 1100 && ((b[510] == 0x55 && b[511] == 0xAA) || partition::detect_fs_in(&b).is_some())
+}
+
+/// Testa as combinações e devolve as melhores (maior pontuação primeiro).
+pub fn detect(
+    members: &[Arc<dyn Source>],
+    cancelled: &(dyn Fn() -> bool + Sync),
+) -> Vec<Candidate> {
+    let n = members.len();
+    if n < 2 {
+        return vec![];
+    }
+    // Trabalha sobre um prefixo em memória de cada disco.
+    let cached: Vec<Arc<dyn Source>> = members
+        .iter()
+        .map(|m| {
+            let len = m.size().min(PREFIX) as usize;
+            Arc::new(MemSource(read_vec(m.as_ref(), 0, len).unwrap_or_default())) as Arc<dyn Source>
+        })
+        .collect();
+    let min_len = cached.iter().map(|c| c.size()).min().unwrap_or(0);
+    if min_len < 1 << 20 {
+        return vec![];
+    }
+    let mut out: Vec<Candidate> = vec![];
+
+    // RAID 1: cópias idênticas.
+    let probe = |s: &Arc<dyn Source>| read_vec(s.as_ref(), 0, 1 << 20).unwrap_or_default();
+    let first = probe(&cached[0]);
+    if first.iter().any(|&x| x != 0) && cached.iter().skip(1).all(|c| probe(c) == first) {
+        let c = Candidate {
+            level: Level::R1,
+            chunk: 65536,
+            layout: Layout::LeftSymmetric,
+            order: (0..n).collect(),
+            score: fs_score(cached[0].as_ref()) + 1.0,
+        };
+        out.push(c);
+    }
+
+    // RAID 5/4 satisfaz "XOR de todos os discos = 0" em toda faixa.
+    let sample = 4usize << 20;
+    let bufs: Vec<Vec<u8>> = cached
+        .iter()
+        .map(|c| read_vec(c.as_ref(), 0, sample).unwrap_or_default())
+        .collect();
+    let mut xor_zero = 0usize;
+    let mut nonzero_rows = 0usize;
+    for blk in 0..sample / 4096 {
+        let mut any = false;
+        let mut z = true;
+        for i in 0..4096 {
+            let mut x = 0u8;
+            for b in &bufs {
+                x ^= b[blk * 4096 + i];
+                any |= b[blk * 4096 + i] != 0;
+            }
+            if x != 0 {
+                z = false;
+                break;
+            }
+        }
+        if any {
+            nonzero_rows += 1;
+            if z {
+                xor_zero += 1;
+            }
+        }
+    }
+    let parity5 = nonzero_rows > 8 && xor_zero * 100 >= nonzero_rows * 95;
+
+    let mut levels: Vec<Level> = vec![];
+    if parity5 && n >= 3 {
+        levels.push(Level::R5);
+    } else {
+        levels.push(Level::R0);
+        if n >= 4 {
+            levels.push(Level::R6);
+        }
+    }
+    let ok_first: Vec<bool> = cached
+        .iter()
+        .map(|c| first_sector_plausible(c.as_ref()))
+        .collect();
+    let any_first = ok_first.iter().any(|&b| b);
+    let perms = permutations(n);
+    for level in levels {
+        let layouts: Vec<Layout> = if matches!(level, Level::R0) {
+            vec![Layout::LeftSymmetric]
+        } else {
+            Layout::all_raid5().to_vec()
+        };
+        for &chunk in &CHUNKS {
+            for layout in &layouts {
+                for order in &perms {
+                    if cancelled() {
+                        return finish(out);
+                    }
+                    let cand = Candidate {
+                        level,
+                        chunk,
+                        layout: *layout,
+                        order: order.clone(),
+                        score: 0.0,
+                    };
+                    let params = cand.params(&cached);
+                    let Ok(r) = RaidSource::new(params) else {
+                        continue;
+                    };
+                    // O primeiro setor do volume precisa estar num disco que o tenha.
+                    if any_first {
+                        let mut b = [0u8; 512];
+                        let _ = r.read_at(0, &mut b);
+                        let m0 = order.iter().position(|&i| {
+                            let mut c = [0u8; 512];
+                            let _ = cached[i].read_at(0, &mut c);
+                            c == b
+                        });
+                        match m0 {
+                            Some(p) if ok_first[order[p]] => {}
+                            _ => continue,
+                        }
+                    }
+                    let score = fs_score(&r);
+                    if score > 0.0 {
+                        out.push(Candidate { score, ..cand });
+                    }
+                }
+            }
+        }
+    }
+    finish(out)
+}
+
+fn finish(mut out: Vec<Candidate>) -> Vec<Candidate> {
+    out.sort_by(|a, b| {
+        b.score
+            .partial_cmp(&a.score)
+            .unwrap_or(std::cmp::Ordering::Equal)
+    });
+    out.truncate(10);
+    out
+}
@@ -375,6 +375,44 @@ pub fn write_file(src: &dyn Source, f: &Found, path: &Path) -> Result<Hashes> {
            out.write_all(bytes)?;
            hasher.update(bytes);
        }
+        DataLoc::Parts { parts } => {
+            for part in parts {
+                match part {
+                    Part::Bytes { bytes } => {
+                        out.write_all(bytes)?;
+                        hasher.update(bytes);
+                    }
+                    Part::Zeros { len } => {
+                        let z = vec![0u8; (1 << 20).min(*len as usize).max(1)];
+                        let mut left = *len;
+                        while left > 0 {
+                            let n = left.min(z.len() as u64) as usize;
+                            out.write_all(&z[..n])?;
+                            hasher.update(&z[..n]);
+                            left -= n as u64;
+                        }
+                    }
+                    Part::Packed(pk) => {
+                        let v = pk.read(src)?;
+                        out.write_all(&v)?;
+                        hasher.update(&v);
+                    }
+                    Part::Run { offset, len } => {
+                        let mut done = 0u64;
+                        while done < *len {
+                            let n = (*len - done).min(1 << 20) as usize;
+                            let got = read_vec(src, offset + done, n)?;
+                            if got.len() < n {
+                                return Err(Error::msg("leitura além do fim da origem"));
+                            }
+                            out.write_all(&got)?;
+                            hasher.update(&got);
+                            done += n as u64;
+                        }
+                    }
+                }
+            }
+        }
        DataLoc::Extents { extents } => {
            let mut left = f.size;
            let mut buf = vec![0u8; 1 << 20];
@@ -425,6 +463,34 @@ pub fn read_found_at(
            buf[..n].copy_from_slice(&bytes[o..o + n]);
            Ok(n)
        }
+        DataLoc::Parts { parts } => {
+            let mut pos = 0u64;
+            for p in parts {
+                let plen = p.len();
+                if offset < pos + plen {
+                    let within = offset - pos;
+                    let n = want.min((plen - within) as usize);
+                    return match p {
+                        Part::Bytes { bytes } => {
+                            buf[..n].copy_from_slice(&bytes[within as usize..within as usize + n]);
+                            Ok(n)
+                        }
+                        Part::Run { offset: o, .. } => src.read_at(o + within, &mut buf[..n]),
+                        Part::Zeros { .. } => {
+                            buf[..n].fill(0);
+                            Ok(n)
+                        }
+                        Part::Packed(pk) => {
+                            let v = pk.read(src)?;
+                            buf[..n].copy_from_slice(&v[within as usize..within as usize + n]);
+                            Ok(n)
+                        }
+                    };
+                }
+                pos += plen;
+            }
+            Ok(0)
+        }
        DataLoc::Extents { extents } => {
            let mut pos = 0u64;
            for e in extents {
@@ -292,12 +292,7 @@ footer{margin-top:34px;color:#5b6f6d;font-size:12px}@media print{body{background
            human(f.size),
            iso(f.modified),
            iso(f.created),
-            match f.origin {
-                Origin::Carved => "assinatura",
-                Origin::Ntfs => "NTFS",
-                Origin::Fat => "FAT",
-                Origin::Exfat => "exFAT",
-            },
+            f.origin.label(),
            f.first_offset().map(|o| o.to_string()).unwrap_or_default()
        ));
    }
@@ -23,6 +23,10 @@ pub trait Sink {
    fn found(&mut self, f: Found);
    /// Um achado de carving confirmou um arquivo já listado por metadados.
    fn confirm(&mut self, id: u64, confidence: Confidence);
+    /// Um achado já emitido ganhou dados melhores (ex.: JPEG remontado de fragmentos).
+    fn replace(&mut self, f: Found) {
+        self.found(f);
+    }
    fn progress(&mut self, p: Progress);
    fn warning(&mut self, w: String);
    fn layout(&mut self, l: &DiskLayout);
@@ -83,6 +87,20 @@ pub fn run(
            l
        }
    };
+    let mut layout = layout;
+    if opts.skip_primary {
+        layout.partitions.clear();
+        layout.gaps.clear();
+        layout.table = "membro de RAID".into();
+    }
+    // Volumes lógicos e outros volumes montados que não estão na tabela do disco.
+    for p in &opts.extra_parts {
+        if !layout.partitions.iter().any(|q| q.start == p.start) {
+            let mut p = p.clone();
+            p.index = layout.partitions.len();
+            layout.partitions.push(p);
+        }
+    }
    cp.layout = Some(layout.clone());

    // Índices para fusão: primeiro offset -> (id, confiança), e extents de achados por metadados.
@@ -128,6 +146,10 @@ pub fn run(
                    }
                    FsKind::Exfat => Some(fs::exfat::scan(&mut ctx, p.start)),
                    FsKind::Ext => Some(fs::ext::scan(&mut ctx, p.start, p.len)),
+                    FsKind::HfsPlus => Some(fs::hfsplus::scan(&mut ctx, p.start, p.len)),
+                    FsKind::Btrfs => Some(fs::btrfs::scan(&mut ctx, p.start, p.len)),
+                    FsKind::Xfs => Some(fs::xfs::scan(&mut ctx, p.start, p.len)),
+                    FsKind::Apfs => Some(fs::apfs::scan(&mut ctx, p.start, p.len)),
                    _ => None,
                };
                let _ = progress_phase;
@@ -179,12 +201,25 @@ pub fn run(
        categories: &opts.categories,
    };
    let mut handler = Handler {
+        src,
        sink,
        starts,
        fs_extents,
        next_id: &next_id,
        done,
        total,
+        index: crate::defrag::ClusterIndex::new(src.size()),
+        pending: vec![],
+        intact_mp4: vec![],
+        refs: opts
+            .references
+            .iter()
+            .filter_map(|p| {
+                let s = crate::source::open_path(std::path::Path::new(p)).ok()?;
+                crate::mp4rebuild::config_from_mp4(s.as_ref(), 0, s.size())
+            })
+            .collect(),
+        carved: vec![],
    };
    for ri in 0..cp.ranges.len() {
        let (start, end) = (cp.ranges[ri].start, cp.ranges[ri].end);
@@ -200,19 +235,118 @@ pub fn run(
            return Outcome::Interrupted(cp);
        }
    }
+    handler.rebuild_pending();
    Outcome::Completed
 }

+/// Arquivo que parece quebrado: tenta recompor depois de varrer o disco todo.
+struct Pending {
+    found: Found,
+    hit_len: u64,
+    mp4: bool,
+}
+
 struct Handler<'a> {
+    src: &'a dyn Source,
    sink: &'a mut dyn Sink,
    starts: HashMap<u64, (u64, Confidence)>,
    fs_extents: Vec<Extent>,
    next_id: &'a AtomicU64,
    done: u64,
    total: u64,
+    index: crate::defrag::ClusterIndex,
+    pending: Vec<Pending>,
+    /// Vídeos íntegros achados no carving (início, tamanho): fontes de SPS/PPS.
+    intact_mp4: Vec<(u64, u64)>,
+    refs: Vec<crate::mp4rebuild::MediaConfig>,
+    /// Extents de arquivos carved já emitidos (não podem servir de fragmento para outro).
+    carved: Vec<Extent>,
+}
+
+impl Handler<'_> {
+    fn rebuild_mp4(&mut self, p: Pending, off: u64) {
+        // Referências: as informadas pelo usuário e os vídeos íntegros mais próximos no disco.
+        let mut refs = self.refs.clone();
+        let mut near = self.intact_mp4.clone();
+        near.sort_by_key(|&(o, _)| o.abs_diff(off));
+        for (o, l) in near.into_iter().take(6) {
+            if let Some(c) = crate::mp4rebuild::config_from_mp4(self.src, o, l) {
+                refs.push(c);
+            }
+        }
+        let Some(r) = crate::mp4rebuild::rebuild(self.src, off, p.hit_len, &refs) else {
+            return;
+        };
+        let Ok(pre) = crate::source::read_vec(self.src, off, r.pre_len as usize) else {
+            return;
+        };
+        let payload_len = r.payload.1 - r.payload.0;
+        let mut f = p.found;
+        let hdr = r.mdat_header();
+        f.size = pre.len() as u64 + hdr.len() as u64 + payload_len + r.moov.len() as u64;
+        f.data = DataLoc::Parts {
+            parts: vec![
+                Part::Bytes { bytes: pre },
+                Part::Bytes { bytes: hdr },
+                Part::Run {
+                    offset: r.payload.0,
+                    len: payload_len,
+                },
+                Part::Bytes { bytes: r.moov },
+            ],
+        };
+        f.ext = "mp4".into();
+        f.name = format!("arquivo_{:06}.mp4", f.id);
+        f.confidence = Confidence::Medium;
+        f.note = Some(format!(
+            "índice (moov) reconstruído: {} quadros {}x{} a {:.1} fps, sem áudio; ajuste de tempo aproximado",
+            r.frames, r.width, r.height, r.fps
+        ));
+        self.carved.push(Extent::new(r.payload.0, payload_len));
+        self.sink.replace(f);
+    }
+
+    fn rebuild_pending(&mut self) {
+        let pend = std::mem::take(&mut self.pending);
+        for p in pend {
+            let off = p.found.first_offset().unwrap_or(0);
+            if p.mp4 {
+                self.rebuild_mp4(p, off);
+                continue;
+            }
+            let mut used = self.fs_extents.clone();
+            used.extend(self.carved.iter().copied());
+            // O próprio começo do arquivo não conta como "ocupado" para ele mesmo.
+            used.retain(|e| !(e.offset == off));
+            let pool = crate::defrag::Pool {
+                index: &self.index,
+                used: &used,
+            };
+            if let crate::defrag::Analysis::Rebuilt { extents, size } =
+                crate::defrag::analyze_jpeg(self.src, off, p.hit_len, &pool, true)
+            {
+                let mut f = p.found;
+                f.size = size;
+                f.data = DataLoc::Extents {
+                    extents: extents.clone(),
+                };
+                f.confidence = Confidence::Medium;
+                f.note = Some(format!(
+                    "remontado a partir de {} fragmentos separados no disco; confira a imagem",
+                    extents.len()
+                ));
+                self.carved.extend(extents);
+                self.sink.replace(f);
+            }
+        }
+    }
 }

 impl CarveEvents for Handler<'_> {
+    fn chunk(&mut self, abs: u64, data: &[u8]) {
+        self.index.scan_chunk(abs, data);
+    }
+
    fn advance(&mut self, n: u64) {
        self.done += n;
        self.sink.progress(Progress {
@@ -233,6 +367,38 @@ impl CarveEvents for Handler<'_> {
        if overlaps(&self.fs_extents, off, 1) {
            return HitAction::Continue; // dentro de arquivo já listado (ex.: miniatura embutida)
        }
+        let mut hit = hit.clone();
+        let mut skip_len = None;
+        let mut pending_len = None;
+        if hit.ext == "jpg" {
+            let pool = crate::defrag::Pool {
+                index: &self.index,
+                used: &[],
+            };
+            match crate::defrag::analyze_jpeg(self.src, off, hit.len, &pool, false) {
+                crate::defrag::Analysis::Intact { len } => {
+                    hit.len = len;
+                    hit.confidence = Confidence::High;
+                }
+                crate::defrag::Analysis::Broken { good_len } => {
+                    pending_len = Some(hit.len);
+                    hit.len = good_len;
+                    hit.confidence = Confidence::Low;
+                    skip_len = Some(good_len);
+                }
+                crate::defrag::Analysis::Unsupported | crate::defrag::Analysis::Rebuilt { .. } => {}
+            }
+        }
+        let mut pending_mp4 = false;
+        if matches!(hit.ext, "mp4" | "mov" | "m4v" | "3gp") {
+            if hit.confidence == Confidence::High {
+                self.intact_mp4.push((off, hit.len));
+            } else {
+                pending_mp4 = true;
+                pending_len = Some(hit.len);
+            }
+        }
+        let hit = &hit;
        let id = self
            .next_id
            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
@@ -263,8 +429,25 @@ impl CarveEvents for Handler<'_> {
            },
        };
        self.starts.insert(off, (id, hit.confidence));
+        self.carved.push(Extent::new(off, hit.len));
+        if let Some(hl) = pending_len {
+            let mut pf = f.clone();
+            pf.note = Some(if pending_mp4 {
+                "vídeo sem índice (moov)".into()
+            } else {
+                "JPEG interrompido ou fragmentado".into()
+            });
+            self.pending.push(Pending {
+                found: pf,
+                hit_len: hl,
+                mp4: pending_mp4,
+            });
+        }
        self.sink.found(f);
-        HitAction::Skip
+        match skip_len {
+            Some(n) => HitAction::SkipLen(n),
+            None => HitAction::Skip,
+        }
    }
 }

@@ -289,7 +472,7 @@ fn build_ranges(
    let free = merge_extents(free.to_vec());
    let mut out: Vec<Extent> = vec![];
    for p in &layout.partitions {
-        if p.encrypted.is_some() {
+        if p.encrypted.is_some() || opts.covered.contains(&p.start) {
            continue;
        }
        let whole = Extent::new(p.start, p.len.min(disk_size.saturating_sub(p.start)));
@@ -137,6 +137,17 @@ impl Sink for JobSink {
            s.found[i].confidence = s.found[i].confidence.max(c);
        }
    }
+    fn replace(&mut self, f: Found) {
+        let mut s = self.0.st.lock().unwrap();
+        match s.index.get(&f.id).copied() {
+            Some(i) => s.found[i] = f,
+            None => {
+                let i = s.found.len();
+                s.index.insert(f.id, i);
+                s.found.push(f);
+            }
+        }
+    }
    fn progress(&mut self, p: Progress) {
        self.0.st.lock().unwrap().progress = p;
    }
@@ -204,10 +215,38 @@ impl Engine {

    // ---------------------------------------------------------------- varredura

-    pub fn start_scan(&self, path: &str, opts: ScanOptions) -> Result<String> {
-        let src = open_path(Path::new(path)).map_err(|e| open_error(path, e))?;
-        let fp = crate::source::fingerprint(src.as_ref());
-        let job = self.register(JobKind::Scan, path.to_string(), opts, Some(src));
+    pub fn start_scan(&self, path: &str, mut opts: ScanOptions) -> Result<String> {
+        let raw = open_path(Path::new(path)).map_err(|e| open_error(path, e))?;
+        let fp = crate::source::fingerprint(raw.as_ref());
+        let asm = crate::assemble::assemble_source(raw, &opts.assembly)?;
+        opts.extra_parts = asm.extra_parts.clone();
+        opts.covered = asm.covered.clone();
+        opts.skip_primary = asm.skip_primary;
+        if opts.assembly.remember_keys {
+            opts.assembly.keys = asm.keys.clone();
+        }
+        let job = self.register(
+            JobKind::Scan,
+            path.to_string(),
+            opts,
+            Some(asm.source.clone()),
+        );
+        {
+            let mut s = job.st.lock().unwrap();
+            for u in &asm.unlocked {
+                s.warnings.push(format!(
+                    "Volume cifrado aberto na posição {}: {}.",
+                    u.start, u.description
+                ));
+            }
+            for l in &asm.locked {
+                s.warnings.push(format!(
+                    "Volume cifrado na posição {} não foi aberto: {}.",
+                    l.start, l.reason
+                ));
+            }
+            s.warnings.extend(asm.notes.iter().cloned());
+        }
        *job.fingerprint.lock().unwrap() = fp;
        *job.session_file.lock().unwrap() = Some(new_session_path(path));
        spawn_scan(job.clone(), None);
@@ -520,6 +559,17 @@ impl Engine {
    // ---------------------------------------------------------------- imagem

    pub fn start_image(&self, path: &str, dest: &str) -> Result<String> {
+        self.start_image_as(path, dest, &image::ImageFormat::Raw)
+    }
+
+    /// Cria a imagem em bruto ou em outro formato forense (E01 ou AFF4).
+    pub fn start_image_as(
+        &self,
+        path: &str,
+        dest: &str,
+        format: &image::ImageFormat,
+    ) -> Result<String> {
+        let format = format.clone();
        let src = open_path(Path::new(path)).map_err(|e| open_error(path, e))?;
        recover::check_destination(
            Some(Path::new(path)),
@@ -542,7 +592,7 @@ impl Engine {
                    total: t,
                };
            };
-            let res = image::create_image(src.as_ref(), &dest, &cancelled, &mut prog);
+            let res = image::create_image_as(src.as_ref(), &dest, &format, &cancelled, &mut prog);
            let mut s = j2.st.lock().unwrap();
            match res {
                Ok(rep) => {
@@ -735,6 +785,17 @@ impl Engine {
                "O arquivo {path} não é uma sessão do Guará válida (ou foi criado por uma versão incompatível): {e}"
            ))
        })?;
+        // Clicar de novo numa sessão já aberta reaproveita o job em vez de criar outro igual.
+        let want = Path::new(path);
+        if let Some(j) = self
+            .jobs
+            .lock()
+            .unwrap()
+            .values()
+            .find(|j| j.session_file.lock().unwrap().as_deref() == Some(want))
+        {
+            return Ok(j.id.clone());
+        }
        let job = self.register(
            JobKind::Scan,
            data.target.clone(),
@@ -803,8 +864,14 @@ impl Engine {
        let mut last_err = None;
        for path in &tried {
            match open_path(Path::new(path)) {
-                Ok(src) if crate::reconnect::matches(src.as_ref(), size, fp.as_deref()) => {
-                    *j.src.lock().unwrap() = Some(src);
+                Ok(src)
+                    if crate::reconnect::matches(
+                        src.as_ref(),
+                        if j.opts.assembly.is_plain() { size } else { 0 },
+                        fp.as_deref(),
+                    ) =>
+                {
+                    *j.src.lock().unwrap() = Some(finish_source(j, src));
                    *j.src_path.lock().unwrap() = path.clone();
                    return Ok(None);
                }
@@ -815,7 +882,7 @@ impl Engine {
        if let Some((path, src)) =
            crate::reconnect::find_matching_source(size, fp.as_deref(), &tried)
        {
-            *j.src.lock().unwrap() = Some(src);
+            *j.src.lock().unwrap() = Some(finish_source(j, src));
            *j.src_path.lock().unwrap() = path.clone();
            return Ok(Some(path));
        }
@@ -852,7 +919,7 @@ impl Engine {
        if fp.is_none() {
            *j.fingerprint.lock().unwrap() = crate::source::fingerprint(src.as_ref());
        }
-        *j.src.lock().unwrap() = Some(src);
+        *j.src.lock().unwrap() = Some(finish_source(&j, src));
        *j.src_path.lock().unwrap() = path.to_string();
        j.st.lock()
            .unwrap()
@@ -951,8 +1018,40 @@ impl Engine {
            "devices" => json!(device::list_devices()),
            "inspect" => {
                let path = s("path")?;
-                let src = open_path(Path::new(&path)).map_err(|e| open_error(&path, e))?;
-                json!(partition::analyze(src.as_ref(), false))
+                let asm: crate::assemble::Assembly = p
+                    .get("assembly")
+                    .cloned()
+                    .map(serde_json::from_value)
+                    .transpose()?
+                    .unwrap_or_default();
+                let raw = open_path(Path::new(&path)).map_err(|e| open_error(&path, e))?;
+                let a = crate::assemble::assemble_source(raw, &asm)?;
+                let mut layout = partition::analyze(a.source.as_ref(), false);
+                if a.skip_primary {
+                    layout.partitions.clear();
+                    layout.gaps.clear();
+                    layout.table = "membro de RAID".into();
+                }
+                for pi in &a.extra_parts {
+                    if !layout.partitions.iter().any(|q| q.start == pi.start) {
+                        let mut pi = pi.clone();
+                        pi.index = layout.partitions.len();
+                        layout.partitions.push(pi);
+                    }
+                }
+                layout.warnings.extend(a.notes.iter().cloned());
+                for u in &a.unlocked {
+                    layout
+                        .warnings
+                        .push(format!("Volume aberto em {}: {}.", u.start, u.description));
+                }
+                for l in &a.locked {
+                    layout.warnings.push(format!(
+                        "Volume cifrado em {} continua fechado: {}.",
+                        l.start, l.reason
+                    ));
+                }
+                json!(layout)
            }
            "scan_start" => {
                let opts: ScanOptions = p
@@ -1085,7 +1184,15 @@ impl Engine {
                    .unwrap_or_default();
                json!({ "job": self.start_recover(&s("job")?, ids, filter, &s("dest")?, layout)? })
            }
-            "image_start" => json!({ "job": self.start_image(&s("path")?, &s("dest")?)? }),
+            "image_start" => {
+                let format: image::ImageFormat = p
+                    .get("format")
+                    .cloned()
+                    .map(serde_json::from_value)
+                    .transpose()?
+                    .unwrap_or(image::ImageFormat::Raw);
+                json!({ "job": self.start_image_as(&s("path")?, &s("dest")?, &format)? })
+            }
            "session_save" => {
                self.save_session(&s("job")?, &s("path")?)?;
                json!({})
@@ -1472,6 +1579,14 @@ impl Engine {

 // ---------------------------------------------------------------- sessões automáticas

+/// Reaplica ao disco reaberto a montagem (volumes desbloqueados, RAID) da sessão.
+fn finish_source(j: &Job, raw: Arc<dyn Source>) -> Arc<dyn Source> {
+    match crate::assemble::assemble_source(raw.clone(), &j.opts.assembly) {
+        Ok(a) => a.source,
+        Err(_) => raw,
+    }
+}
+
 fn sessions_dir() -> PathBuf {
    crate::settings::config_dir().join("sessoes")
 }
@@ -1499,10 +1614,16 @@ fn new_session_path(target: &str) -> PathBuf {

 fn snapshot(j: &Job) -> SessionFile {
    let s = j.st.lock().unwrap();
+    // Senhas e chaves nunca vão para o arquivo de sessão (só as chaves de volume, se o usuário pediu).
+    let mut options = j.opts.clone();
+    options.assembly.secrets.clear();
+    if !options.assembly.remember_keys {
+        options.assembly.keys.clear();
+    }
    SessionFile {
        version: 1,
        target: j.target.clone(),
-        options: j.opts.clone(),
+        options,
        found: s.found.clone(),
        checkpoint: s.checkpoint.clone(),
        layout: s.layout.clone(),
@@ -18,15 +18,21 @@ pub struct Hit {
 pub fn category_for_ext(ext: &str) -> Category {
    match ext.to_ascii_lowercase().as_str() {
        "jpg" | "jpeg" | "png" | "gif" | "bmp" | "webp" | "heic" | "avif" | "tif" | "tiff"
-        | "psd" | "svg" | "ico" | "cr2" | "nef" | "dng" => Category::Image,
+        | "psd" | "svg" | "ico" | "cr2" | "nef" | "dng" | "jp2" => Category::Image,
        "pdf" | "doc" | "docx" | "xls" | "xlsx" | "ppt" | "pptx" | "odt" | "ods" | "odp"
-        | "txt" | "rtf" | "epub" | "md" | "csv" | "html" | "xml" | "json" => Category::Document,
-        "mp4" | "mov" | "m4v" | "avi" | "mkv" | "webm" | "wmv" | "flv" | "mpg" | "mpeg" | "3gp" => {
-            Category::Video
+        | "txt" | "rtf" | "epub" | "md" | "csv" | "html" | "xml" | "json" | "swf" => {
+            Category::Document
+        }
+        "mp4" | "mov" | "m4v" | "avi" | "mkv" | "webm" | "wmv" | "flv" | "mpg" | "mpeg" | "3gp"
+        | "ts" => Category::Video,
+        "mp3" | "wav" | "flac" | "ogg" | "m4a" | "aac" | "wma" | "opus" | "mid" | "aif" => {
+            Category::Audio
+        }
+        "zip" | "rar" | "7z" | "gz" | "tar" | "bz2" | "xz" | "jar" | "apk" | "zst" | "cab"
+        | "deb" => Category::Archive,
+        "sqlite" | "db" | "sqlite3" | "mdb" | "accdb" | "pst" | "dat" | "evtx" => {
+            Category::Database
        }
-        "mp3" | "wav" | "flac" | "ogg" | "m4a" | "aac" | "wma" | "opus" => Category::Audio,
-        "zip" | "rar" | "7z" | "gz" | "tar" | "bz2" | "xz" | "jar" | "apk" => Category::Archive,
-        "sqlite" | "db" | "sqlite3" | "mdb" | "accdb" => Category::Database,
        _ => Category::Other,
    }
 }
@@ -60,6 +66,21 @@ pub fn matches_ext(ext: &str, head: &[u8]) -> Option<bool> {
        "mkv" | "webm" => starts(&[0x1A, 0x45, 0xDF, 0xA3]),
        "sqlite" | "sqlite3" | "db" => starts(b"SQLite format 3\0"),
        "exe" | "dll" => starts(b"MZ"),
+        "bz2" => starts(b"BZh"),
+        "zst" => starts(&[0x28, 0xB5, 0x2F, 0xFD]),
+        "cab" => starts(b"MSCF"),
+        "deb" => starts(b"!<arch>"),
+        "elf" => starts(&[0x7F, b'E', b'L', b'F']),
+        "tif" | "tiff" => starts(&[b'I', b'I', 42, 0]) || starts(&[b'M', b'M', 0, 42]),
+        "ico" => starts(&[0, 0, 1, 0]),
+        "rtf" => starts(b"{\\rtf"),
+        "swf" => starts(b"FWS") || starts(b"CWS"),
+        "flv" => starts(b"FLV"),
+        "pst" => starts(b"!BDN"),
+        "evtx" => starts(b"ElfFile"),
+        "mid" => starts(b"MThd"),
+        "pcap" => starts(&[0xD4, 0xC3, 0xB2, 0xA1]) || starts(&[0xA1, 0xB2, 0xC3, 0xD4]),
+        "wmv" | "wma" => starts(&[0x30, 0x26, 0xB2, 0x75]),
        _ => return None,
    };
    Some(r)
@@ -68,23 +89,24 @@ pub fn matches_ext(ext: &str, head: &[u8]) -> Option<bool> {
 /// Tabela de primeiros bytes -> detectores candidatos.
 /// O carving consulta `candidates(first_byte)` e chama `detect`.
 pub fn might_start(b0: u8) -> bool {
-    matches!(
-        b0,
-        0xFF | 0x89
-            | b'G'
-            | b'B'
-            | b'%'
-            | b'P'
-            | 0xD0
-            | b'7'
-            | b'S'
-            | b'R'
-            | b'I'
-            | b'M'
-            | 0x00
-            | b'f'
-            | 0x1F
-    )
+    crate::formats::might_start(b0)
+        || matches!(
+            b0,
+            0xFF | 0x89
+                | b'G'
+                | b'B'
+                | b'%'
+                | b'P'
+                | 0xD0
+                | b'7'
+                | b'S'
+                | b'R'
+                | b'I'
+                | b'M'
+                | 0x00
+                | b'f'
+                | 0x1F
+        )
 }

 const MAX_HEADER: usize = 64 * 1024;
@@ -135,7 +157,7 @@ pub fn detect(src: &dyn Source, off: u64, head: &[u8], max_size: u64) -> Option<
    if h.starts_with(b"MZ") {
        return pe(src, off, max_size);
    }
-    None
+    crate::formats::detect(src, off, h, max_size)
 }

 // ---------------------------------------------------------------- JPEG
@@ -272,7 +272,21 @@ pub fn open_path(path: &Path) -> io::Result<Arc<dyn Source>> {
            return Ok(Arc::new(open_windows_device(path)?));
        }
    }
-    Ok(Arc::new(FileSource::open(path)?))
+    let file = FileSource::open(path)?;
+    // Imagens forenses EWF (E01/Ex01) são abertas como o disco que contêm.
+    let mut head = [0u8; 96];
+    let got = file.read_at(0, &mut head).unwrap_or(0);
+    if got >= 4 && head.starts_with(b"PK") && crate::aff4::is_aff4(&head[..got]) {
+        let a = crate::aff4::Aff4Source::open(path)
+            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e.to_string()))?;
+        return Ok(Arc::new(a));
+    }
+    if got >= 8 && crate::ewf::is_ewf_header(&head) {
+        let e = crate::ewf::EwfSource::open(path)
+            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e.to_string()))?;
+        return Ok(Arc::new(e));
+    }
+    Ok(Arc::new(file))
 }

 /// Identidade do conteúdo de um disco: SHA-256 do tamanho + primeiro e último MiB
@@ -106,6 +106,149 @@ pub enum DataLoc {
    Extents {
        extents: Vec<Extent>,
    },
+    /// Arquivo montado: trechos em memória (cabeçalhos refeitos) e trechos do disco.
+    Parts {
+        parts: Vec<Part>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "part", rename_all = "lowercase")]
+pub enum Part {
+    Bytes {
+        #[serde(with = "b64")]
+        bytes: Vec<u8>,
+    },
+    /// Trecho contíguo da origem.
+    Run { offset: u64, len: u64 },
+    /// Zeros (buracos de arquivos esparsos).
+    Zeros { len: u64 },
+    /// Extensão comprimida na origem (Btrfs): descompactada ao ler.
+    Packed(Packed),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum PackedCodec {
+    Zlib,
+    Zstd,
+    Lzo,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Packed {
+    /// Onde estão os bytes comprimidos na origem.
+    pub offset: u64,
+    pub disk_len: u64,
+    /// Tamanho da extensão depois de descompactada.
+    pub ram_len: u64,
+    /// Bytes a pular no começo da extensão descompactada.
+    pub skip: u64,
+    /// Bytes úteis a partir de `skip`.
+    pub len: u64,
+    pub codec: PackedCodec,
+}
+
+impl Packed {
+    /// Descompacta a extensão e devolve os `len` bytes úteis.
+    pub fn read(&self, src: &dyn crate::source::Source) -> std::io::Result<Vec<u8>> {
+        use std::io::Read;
+        let raw = crate::source::read_vec(src, self.offset, self.disk_len as usize)?;
+        let bad = |m: &str| {
+            std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("extensão comprimida ilegível ({m})"),
+            )
+        };
+        let mut data = match self.codec {
+            PackedCodec::Zlib => {
+                let mut v = Vec::with_capacity(self.ram_len as usize);
+                flate2::read::ZlibDecoder::new(&raw[..])
+                    .read_to_end(&mut v)
+                    .map_err(|_| bad("zlib"))?;
+                v
+            }
+            PackedCodec::Zstd => {
+                let mut v = Vec::with_capacity(self.ram_len as usize);
+                ruzstd::StreamingDecoder::new(&raw[..])
+                    .map_err(|_| bad("zstd"))?
+                    .read_to_end(&mut v)
+                    .map_err(|_| bad("zstd"))?;
+                v
+            }
+            PackedCodec::Lzo => crate::fs::btrfs::lzo_btrfs(&raw, self.ram_len as usize)
+                .ok_or_else(|| bad("lzo"))?,
+        };
+        data.resize(self.ram_len.max(data.len() as u64) as usize, 0);
+        let s = (self.skip as usize).min(data.len());
+        let e = (s + self.len as usize).min(data.len());
+        let mut v = data[s..e].to_vec();
+        v.resize(self.len as usize, 0);
+        Ok(v)
+    }
+}
+
+impl Part {
+    pub fn len(&self) -> u64 {
+        match self {
+            Part::Bytes { bytes } => bytes.len() as u64,
+            Part::Run { len, .. } | Part::Zeros { len } => *len,
+            Part::Packed(p) => p.len,
+        }
+    }
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+mod b64 {
+    use serde::{Deserialize, Deserializer, Serializer};
+    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+    #[allow(clippy::ptr_arg)]
+    pub fn serialize<S: Serializer>(b: &Vec<u8>, s: S) -> Result<S::Ok, S::Error> {
+        let mut out = String::with_capacity(b.len().div_ceil(3) * 4);
+        for c in b.chunks(3) {
+            let n = (c[0] as u32) << 16
+                | (*c.get(1).unwrap_or(&0) as u32) << 8
+                | *c.get(2).unwrap_or(&0) as u32;
+            out.push(T[(n >> 18) as usize & 63] as char);
+            out.push(T[(n >> 12) as usize & 63] as char);
+            out.push(if c.len() > 1 {
+                T[(n >> 6) as usize & 63] as char
+            } else {
+                '='
+            });
+            out.push(if c.len() > 2 {
+                T[n as usize & 63] as char
+            } else {
+                '='
+            });
+        }
+        s.serialize_str(&out)
+    }
+    pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<Vec<u8>, D::Error> {
+        let s = String::deserialize(d)?;
+        let mut out = vec![];
+        let (mut acc, mut bits) = (0u32, 0);
+        for c in s.bytes() {
+            let v = match c {
+                b'A'..=b'Z' => c - b'A',
+                b'a'..=b'z' => c - b'a' + 26,
+                b'0'..=b'9' => c - b'0' + 52,
+                b'+' => 62,
+                b'/' => 63,
+                _ => continue,
+            } as u32;
+            acc = (acc << 6) | v;
+            bits += 6;
+            if bits >= 8 {
+                bits -= 8;
+                out.push((acc >> bits) as u8);
+                acc &= (1 << bits) - 1;
+            }
+        }
+        Ok(out)
+    }
 }

 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
@@ -114,9 +257,32 @@ pub enum Origin {
    Ntfs,
    Fat,
    Exfat,
+    Ext,
+    Btrfs,
+    Xfs,
+    Hfs,
+    Apfs,
+    Refs,
    Carved,
 }

+impl Origin {
+    pub fn label(self) -> &'static str {
+        match self {
+            Origin::Carved => "assinatura",
+            Origin::Ntfs => "NTFS",
+            Origin::Fat => "FAT",
+            Origin::Exfat => "exFAT",
+            Origin::Ext => "ext4",
+            Origin::Btrfs => "Btrfs",
+            Origin::Xfs => "XFS",
+            Origin::Hfs => "HFS+",
+            Origin::Apfs => "APFS",
+            Origin::Refs => "ReFS",
+        }
+    }
+}
+
 /// Um arquivo encontrado (apagado, perdido ou reconstruído por assinatura).
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Found {
@@ -165,6 +331,10 @@ impl Found {
        match &self.data {
            DataLoc::Extents { extents } => extents.iter().find(|e| !e.sparse).map(|e| e.offset),
            DataLoc::Resident { .. } => None,
+            DataLoc::Parts { parts } => parts.iter().find_map(|p| match p {
+                Part::Run { offset, .. } => Some(*offset),
+                _ => None,
+            }),
        }
    }

@@ -187,8 +357,17 @@ pub enum FsKind {
    Ext,
    Apfs,
    HfsPlus,
+    Btrfs,
+    Xfs,
+    Refs,
    Bitlocker,
    Luks,
+    /// FileVault 2 (Core Storage).
+    Corestorage,
+    /// Membro de volume LVM (physical volume).
+    Lvm,
+    /// Membro de RAID por software (mdadm).
+    Raid,
    Unknown,
 }

@@ -203,8 +382,14 @@ impl FsKind {
            FsKind::Ext => "ext2/3/4",
            FsKind::Apfs => "APFS",
            FsKind::HfsPlus => "HFS+",
+            FsKind::Btrfs => "Btrfs",
+            FsKind::Xfs => "XFS",
+            FsKind::Refs => "ReFS",
            FsKind::Bitlocker => "BitLocker",
            FsKind::Luks => "LUKS",
+            FsKind::Corestorage => "FileVault 2",
+            FsKind::Lvm => "LVM",
+            FsKind::Raid => "RAID (mdadm)",
            FsKind::Unknown => "desconhecido",
        }
    }
@@ -214,6 +399,7 @@ impl FsKind {
        match self {
            FsKind::Bitlocker => Some("BitLocker"),
            FsKind::Luks => Some("LUKS"),
+            FsKind::Corestorage => Some("FileVault 2"),
            _ => None,
        }
    }
@@ -222,7 +408,16 @@ impl FsKind {
    pub fn has_metadata_scanner(self) -> bool {
        matches!(
            self,
-            FsKind::Ntfs | FsKind::Fat12 | FsKind::Fat16 | FsKind::Fat32 | FsKind::Exfat
+            FsKind::Ntfs
+                | FsKind::Fat12
+                | FsKind::Fat16
+                | FsKind::Fat32
+                | FsKind::Exfat
+                | FsKind::Ext
+                | FsKind::HfsPlus
+                | FsKind::Btrfs
+                | FsKind::Xfs
+                | FsKind::Apfs
        )
    }
 }
@@ -279,6 +474,21 @@ pub struct ScanOptions {
    /// Tamanho máximo aceito para arquivos carved (bytes).
    #[serde(default = "default_max_carve")]
    pub max_carve_size: u64,
+    /// Membros extras (RAID/LVM) e segredos para volumes cifrados.
+    #[serde(default)]
+    pub assembly: crate::assemble::Assembly,
+    /// Partições que não estão na tabela do disco (volumes lógicos, desbloqueados).
+    #[serde(default)]
+    pub extra_parts: Vec<PartInfo>,
+    /// Partições que só contêm RAID/LVM remontado: a varredura entra pelos volumes virtuais.
+    #[serde(default)]
+    pub covered: Vec<u64>,
+    /// O disco principal é só membro de RAID sem metadados: varre apenas os volumes virtuais.
+    #[serde(default)]
+    pub skip_primary: bool,
+    /// Vídeos íntegros da mesma câmera/drone: fornecem SPS/PPS para remontar MP4 sem moov.
+    #[serde(default)]
+    pub references: Vec<String>,
 }

 fn default_max_carve() -> u64 {
@@ -292,6 +502,11 @@ impl Default for ScanOptions {
            include_allocated: false,
            categories: vec![],
            max_carve_size: default_max_carve(),
+            assembly: Default::default(),
+            extra_parts: vec![],
+            covered: vec![],
+            skip_primary: false,
+            references: vec![],
        }
    }
 }
Author	SHA1	Message	Date
Lucas RayanandClaude Opus 5.5	beb83fef92	Formatação (cargo fmt) e ajustes do clippy para o CI da 1.0.0 Release / Cria a release (push) Canceled after 0s Details Release / CLI (linux-aarch64) (push) Canceled after 0s Details Release / CLI (linux-x86_64) (push) Canceled after 0s Details Release / CLI (macos-aarch64) (push) Canceled after 0s Details Release / CLI (macos-x86_64) (push) Canceled after 0s Details Release / CLI (windows-x86_64) (push) Canceled after 0s Details Release / App desktop (linux-x86_64) (push) Canceled after 0s Details Release / App desktop (macos-aarch64) (push) Canceled after 0s Details Release / App desktop (macos-x86_64) (push) Canceled after 0s Details Release / App desktop (windows-x86_64) (push) Canceled after 0s Details Release / Publica a release (push) Canceled after 0s Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-19 11:41:58 -03:00
Lucas RayanandClaude Sonnet 5.5	74218e7beb	Versão 1.0.0: interface com senha, RAID, referência de vídeo e formatos de imagem; changelog Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 01:37:07 -03:00
Lucas RayanandClaude Sonnet 5.5	6fcbe773a1	APFS: contêiner, mapa de objetos, árvore de arquivos, instantâneos e nós antigos Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 01:33:14 -03:00
Lucas RayanandClaude Sonnet 5.5	465bb672bd	XFS: espaço livre por AG e arquivos apagados (extents sobrando no inode livre + nome da entrada liberada) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 00:23:47 -03:00
Lucas RayanandClaude Sonnet 5.5	0ced7b725a	Btrfs: árvores atuais, mapa livre e arquivos apagados em versões antigas de nós; extensões comprimidas (zlib, zstd, lzo) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 00:19:47 -03:00
Lucas RayanandClaude Sonnet 5.5	a017d79b00	24 formatos novos reconhecidos pela estrutura (gz, bz2, zst, mkv/webm, ogg, rar, elf, tiff/cr2, ico, regf, evtx, ts, cab, deb, swf, wmv, pst, flv, jp2, rtf, midi, aiff, pcap, pcapng) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 00:15:04 -03:00
Lucas RayanandClaude Sonnet 5.5	b89d5dd490	AFF4: leitura (snappy/deflate/LZ4, mapas esparsos) e gravação; CLI --format aff4 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 00:11:36 -03:00
Lucas RayanandClaude Sonnet 5.5	b02bbcb7d6	CLI: senhas, chaves, membros de RAID, referências de vídeo, imagem E01 e verify Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 00:08:47 -03:00
Lucas RayanandClaude Sonnet 5.5	df194edb2f	Reconstrução de vídeo MP4/MOV sem moov (H.264/HEVC) com referência de câmera e arquivos montados em partes Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-19 00:06:25 -03:00
Lucas RayanandClaude Sonnet 5.5	8fdb931c49	Ajusta teste da varredura rápida: o ext4 agora lê metadados Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:48:45 -03:00
Lucas RayanandClaude Sonnet 5.5	7f00445d67	Carving de JPEG fragmentado: decodificador de entropia, índice de clusters e remontagem de até três fragmentos Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:46:47 -03:00
Lucas RayanandClaude Sonnet 5.5	a9ac1dddba	HFS+: catálogo, mapa livre, registros apagados em sobras de nós e no diário Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:31:49 -03:00
Lucas RayanandClaude Sonnet 5.5	b8dfe21fd7	Detecção automática de parâmetros de RAID sem metadados e montagem integrada Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:29:11 -03:00
Lucas RayanandClaude Sonnet 5.5	5d45273e0d	RAID (0/1/4/5/6/10/linear, mdadm 0.90 e 1.x, degradado) e LVM2 remontados no disco virtual Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:24:41 -03:00
Lucas RayanandClaude Sonnet 5.5	c014526761	Montagem de discos virtuais: desbloqueio de LUKS, BitLocker e FileVault 2 integrado à varredura e à recuperação Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:18:04 -03:00
Lucas RayanandClaude Sonnet 5.5	a2ce82315e	FileVault 2 (Core Storage): confere com o hash SHA-256 de referência do cryptsetup Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:15:25 -03:00
Lucas RayanandClaude Sonnet 5.5	86344c0536	ext4 com diário e entradas apagadas; LUKS1/2 e BitLocker (todas as imagens de referência do cryptsetup) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:12:28 -03:00
Lucas RayanandClaude Sonnet 5.5	b1ac320193	Corrige sessões duplicadas ao reabrir uma sessão recente Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 23:09:26 -03:00
Lucas RayanandClaude Sonnet 5.5	627eae1b8b	Imagens forenses E01 e Ex01: leitura (deflate, bzip2, padrão, multi-segmento) e gravação de E01 Validado contra o libewf (ewfverify) e imagens de referência geradas por ele. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-18 22:53:01 -03:00
Lucas RayanandClaude Opus 5.5	c3b5f79009	Versão 0.6.0: saúde do disco no estilo do CrystalDiskInfo e nova logo Release / Cria a release (push) Canceled after 0s Details Release / CLI (linux-aarch64) (push) Canceled after 0s Details Release / CLI (linux-x86_64) (push) Canceled after 0s Details Release / CLI (macos-aarch64) (push) Canceled after 0s Details Release / CLI (macos-x86_64) (push) Canceled after 0s Details Release / CLI (windows-x86_64) (push) Canceled after 0s Details Release / App desktop (linux-x86_64) (push) Canceled after 0s Details Release / App desktop (macos-aarch64) (push) Canceled after 0s Details Release / App desktop (macos-x86_64) (push) Canceled after 0s Details Release / App desktop (windows-x86_64) (push) Canceled after 0s Details Release / Publica a release (push) Canceled after 0s Details SMART completo (estado com % de vida útil, temperatura, horas e vezes ligado, total lido/gravado, ficha do dispositivo e tabela de atributos ATA e NVMe), leitura pelo disco que contém a partição e comando `guara health`. Nova logo: a cabeça do guará recortada das trilhas de um disco, nas cores do app. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-18 22:05:48 -03:00
Lucas RayanandClaude Opus 5.5	f65e7ae615	Nova logo em estilo geométrico facetado Cabeça do lobo-guará contornada sobre foto de referência, com as regiões de cor do animal real em tons de verde-azulado e o pescoço se desfazendo em estilhaços. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-18 21:51:44 -03:00