# What Guará supports

[English](support.md) · [Português](pt-BR/suporte.md)

Matrix of what exists today (version 1.0.0). For what comes next, see the [ROADMAP](../ROADMAP.md).

## Partition tables

MBR and GPT. When the table fails, Guará searches for volumes by signature (NTFS, FAT, exFAT, ext, APFS, HFS+, BitLocker, LUKS) and also examines the **unpartitioned space**.

## File systems

"Metadata" means Guará reads the file system structure and returns **name, folder and dates**. Without it, recovery depends only on carving, which returns the content without a name.

| File system | Metadata | What is used | Limits |
|---|---|---|---|
| NTFS | ✅ | MFT, deleted records, creation, modification and access dates | Compressed and EFS files are skipped or marked as incomplete; attribute list handled partially |
| FAT12/16/32 | ✅ | Deleted entries, long names, dates | |
| exFAT | ✅ | Deleted entries, dates | Covered by a synthetic image; needs validation on more real media |
| ext2/3/4 | ✅ | Deleted inodes, old copies in the journal (ext4), free block map | |
| HFS+ | ✅ | Leftovers of catalog tree nodes, journal | |
| Btrfs | ✅ | Old versions of the trees; zlib, zstd and lzo extents | |
| XFS | ✅ | Freed inodes, names of freed entries, free space per group | Deletion tested only in simulation |
| APFS | 🟡 | Container, object map, file tree, snapshots, old nodes | No free-space map; deletion tested only in simulation |
| ReFS | ❌ | Only detected | Recovery through carving |
| Storage Spaces | ❌ | Not supported | |

In every case carving keeps running on the free space and the result is merged without duplicates.

## Encrypted volumes

Guará opens the volume with the **password or key you provide**, mounts a virtual disk and scans inside it. It does not crack passwords.

| Format | Accepted credentials |
|---|---|
| BitLocker | Password, recovery key (8 groups of 6 digits), `.BEK` file, clear key |
| LUKS1 and LUKS2 | Password, key file, volume key |
| FileVault 2 (Core Storage) | Password, recovery key, volume key |

Passwords are **never** written to the session file. With `--remember-keys` the session stores the already derived volume key, not the password. In the terminal, prefer `--ask-password` or the `GUARA_PASSWORD` variable over `--password`, which stays in the shell history.

## RAID and LVM

| Item | Support |
|---|---|
| RAID 0, 1, 4, 5, 6, 10 and linear from mdadm superblocks | ✅ including degraded (use `-` in `--member` for a missing disk) |
| RAID without metadata | ✅ `--raid` discovers level, stripe size, layout and order; `--raid-level`, `--raid-chunk-kb`, `--raid-layout` and `--raid-order` fix what you already know |
| LVM2 | ✅ linear, striped, mirrored and RAID |
| Storage Spaces | ❌ |

## Forensic images

| Format | Read | Write |
|---|---|---|
| Raw (dd, `.img`) | ✅ | ✅ with a bad sector error map |
| E01 and Ex01 (Expert Witness) | ✅ | ✅ with case metadata and segmentation |
| AFF4 | ✅ | ✅ |

`guara verify` recomputes the MD5 of an E01 or Ex01 image and compares it with the one stored in it.

## Carving: formats recognized by structure

The detectors read headers, blocks and internal sizes to return the **exact size** and a **confidence**, instead of cutting at a fixed number of bytes.

| Family | Formats |
|---|---|
| Image | JPEG, PNG, GIF, BMP, TIFF, ICO, HEIC, WebP |
| Document | PDF, DOC/XLS/PPT (OLE), DOCX/XLSX/PPTX/ODF/EPUB (ZIP), RTF |
| Video and audio | MP4/MOV, AVI, WAV, MP3, Matroska/WebM, Ogg, MPEG-TS, FLV, ASF/WMV, MIDI |
| Compressed | ZIP, 7z, RAR, gzip, zstd, ar |
| Database and system | SQLite, Windows registry (regf), EVTX, PST, pcap/pcapng, EXE/DLL (PE), ELF, SWF |

### Fragmented files

- **JPEG:** reassembled from up to three fragments (`jpegscan.rs`, `defrag.rs`).
- **MP4/MOV without an index (`moov`):** the index is rebuilt from an intact video from the **same camera or drone**, passed with `--reference`. Works with H.264 and HEVC. Audio is not reconstructed.
- Other formats only come out whole if they are contiguous; otherwise they come out truncated with low confidence.

## Metadata and preview

| Type | What is read |
|---|---|
| Photos | EXIF: camera, lens, serial number, date, GPS |
| PDF | Author, program, dates |
| Office and OpenDocument | Author, last modified by, company |
| MP4/MOV | Recording date, duration, resolution |
| SQLite | Schema, tables, blobs, dates, deleted rows from the free space of pages |

The preview is read straight from the disk, without writing anything: image, video, audio, PDF, text, Office, ZIP and hex.

## Platforms

| | CLI | Interface | Tests with real images |
|---|---|---|---|
| Linux | ✅ | ✅ AppImage and deb | ✅ |
| Windows | ✅ | ✅ msi and exe | build and synthetic tests only |
| macOS | ✅ | ✅ dmg | build and synthetic tests only |

## What Guará does not do

- Recover **overwritten** data. On an SSD with TRIM the disk itself may zero deleted blocks.
- Unlock phones or bypass passwords and security locks.
- Replace a mobile device extraction tool.
- Produce a report with forensic validity by itself: it has not been through external validation (NIST CFTT) yet. See the [ROADMAP](../ROADMAP.md).