19 Releases 19 Tags

RSS Feed

• v1.0.0 beb83fef92

  Compare

  Guará 1.0.0 Stable

  lucasrguerra released this 2026-10-30 15:38:29 +00:00 | 97 commits to main since this release

  Added

  • File systems with metadata: ext4 (deleted inodes and old copies in the journal), HFS+ (node leftovers and journal), Btrfs (old versions of the trees; zlib, zstd and lzo extents), XFS (freed inodes and names of freed entries) and APFS (snapshots and old nodes). ReFS is still only detected.
  • Encrypted volumes: BitLocker (password, recovery key, .BEK, clear key), LUKS1/LUKS2 and FileVault 2 (Core Storage) open with the password or key and are scanned inside. Passwords are never written to the session file.
  • RAID and LVM: RAID 0, 1, 4, 5, 6, 10 and linear from mdadm superblocks, including degraded; automatic discovery of level, stripe size, layout and order when there is no metadata; LVM2 (linear, striped, mirrored and RAID).
  • Forensic images: reading of E01/Ex01 and AFF4; writing of E01 and AFF4; guara verify command.
  • Carving: fragmented JPEG reassembled (up to three fragments), index reconstruction for MP4/MOV without moov (H.264/HEVC, with a reference video) and 24 formats recognized by structure.
  • Interface: fields for password, RAID, reference video and image format.

  Fixed

  • Reopening a recent session that is already open no longer creates identical copies in the sessions tab.

  Limitations

  • Storage Spaces and ReFS (metadata) are not supported; XFS and APFS tested with simulated deletions; audio is not reconstructed in MP4 without moov.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)