guara/docs/support.md

What Guará supports

English · Português

Matrix of what exists today (version 1.3.2). For what comes next, see the ROADMAP.

Partition tables

MBR and GPT. When the table fails, Guará searches for volumes by signature (NTFS, FAT, exFAT, ext, APFS, HFS+, BitLocker, LUKS) and also examines the unpartitioned space.

File systems

"Metadata" means Guará reads the file system structure and returns name, folder and dates. Without it, recovery depends only on carving, which returns the content without a name.

File system	Metadata	What is used	Limits
NTFS	✅	MFT, deleted records, creation, modification and access dates	Compressed and EFS files are skipped or marked as incomplete; attribute list handled partially
FAT12/16/32	✅	Deleted entries, long names, dates
exFAT	✅	Deleted entries, dates	Covered by a synthetic image; needs validation on more real media
ext2/3/4	✅	Deleted inodes, old copies in the journal (ext4), free block map
HFS+	✅	Leftovers of catalog tree nodes, journal
Btrfs	✅	Old versions of the trees; zlib, zstd and lzo extents
XFS	🟡	Freed inodes, names of freed entries and free space per group (works on simulated deletion); content by carving	Tested with real kernel deletion in CI: the kernel wipes the inode and extents, so names and folders are lost and only carving recovers content. Journal reading is missing
APFS	🟡	Container, object map, file tree, snapshots, old nodes	No free-space map; deletion tested only in simulation
ReFS	❌	Only detected	Recovery through carving
Storage Spaces	❌	Not supported

In every case carving keeps running on the free space and the result is merged without duplicates.

Encrypted volumes

Guará opens the volume with the password or key you provide, mounts a virtual disk and scans inside it. It does not crack passwords.

Format	Accepted credentials
BitLocker	Password, recovery key (8 groups of 6 digits), .BEK file, clear key
LUKS1 and LUKS2	Password, key file, volume key
FileVault 2 (Core Storage)	Password, recovery key, volume key

Passwords are never written to the session file. With --remember-keys the session stores the already derived volume key, not the password. In the terminal, prefer --ask-password or the GUARA_PASSWORD variable over --password, which stays in the shell history.

RAID and LVM

Item	Support
RAID 0, 1, 4, 5, 6, 10 and linear from mdadm superblocks	✅ including degraded (use - in --member for a missing disk)
RAID without metadata	✅ --raid discovers level, stripe size, layout and order; --raid-level, --raid-chunk-kb, --raid-layout and --raid-order fix what you already know
LVM2	✅ linear, striped, mirrored and RAID
Storage Spaces	❌

Forensic images

Format	Read	Write
Raw (dd, .img)	✅	✅ with a bad sector error map
E01 and Ex01 (Expert Witness)	✅	✅ with case metadata and segmentation
AFF4	✅	✅
QCOW2 (QEMU), versions 2 and 3	✅ including compressed clusters (deflate, zstd) and backing files	❌
VMDK (VMware, VirtualBox)	✅ sparse, streamOptimized, descriptors with flat/zero extents and snapshots (parent by name or, for VirtualBox, by UUID)	❌
VHD and VHDX (Hyper-V)	✅ fixed, dynamic and differencing (follows the parent chain)	❌
DMG (Apple UDIF)	✅ zero, raw, ADC, zlib, bzip2 and LZFSE chunks	❌

Virtual disk containers are opened as the disk they hold, with no conversion. Images that cannot be read correctly are refused with the reason: encrypted QCOW2, QCOW2 whose backing file is not a local file, VMDK in SEsparse, and password-protected DMG. Differencing disks (VHD, VHDX, QCOW2 backing file, VMDK snapshot) read the parent for what the child did not write; the parent is found next to the child (VMDK: by name or UUID) and, for VMDK, its CID must match, otherwise the image is refused because the parent changed. The identity of VHD, VHDX and QCOW2 parents is not checked. The VHDX transaction log is not replayed (nothing is ever written to the image).

guara verify recomputes the MD5 of an E01 or Ex01 image and compares it with the one stored in it.

Carving: formats recognized by structure

The detectors read headers, blocks and internal sizes to return the exact size and a confidence, instead of cutting at a fixed number of bytes.

Family	Formats
Image	JPEG, PNG, GIF, BMP, TIFF, ICO, HEIC, WebP
Document	PDF, DOC/XLS/PPT (OLE), DOCX/XLSX/PPTX/ODF/EPUB (ZIP), RTF
Video and audio	MP4/MOV, AVI, WAV, MP3, Matroska/WebM, Ogg, MPEG-TS, FLV, ASF/WMV, MIDI
Compressed	ZIP, 7z, RAR, gzip, zstd, ar
Database and system	SQLite, Windows registry (regf), EVTX, PST, pcap/pcapng, EXE/DLL (PE), ELF, SWF

Fragmented files

• JPEG: reassembled from up to three fragments (jpegscan.rs, defrag.rs).
• MP4/MOV without an index (moov): the index is rebuilt from an intact video from the same camera or drone, passed with --reference. Works with H.264 and HEVC. Audio is not reconstructed.
• Other formats only come out whole if they are contiguous; otherwise they come out truncated with low confidence.

Metadata and preview

Type	What is read
Photos	EXIF: camera, lens, serial number, date, GPS
PDF	Author, program, dates
Office and OpenDocument	Author, last modified by, company
MP4/MOV	Recording date, duration, resolution
SQLite	Schema, tables, blobs, dates, deleted rows from the free space of pages

The preview is read straight from the disk, without writing anything: image, video, audio, PDF, text, Office, ZIP and hex.

Platforms

	CLI	Interface	Tests with real images
Linux	✅	✅ AppImage and deb	✅
Windows	✅	✅ msi and exe	build and synthetic tests only
macOS	✅	✅ dmg	build and synthetic tests only

What Guará does not do

• Recover overwritten data. On an SSD with TRIM the disk itself may zero deleted blocks.
• Unlock phones or bypass passwords and security locks.
• Replace a mobile device extraction tool.
• Produce a report with forensic validity by itself: it has not been through external validation (NIST CFTT) yet. See the ROADMAP.