diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ab3c419
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  # No pip ecosystem entry by design: Strata is standard-library-only in
+  # the engine and in the tests (see CONTRIBUTING.md), so there is no
+  # requirements.txt / pyproject.toml to keep current. Only the CI
+  # tooling itself -- the GitHub Actions used in the workflows -- has
+  # versions worth Dependabot's attention.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..7e1902b
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,56 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly as well as on push: CodeQL's query packs are updated
+    # independently of this repo, so new checks reach unchanged code.
+    - cron: '17 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        # engine/ parses untrusted forensic input (images, filesystems,
+        # registry hives, archives, ...) byte by byte, and web/ is the
+        # local HTTP UI that talks to it -- both are exactly the kind of
+        # code CodeQL is worth running against. No compiled languages
+        # here, so build-mode is always "none".
+        include:
+          - { language: python, build-mode: none }
+          - { language: javascript-typescript, build-mode: none }
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+          paths-ignore: |
+            docs/**
+            **/*.md
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
new file mode 100644
index 0000000..a58147c
--- /dev/null
+++ b/.github/workflows/fuzz.yml
@@ -0,0 +1,60 @@
+name: Fuzz
+
+# Mutation fuzzing of the evidence parsers (tests/fuzz.py).  Kept out of the
+# main CI workflow on purpose: it runs against a time budget rather than to
+# completion, and a finding is something to triage, not a reason to block an
+# unrelated PR.  Findings are uploaded as an artifact with their inputs, and
+# each can be replayed locally with `python3 tests/fuzz.py --replay <file>`.
+
+on:
+  pull_request:
+    paths:
+      - 'engine/**'
+      - 'tests/fuzz.py'
+      - 'tests/imagebuild_*.py'
+  schedule:
+    - cron: '41 4 * * 2'
+  workflow_dispatch:
+    inputs:
+      minutes:
+        description: 'Time budget in minutes'
+        default: '20'
+      target:
+        description: 'Target (all, fat16, ntfs, ext4, hive, ewf, ...)'
+        default: 'all'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz parsers
+    runs-on: ubuntu-latest
+    # A PR gets a short pass over whatever it touched; the weekly run and a
+    # manual dispatch get long enough to find the less shallow problems.
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - name: Run the fuzzer
+        env:
+          MINUTES: ${{ github.event_name == 'pull_request' && '3' || github.event.inputs.minutes || '45' }}
+          TARGET: ${{ github.event.inputs.target || 'all' }}
+        run: |
+          python tests/fuzz.py --minutes "$MINUTES" --target "$TARGET" \
+            --seed "${{ github.run_id }}" --out fuzz-findings
+      - name: Upload findings
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-findings
+          path: fuzz-findings/
+          if-no-files-found: ignore
+          retention-days: 30
diff --git a/.gitignore b/.gitignore
index 19d485d..7b19843 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@
 /exports/
 /reports/
 *-report.html
+/fuzz-findings/
 
 # Python
 __pycache__/
diff --git a/tests/fuzz.py b/tests/fuzz.py
new file mode 100644
index 0000000..079b8c8
--- /dev/null
+++ b/tests/fuzz.py
@@ -0,0 +1,465 @@
+"""Mutation fuzzing for the parsers that read untrusted evidence.
+
+Seeds are the synthetic images from tests/imagebuild_*.py.  Each case takes
+one seed, applies a few random mutations (bit flips, interesting integers,
+truncation, duplicated spans) and drives the same entry points the app uses:
+open the filesystem and walk it, open a hive and walk it, open an E01 and
+read and verify it.
+
+What counts as a finding:
+
+  hang       a single case ran past --case-timeout
+  memory     the worker died or raised MemoryError under --memory-mb
+  exception  anything other than a clean error (ValueError and the engine's
+             own exception classes).  Reported, but only fails the run with
+             --strict, since the server turns these into a 500 rather than
+             losing the session.
+
+Cases run in a child worker so a hang or an out-of-memory kill takes down
+only the worker; the parent records the input and starts a new one.  Every
+finding's input is written to --out with a JSON summary, and can be replayed:
+
+    python3 tests/fuzz.py --minutes 5
+    python3 tests/fuzz.py --target ext4 --cases 2000 --seed 7
+    python3 tests/fuzz.py --replay fuzz-findings/ext4-hang-1a2b3c4d.bin
+
+This is meant for CI (see .github/workflows/fuzz.yml).  The memory cap uses
+RLIMIT_AS and is only enforced on Linux.
+"""
+
+import argparse
+import hashlib
+import json
+import os
+import queue
+import random
+import struct
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import traceback
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ROOT = os.path.dirname(HERE)
+sys.path.insert(0, ROOT)
+sys.path.insert(0, HERE)
+
+# Hard caps inside each case, so a finding is about the parser rather than
+# about the harness asking for too much.
+WALK_BUDGET = 2000
+WALK_DEPTH = 16
+READ_FILES = 40
+READ_BYTES = 1 << 16
+HIVE_KEYS = 2000
+
+
+# --- targets ---------------------------------------------------------------
+
+class BytesImage:
+    """ewf.RawImage stand-in over bytes."""
+
+    bytes_per_sector = 512
+
+    def __init__(self, data):
+        self.data = data
+        self.size = len(data)
+        self.findings = []
+
+    def read_at(self, offset, length):
+        if offset < 0 or length <= 0 or offset >= self.size:
+            return b""
+        return self.data[offset:offset + length]
+
+
+def _root_handle(fs):
+    root = getattr(fs, "root_node", None)
+    if root is None:
+        root = {"NTFS": 5, "ext4": 2, "ext3": 2, "ext2": 2,
+                "APFS": 2}.get(getattr(fs, "name", ""), 0)
+    return root
+
+
+def run_fs(data):
+    from engine import filesearch
+    from engine.ewf import OffsetReader
+    from engine.fs import ntfs
+    src = OffsetReader(BytesImage(data), 0, len(data))
+    fs = ntfs.open_fs(src)
+    if hasattr(fs, "info"):
+        fs.info()
+    entries = filesearch.collect(fs, _root_handle(fs), budget=WALK_BUDGET,
+                                 max_depth=WALK_DEPTH)
+    read = 0
+    for e in entries:
+        if hasattr(fs, "stat"):
+            fs.stat(e)
+        if e.get("is_dir") or read >= READ_FILES:
+            continue
+        fs.read_file(e, READ_BYTES)
+        read += 1
+
+
+def run_volume(data):
+    from engine import volume
+    volume.scan(BytesImage(data))
+
+
+def run_hive(data):
+    from engine import registry
+    hive = registry.open_hive(data, "SOFTWARE")
+    if not hive:
+        return
+    seen = 0
+    stack = [hive.root()]
+    visited = set()
+    while stack and seen < HIVE_KEYS:
+        key = stack.pop()
+        if not key:
+            continue
+        marker = key.get("offset", id(key))
+        if marker in visited:
+            continue
+        visited.add(marker)
+        seen += 1
+        hive.values(key)
+        stack.extend(hive.subkeys(key))
+    hive.carve_deleted(limit=500)
+
+
+def run_reglog(data, _pair=[]):
+    import imagebuild_registry
+    from engine import reglog
+    if not _pair:
+        _pair.extend(imagebuild_registry.build_dirty_pair()[:2])
+    reglog.recover(_pair[0], [data])
+
+
+def run_ewf(data, _dir=[]):
+    from engine import ewf
+    if not _dir:
+        _dir.append(tempfile.mkdtemp(prefix="strata-fuzz-"))
+    path = os.path.join(_dir[0], "case.E01")
+    with open(path, "wb") as fh:
+        fh.write(data)
+    img = ewf.open_image(path)
+    try:
+        step = max(1, min(img.size, 1 << 20) // 64)
+        for off in range(0, min(img.size, 1 << 20), step):
+            img.read_at(off, 4096)
+        img.verify()
+    finally:
+        img.close()
+
+
+def _seeds_fs():
+    import imagebuild_ext4
+    import imagebuild_fat
+    out = {
+        "fat12": lambda: imagebuild_fat.build_fat(12),
+        "fat16": lambda: imagebuild_fat.build_fat(16),
+        # No fat32: its seed is ~34 MB of mostly zeros, so mutations land in
+        # empty space.  fat12 and fat16 drive the same FatFS code paths.
+        "exfat": imagebuild_fat.build_exfat,
+        "ext4": imagebuild_ext4.build_ext4,
+        "ext2": imagebuild_ext4.build_ext2_legacy,
+    }
+    try:
+        import imagebuild_ntfs
+        out["ntfs"] = imagebuild_ntfs.build_ntfs
+    except ImportError:
+        pass
+    return out
+
+
+def targets():
+    """name -> (seed builder, runner)."""
+    import imagebuild_ewf
+    import imagebuild_fat
+    import imagebuild_registry
+    out = {}
+    for name, build in _seeds_fs().items():
+        out[name] = (build, run_fs)
+    out["mbr"] = (lambda: imagebuild_fat.wrap_mbr(imagebuild_fat.build_fat(16)),
+                  run_volume)
+    try:
+        import imagebuild_ntfs
+        out["gpt"] = (lambda: imagebuild_ntfs.wrap_gpt(
+            imagebuild_ntfs.build_ntfs()), run_volume)
+    except ImportError:
+        pass
+    out["hive"] = (imagebuild_registry.build_hive, run_hive)
+    out["reglog"] = (lambda: imagebuild_registry.build_dirty_pair()[1],
+                     run_reglog)
+    out["ewf"] = (lambda: imagebuild_ewf.build_e01()[0], run_ewf)
+    return out
+
+
+# --- mutation --------------------------------------------------------------
+
+INTERESTING = [0, 1, 0x7F, 0x80, 0xFF, 0x100, 0x7FFF, 0x8000, 0xFFFF,
+               0x7FFFFFFF, 0x80000000, 0xFFFFFFFF]
+
+
+def mutate(seed, rng):
+    data = bytearray(seed)
+    for _ in range(rng.randint(1, 8)):
+        if not data:
+            break
+        op = rng.random()
+        pos = rng.randrange(len(data))
+        if op < 0.35:
+            data[pos] ^= 1 << rng.randrange(8)
+        elif op < 0.55:
+            data[pos] = rng.choice((0, 0xFF, 0x7F, 0x80, rng.randrange(256)))
+        elif op < 0.85:
+            width, fmt = rng.choice(((2, "<H"), (4, "<I"), (8, "<Q")))
+            if pos + width <= len(data):
+                v = rng.choice(INTERESTING) & ((1 << (8 * width)) - 1)
+                struct.pack_into(fmt, data, pos, v)
+        elif op < 0.93:
+            size = rng.randint(1, 512)
+            src = rng.randrange(len(data))
+            chunk = data[src:src + size]
+            data[pos:pos + len(chunk)] = chunk
+        else:
+            del data[rng.randint(len(data) // 2, len(data)):]
+    return bytes(data)
+
+
+# --- classification --------------------------------------------------------
+
+def _clean_types():
+    """Exception classes a parser may raise to say "this input is bad"."""
+    from engine import ewf
+    from engine.fs import ntfs
+    types = [ValueError]
+    for mod in (ewf, ntfs):
+        for obj in vars(mod).values():
+            if (isinstance(obj, type) and issubclass(obj, Exception)
+                    and obj.__module__.startswith("engine")):
+                types.append(obj)
+    return tuple(types)
+
+
+def _where(tb):
+    """Innermost engine frame, which is what identifies a bug."""
+    frames = traceback.extract_tb(tb)
+    for fr in reversed(frames):
+        rel = os.path.relpath(fr.filename, ROOT)
+        if rel.startswith("engine"):
+            return "%s:%d" % (rel.replace(os.sep, "/"), fr.lineno)
+    fr = frames[-1] if frames else None
+    return "%s:%d" % (fr.filename, fr.lineno) if fr else "?"
+
+
+# --- worker ----------------------------------------------------------------
+
+def worker(args):
+    if args.memory_mb and sys.platform.startswith("linux"):
+        import resource
+        cap = args.memory_mb * 1024 * 1024
+        resource.setrlimit(resource.RLIMIT_AS, (cap, cap))
+    sys.setrecursionlimit(4000)
+    table = targets()
+    clean = _clean_types()
+    seeds = {}
+    out = sys.stdout
+    for line in sys.stdin:
+        name, case_seed = line.split()
+        build, run = table[name]
+        if name not in seeds:
+            seeds[name] = build()
+        data = mutate(seeds[name], random.Random(int(case_seed)))
+        out.write("start\n")
+        out.flush()
+        result = {"ok": True}
+        try:
+            run(data)
+        except clean:
+            pass
+        except MemoryError:
+            result = {"ok": False, "kind": "memory", "type": "MemoryError",
+                      "where": _where(sys.exc_info()[2])}
+        except RecursionError:
+            result = {"ok": False, "kind": "exception",
+                      "type": "RecursionError",
+                      "where": _where(sys.exc_info()[2])}
+        except Exception as exc:
+            result = {"ok": False, "kind": "exception",
+                      "type": type(exc).__name__, "message": str(exc)[:200],
+                      "where": _where(sys.exc_info()[2])}
+        out.write(json.dumps(result) + "\n")
+        out.flush()
+
+
+class Worker:
+
+    def __init__(self, args):
+        cmd = [sys.executable, os.path.abspath(__file__), "--worker",
+               "--memory-mb", str(args.memory_mb)]
+        self.proc = subprocess.Popen(cmd, stdin=subprocess.PIPE,
+                                     stdout=subprocess.PIPE,
+                                     universal_newlines=True, bufsize=1)
+        self.lines = queue.Queue()
+        t = threading.Thread(target=self._pump, daemon=True)
+        t.start()
+
+    def _pump(self):
+        for line in self.proc.stdout:
+            self.lines.put(line)
+        self.lines.put(None)
+
+    def run(self, name, case_seed, timeout):
+        """Returns a result dict, with kind hang/memory on worker loss."""
+        try:
+            self.proc.stdin.write("%s %d\n" % (name, case_seed))
+            self.proc.stdin.flush()
+        except (BrokenPipeError, OSError):
+            return {"ok": False, "kind": "memory", "type": "worker died"}
+        started = False
+        deadline = time.time() + timeout + 60     # seed build on first use
+        while True:
+            try:
+                line = self.lines.get(timeout=max(0.1, deadline - time.time()))
+            except queue.Empty:
+                if started:
+                    return {"ok": False, "kind": "hang",
+                            "type": "timeout %ss" % timeout}
+                return {"ok": False, "kind": "hang",
+                        "type": "seed build timed out"}
+            if line is None:
+                if not started:
+                    # Died before the case began: an import error or a
+                    # broken seed, not a finding.  Stop rather than respawn.
+                    raise RuntimeError("fuzz worker failed to start %s"
+                                       % name)
+                return {"ok": False, "kind": "memory", "type": "worker died",
+                        "returncode": self.proc.poll()}
+            if line.strip() == "start":
+                started = True
+                deadline = time.time() + timeout
+                continue
+            return json.loads(line)
+
+    def kill(self):
+        try:
+            self.proc.kill()
+            self.proc.wait(5)
+        except Exception:
+            pass
+
+
+# --- driver ----------------------------------------------------------------
+
+def record(args, name, case_seed, result, findings):
+    build, _ = targets()[name]
+    data = mutate(build(), random.Random(case_seed))
+    key = "%s|%s|%s|%s" % (name, result["kind"], result.get("type"),
+                           result.get("where"))
+    if key in findings:
+        findings[key]["count"] += 1
+        return False
+    digest = hashlib.sha256(key.encode()).hexdigest()[:8]
+    stem = "%s-%s-%s" % (name, result["kind"], digest)
+    os.makedirs(args.out, exist_ok=True)
+    with open(os.path.join(args.out, stem + ".bin"), "wb") as fh:
+        fh.write(data)
+    entry = dict(result, target=name, case_seed=case_seed, count=1,
+                 input=stem + ".bin")
+    entry.pop("ok", None)
+    findings[key] = entry
+    return True
+
+
+def fuzz(args):
+    table = targets()
+    names = sorted(table) if args.target == "all" else [args.target]
+    unknown = [n for n in names if n not in table]
+    if unknown:
+        sys.exit("unknown target: %s (have: %s)"
+                 % (", ".join(unknown), ", ".join(sorted(table))))
+    rng = random.Random(args.seed)
+    stop_at = time.time() + args.minutes * 60 if args.minutes else None
+    findings = {}
+    counts = dict((n, 0) for n in names)
+    w = Worker(args)
+    done = 0
+    try:
+        while True:
+            if args.cases and done >= args.cases:
+                break
+            if stop_at and time.time() >= stop_at:
+                break
+            name = names[done % len(names)]
+            case_seed = rng.getrandbits(48)
+            result = w.run(name, case_seed, args.case_timeout)
+            done += 1
+            counts[name] += 1
+            if result.get("ok"):
+                continue
+            if record(args, name, case_seed, result, findings):
+                print("finding: %s %s %s at %s" % (
+                    name, result["kind"], result.get("type"),
+                    result.get("where", "?")))
+                sys.stdout.flush()
+            if result["kind"] in ("hang", "memory"):
+                w.kill()
+                w = Worker(args)
+    finally:
+        w.kill()
+
+    summary = {"cases": done, "per_target": counts,
+               "findings": sorted(findings.values(),
+                                  key=lambda f: (f["kind"], f["target"]))}
+    os.makedirs(args.out, exist_ok=True)
+    with open(os.path.join(args.out, "summary.json"), "w") as fh:
+        json.dump(summary, fh, indent=2)
+    kinds = {}
+    for f in findings.values():
+        kinds[f["kind"]] = kinds.get(f["kind"], 0) + 1
+    print("fuzz: %d cases, %d distinct findings %s"
+          % (done, len(findings), json.dumps(kinds, sort_keys=True)))
+    fatal = kinds.get("hang", 0) + kinds.get("memory", 0)
+    if args.strict:
+        fatal += kinds.get("exception", 0)
+    return 1 if fatal else 0
+
+
+def replay(args):
+    name = os.path.basename(args.replay).split("-")[0]
+    table = targets()
+    if name not in table:
+        sys.exit("cannot tell the target from %s" % args.replay)
+    with open(args.replay, "rb") as fh:
+        data = fh.read()
+    table[name][1](data)
+    print("replay: %s returned without raising" % name)
+    return 0
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("--target", default="all")
+    ap.add_argument("--minutes", type=float, default=0)
+    ap.add_argument("--cases", type=int, default=0)
+    ap.add_argument("--seed", type=int, default=0)
+    ap.add_argument("--case-timeout", type=float, default=10)
+    ap.add_argument("--memory-mb", type=int, default=1024)
+    ap.add_argument("--out", default=os.path.join(ROOT, "fuzz-findings"))
+    ap.add_argument("--strict", action="store_true")
+    ap.add_argument("--replay")
+    ap.add_argument("--worker", action="store_true", help=argparse.SUPPRESS)
+    args = ap.parse_args()
+    if args.worker:
+        return worker(args)
+    if args.replay:
+        return replay(args)
+    if not args.minutes and not args.cases:
+        args.cases = 500
+    return fuzz(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/imagebuild_ewf.py b/tests/imagebuild_ewf.py
new file mode 100644
index 0000000..0ffebba
--- /dev/null
+++ b/tests/imagebuild_ewf.py
@@ -0,0 +1,189 @@
+"""Build synthetic EWF v1 (E01) segment files and split raw sets in memory.
+
+Follows the libewf "Expert Witness Compression Format" specification.
+
+Segment file:
+
+    0     file header (13 bytes): "EVF\\x09\\x0d\\x0a\\xff\\x00", 0x01,
+          segment number (u16), 0x0000
+    13    sections, each starting with a 76-byte descriptor:
+            type (16, NUL padded), next section offset (u64, absolute in
+            this file), section size (u64, descriptor included),
+            40 bytes padding, Adler-32 of the preceding 72 bytes (u32)
+
+Sections written, in order:
+
+    E01:  header, volume, sectors, table, table2, then "hash" + "done" for a
+          single segment or "next" when another segment follows
+    E02+: data (copy of volume), sectors, table, table2, then next/hash+done
+
+    header   zlib-compressed text: "1", "main", tab-separated keys, values
+    volume   1052 bytes: media type @0, chunk count @4, sectors per chunk
+             @8, bytes per sector @12, sector count (u64) @16, media flags
+             @36, compression level @52, ... Adler-32 @1048
+    sectors  chunk data.  Uncompressed chunk = data + Adler-32 (u32 LE);
+             compressed chunk = zlib stream
+    table    entry count (u32), padding (4), base offset (u64), padding (4),
+             Adler-32 of those 20 bytes; entries (u32: offset relative to the
+             base offset, MSB set = compressed); Adler-32 of the entries
+    hash     MD5 (16), unknown (16), Adler-32 (4)
+
+Chunks are CHUNK_SIZE bytes (SECTORS_PER_CHUNK x 512).  build_e01() stores
+even-numbered chunks zlib-compressed and odd ones uncompressed; the media's
+last chunk is short when the sector count is not a whole number of chunks.
+"""
+
+import hashlib
+import struct
+import zlib
+
+EVF_SIG = b"EVF\x09\x0d\x0a\xff\x00"
+SECTOR = 512
+SECTORS_PER_CHUNK = 4
+CHUNK_SIZE = SECTOR * SECTORS_PER_CHUNK
+DESC = 76
+
+HEADER_FIELDS = [("c", "CASE-1"), ("n", "EV-7"), ("a", "synthetic disk"),
+                 ("e", "Examiner"), ("t", "unit test"), ("av", "7.0"),
+                 ("ov", "Linux"), ("m", "2026 9 16 10 0 0"),
+                 ("u", "2026 9 16 10 0 0"), ("p", "0")]
+
+
+def adler(data):
+    return zlib.adler32(data) & 0xFFFFFFFF
+
+
+def media(sectors=14):
+    """Deterministic media content: `sectors` sectors, each distinct."""
+    out = bytearray()
+    for s in range(sectors):
+        line = ("sector %04d " % s).encode("ascii")
+        out += (line * (SECTOR // len(line) + 1))[:SECTOR]
+    return bytes(out)
+
+
+def descriptor(type_, offset, size, next_offset=None):
+    raw = type_.encode("ascii").ljust(16, b"\x00")
+    raw += struct.pack("<QQ", offset + size if next_offset is None
+                       else next_offset, size)
+    raw += bytes(40)
+    return raw + struct.pack("<I", adler(raw))
+
+
+def header_body(fields=HEADER_FIELDS):
+    text = "1\nmain\n%s\n%s\n\n" % ("\t".join(k for k, _ in fields),
+                                     "\t".join(v for _, v in fields))
+    return zlib.compress(text.encode("ascii"))
+
+
+def volume_body(chunk_count, sector_count, compression=1):
+    body = bytearray(1052)
+    body[0] = 0x01                                   # fixed disk
+    struct.pack_into("<IIIQ", body, 4, chunk_count, SECTORS_PER_CHUNK,
+                     SECTOR, sector_count)
+    body[36] = 0x01                                  # image file
+    body[52] = compression
+    struct.pack_into("<I", body, 1048, adler(bytes(body[:1048])))
+    return bytes(body)
+
+
+def chunk_bytes(data, compress):
+    if compress:
+        return zlib.compress(data)
+    return data + struct.pack("<I", adler(data))
+
+
+def table_body(offsets, base, compressed_flags):
+    head = struct.pack("<IIQI", len(offsets), 0, base, 0)
+    head += struct.pack("<I", adler(head))
+    entries = b"".join(struct.pack("<I", (o - base) | (0x80000000 if c else 0))
+                       for o, c in zip(offsets, compressed_flags))
+    return head + entries + struct.pack("<I", adler(entries))
+
+
+def hash_body(md5):
+    body = md5 + bytes(16)
+    return body + struct.pack("<I", adler(body))
+
+
+def segment(number, chunks, last, total_chunks, sector_count, md5,
+            chunk_mutator=None):
+    """One segment file.  `chunks` is a list of (data, compress)."""
+    out = bytearray(EVF_SIG + struct.pack("<BHH", 1, number, 0))
+
+    def section(type_, body, next_offset=None):
+        start = len(out)
+        out.extend(descriptor(type_, start, DESC + len(body), next_offset))
+        out.extend(body)
+
+    if number == 1:
+        section("header", header_body())
+        section("volume", volume_body(total_chunks, sector_count))
+    else:
+        section("data", volume_body(total_chunks, sector_count))
+
+    sectors_start = len(out)
+    stored = []
+    for i, (data, compress) in enumerate(chunks):
+        raw = chunk_bytes(data, compress)
+        if chunk_mutator:
+            raw = chunk_mutator(i, raw)
+        stored.append(raw)
+    offsets, pos = [], sectors_start + DESC
+    for raw in stored:
+        offsets.append(pos)
+        pos += len(raw)
+    section("sectors", b"".join(stored))
+
+    flags = [c for _d, c in chunks]
+    body = table_body(offsets, sectors_start, flags)
+    section("table", body)
+    section("table2", body)
+    if last:
+        section("hash", hash_body(md5))
+        start = len(out)
+        out.extend(descriptor("done", start, DESC, next_offset=start))
+    else:
+        start = len(out)
+        out.extend(descriptor("next", start, DESC, next_offset=start))
+    return bytes(out)
+
+
+def build_e01(data=None, per_segment=None, compress=None, chunk_mutator=None):
+    """Return a list of segment file bytes (E01, E02, ...) holding `data`.
+
+    per_segment: chunks per segment file (default: all in one).
+    compress:    function(chunk index) -> bool (default: even chunks).
+    chunk_mutator: function(global chunk index, stored bytes) -> bytes, to
+                   corrupt a chunk after its checksum was computed.
+    """
+    data = media() if data is None else data
+    if len(data) % SECTOR:
+        raise ValueError("media must be a whole number of sectors")
+    compress = compress or (lambda i: i % 2 == 0)
+    chunks = [(data[i:i + CHUNK_SIZE], compress(i // CHUNK_SIZE))
+              for i in range(0, len(data), CHUNK_SIZE)]
+    per_segment = per_segment or len(chunks)
+    md5 = hashlib.md5(data).digest()
+    segments = []
+    groups = [chunks[i:i + per_segment]
+              for i in range(0, len(chunks), per_segment)]
+    base = 0
+    for n, group in enumerate(groups):
+        mut = None
+        if chunk_mutator:
+            mut = (lambda b: lambda i, raw: chunk_mutator(b + i, raw))(base)
+        segments.append(segment(n + 1, group, n == len(groups) - 1,
+                                len(chunks), len(data) // SECTOR, md5, mut))
+        base += len(group)
+    return segments
+
+
+def segment_names(stem, count):
+    """x.E01, x.E02, ... as written by EnCase for the first 99 segments."""
+    return ["%s.E%02d" % (stem, i + 1) for i in range(count)]
+
+
+def split_raw(data, piece):
+    """Split raw media into .001/.002/... sized `piece` bytes."""
+    return [data[i:i + piece] for i in range(0, len(data), piece)]
diff --git a/tests/imagebuild_ext4.py b/tests/imagebuild_ext4.py
new file mode 100644
index 0000000..88fa363
--- /dev/null
+++ b/tests/imagebuild_ext4.py
@@ -0,0 +1,455 @@
+"""Build small synthetic ext2/3/4 filesystem images in memory.
+
+Nothing here is a fixture file: every image is assembled byte by byte so the
+tests stay reviewable and the builders can be reused as fuzzing seeds.
+
+Layout of the image returned by build_ext4() (block size 1024, one group):
+
+    block 0        boot block (zero)
+    block 1        superblock (byte offset 1024)
+    block 2        group descriptor table (32-byte descriptors)
+    block 3        block bitmap
+    block 4        inode bitmap
+    blocks 5-12    inode table: 32 inodes x 256 bytes
+    blocks 13+     data blocks, handed out in allocation order
+
+Superblock features: incompat FILETYPE | EXTENTS | INLINE_DATA, compat
+HAS_JOURNAL, rev 1, first_ino 11, journal inode 8.  Inodes (see the INO_*
+constants for the numbers and CONTENT for expected file bytes):
+
+    2   /                  directory, extent-mapped (depth 0)
+    8   journal            jbd2 journal, 16 blocks, extent-mapped
+    12  extent.txt         2 blocks in one depth-0 extent
+    13  deep.bin           depth-1 extent tree: index -> leaf block -> 2 extents
+    14  legacy.txt         block map: 12 direct pointers + 1 single-indirect block
+    15  inline.txt         inline data, fits within i_block (<= 60 bytes)
+    16  inline_long.txt    inline data, first 60 bytes in i_block, rest in the
+                           in-inode "system.data" extended attribute
+    17  link               fast symlink -> "extent.txt"
+    18  sub/               directory; holds nested.txt (inode 19)
+    19  sub/nested.txt     1-block extent file
+    20  sparse.bin         extents at logical 0 and 2 with a hole at logical 1
+    21  deleted.txt        unlinked (links 0, dtime set, size 0, empty extent
+                           header); an earlier copy of its inode table block
+                           survives in journal transaction 5
+    22  inlinedir/         inline-data directory holding "again.txt" -> 12
+
+Journal (inode 8, journal-relative block numbers):
+
+    0   jbd2 superblock v2, blocksize 1024, maxlen 16, first 1, sequence 5
+    1   descriptor block, sequence 5, one tag for the inode-table block that
+        holds inode 21 (tag flags LAST_TAG, UUID follows the tag)
+    2   the superseded copy of that inode-table block (inode 21 live: links 1,
+        size len(CONTENT["deleted.txt"]), extent -> its old data block)
+    3   commit block, sequence 5
+"""
+
+import struct
+
+BLOCK_SIZE = 1024
+INODE_SIZE = 256
+INODES_PER_GROUP = 32
+BLOCKS_COUNT = 160
+INODE_TABLE = 5
+INODE_TABLE_BLOCKS = INODES_PER_GROUP * INODE_SIZE // BLOCK_SIZE
+FIRST_DATA = INODE_TABLE + INODE_TABLE_BLOCKS
+
+S_IFDIR = 0x4000
+S_IFREG = 0x8000
+S_IFLNK = 0xA000
+FL_EXTENTS = 0x00080000
+FL_INLINE_DATA = 0x10000000
+
+INCOMPAT_FILETYPE = 0x0002
+INCOMPAT_EXTENTS = 0x0040
+INCOMPAT_INLINE_DATA = 0x8000
+COMPAT_HAS_JOURNAL = 0x0004
+
+JBD2_MAGIC = 0xC03B3998
+
+MTIME = 1700000000
+DTIME = 1700000500
+UUID = bytes(range(16))
+LABEL = b"strata-test"
+
+INO_ROOT = 2
+INO_JOURNAL = 8
+INO_EXTENT = 12
+INO_DEEP = 13
+INO_LEGACY = 14
+INO_INLINE = 15
+INO_INLINE_LONG = 16
+INO_LINK = 17
+INO_SUB = 18
+INO_NESTED = 19
+INO_SPARSE = 20
+INO_DELETED = 21
+INO_INLINEDIR = 22
+
+JOURNAL_BLOCKS = 16
+JOURNAL_SEQUENCE = 5
+
+
+def _pattern(tag, length):
+    """Distinct, position-dependent filler so misplaced bytes are visible."""
+    out = bytearray()
+    n = 0
+    while len(out) < length:
+        out += ("%s:%05d|" % (tag, n)).encode("ascii")
+        n += 1
+    return bytes(out[:length])
+
+
+CONTENT = {
+    "extent.txt": _pattern("extent", 1500),
+    "deep.bin": _pattern("deep", 3000),
+    "legacy.txt": _pattern("legacy", 13 * BLOCK_SIZE + 100),
+    "inline.txt": b"small file stored inside its own inode\n",
+    "inline_long.txt": _pattern("inl", 100),
+    "sub/nested.txt": b"nested file content\n",
+    "sparse.bin": (_pattern("sp0", BLOCK_SIZE) + bytes(BLOCK_SIZE)
+                   + _pattern("sp2", BLOCK_SIZE)),
+    "deleted.txt": b"this content was deleted but the journal remembers\n",
+}
+LINK_TARGET = b"extent.txt"
+
+
+def extent_header(entries, max_entries, depth):
+    """ext4_extent_header: magic 0xF30A, entries, max, depth, generation."""
+    return struct.pack("<HHHHI", 0xF30A, entries, max_entries, depth, 0)
+
+
+def extent(logical, length, physical):
+    """ext4_extent: ee_block, ee_len, ee_start_hi, ee_start_lo."""
+    return struct.pack("<IHHI", logical, length, physical >> 32,
+                       physical & 0xFFFFFFFF)
+
+
+def extent_index(logical, leaf):
+    """ext4_extent_idx: ei_block, ei_leaf_lo, ei_leaf_hi, unused."""
+    return struct.pack("<IIHH", logical, leaf & 0xFFFFFFFF, leaf >> 32, 0)
+
+
+def extent_area(extents, depth=0):
+    """A 60-byte i_block holding an extent (or index) node of up to 4."""
+    body = extent_header(len(extents), 4, depth) + b"".join(extents)
+    return body.ljust(60, b"\x00")
+
+
+def dirent(inode, name, ftype, rec_len=None):
+    """ext4_dir_entry_2: inode, rec_len, name_len, file_type, name (pad 4)."""
+    name = name.encode("utf-8") if isinstance(name, str) else name
+    need = (8 + len(name) + 3) // 4 * 4
+    rec_len = rec_len or need
+    return struct.pack("<IHBB", inode, rec_len, len(name), ftype) + \
+        name + bytes(rec_len - 8 - len(name))
+
+
+def dir_block(entries, size=BLOCK_SIZE):
+    """Pack (inode, name, ftype) dirents; the last one pads to `size`."""
+    out = bytearray()
+    for i, (ino, name, ftype) in enumerate(entries):
+        if i == len(entries) - 1:
+            raw = dirent(ino, name, ftype)
+            out += dirent(ino, name, ftype, size - len(out)) \
+                if size - len(out) >= len(raw) else raw
+        else:
+            out += dirent(ino, name, ftype)
+    return bytes(out)
+
+
+def inode_bytes(mode, size, i_block=b"", flags=0, links=1, dtime=0,
+                xattr=b""):
+    """One 256-byte inode (ext4_inode) with i_extra_isize = 32.
+
+    `xattr` is placed at byte 160 (128 + extra_isize), i.e. the in-inode
+    extended attribute area, and must include its 0xEA020000 magic.
+    """
+    raw = bytearray(INODE_SIZE)
+    struct.pack_into("<HHIIIIIHH", raw, 0, mode, 1000, size & 0xFFFFFFFF,
+                     MTIME, MTIME, MTIME, dtime, 1000, links)
+    struct.pack_into("<I", raw, 32, flags)
+    raw[40:100] = i_block.ljust(60, b"\x00")[:60]
+    struct.pack_into("<I", raw, 108, size >> 32)
+    struct.pack_into("<H", raw, 128, 32)            # i_extra_isize
+    struct.pack_into("<I", raw, 144, MTIME)         # i_crtime
+    raw[160:160 + len(xattr)] = xattr
+    return bytes(raw)
+
+
+def inline_data_xattr(value):
+    """In-inode xattr area carrying one "system.data" entry.
+
+    ext4_xattr_ibody_header (magic) then ext4_xattr_entry: name_len 4,
+    name_index 7 (system), value_offs (relative to the first entry),
+    value_inum 0, value_size, hash 0, name "data"; a 4-byte zero terminator;
+    the value itself sits right after, padded to 4.
+    """
+    entry_len = 16 + 4
+    value_offs = entry_len + 4
+    entry = struct.pack("<BBHIII", 4, 7, value_offs, 0, len(value), 0) + b"data"
+    pad = bytes((4 - len(value) % 4) % 4)
+    return struct.pack("<I", 0xEA020000) + entry + bytes(4) + value + pad
+
+
+class Ext4Image(object):
+    """Mutable single-group image; call to_bytes() when done."""
+
+    def __init__(self, blocks=BLOCKS_COUNT):
+        self.blocks = blocks
+        self.data = bytearray(blocks * BLOCK_SIZE)
+        self.next_block = FIRST_DATA
+
+    def alloc(self, count=1):
+        first = self.next_block
+        self.next_block += count
+        if self.next_block > self.blocks:
+            raise ValueError("builder ran out of blocks")
+        return first
+
+    def write_block(self, block, payload):
+        if len(payload) > BLOCK_SIZE:
+            raise ValueError("payload larger than a block")
+        off = block * BLOCK_SIZE
+        self.data[off:off + BLOCK_SIZE] = payload.ljust(BLOCK_SIZE, b"\x00")
+
+    def write_blocks(self, first, payload):
+        for i in range(0, len(payload), BLOCK_SIZE):
+            self.write_block(first + i // BLOCK_SIZE, payload[i:i + BLOCK_SIZE])
+
+    @staticmethod
+    def inode_offset(num):
+        return INODE_TABLE * BLOCK_SIZE + (num - 1) * INODE_SIZE
+
+    def set_inode(self, num, raw):
+        off = self.inode_offset(num)
+        self.data[off:off + INODE_SIZE] = raw
+
+    def superblock(self, incompat, compat, journal_inum=INO_JOURNAL):
+        sb = bytearray(1024)
+        struct.pack_into("<IIIII", sb, 0, INODES_PER_GROUP, self.blocks, 0,
+                         0, INODES_PER_GROUP)
+        struct.pack_into("<I", sb, 20, 1)                   # first_data_block
+        struct.pack_into("<I", sb, 24, 0)                   # log_block_size
+        struct.pack_into("<I", sb, 32, 8192)                # blocks_per_group
+        struct.pack_into("<I", sb, 40, INODES_PER_GROUP)    # inodes_per_group
+        struct.pack_into("<II", sb, 44, MTIME, MTIME)       # mtime, wtime
+        sb[56:58] = b"\x53\xEF"
+        struct.pack_into("<H", sb, 58, 1)                   # state: clean
+        struct.pack_into("<I", sb, 76, 1)                   # rev_level
+        struct.pack_into("<I", sb, 84, 11)                  # first_ino
+        struct.pack_into("<H", sb, 88, INODE_SIZE)
+        struct.pack_into("<III", sb, 92, compat, incompat, 0)
+        sb[104:120] = UUID
+        sb[120:120 + len(LABEL)] = LABEL
+        sb[136:141] = b"/mnt\x00"
+        struct.pack_into("<I", sb, 224, journal_inum)
+        self.data[1024:2048] = sb
+        gd = struct.pack("<III", 3, 4, INODE_TABLE)
+        self.write_block(2, gd)
+
+    def to_bytes(self):
+        return bytes(self.data)
+
+
+def journal_superblock(maxlen=JOURNAL_BLOCKS, first=1, sequence=JOURNAL_SEQUENCE):
+    """journal_superblock_t v2 (big-endian)."""
+    sb = bytearray(BLOCK_SIZE)
+    struct.pack_into(">III", sb, 0, JBD2_MAGIC, 4, 0)
+    struct.pack_into(">IIIII", sb, 12, BLOCK_SIZE, maxlen, first, sequence,
+                     first)
+    sb[48:64] = UUID
+    struct.pack_into(">I", sb, 64, 1)
+    return bytes(sb)
+
+
+def journal_descriptor(sequence, fs_blocks):
+    """Descriptor block with classic 8-byte tags (no 64bit, no csum).
+
+    Tag: t_blocknr (be32), t_checksum (be16), t_flags (be16).  The first tag
+    carries the 16-byte UUID after it; later tags set SAME_UUID (0x2); the
+    last sets LAST_TAG (0x8).
+    """
+    blk = bytearray(struct.pack(">III", JBD2_MAGIC, 1, sequence))
+    for i, b in enumerate(fs_blocks):
+        flags = 0x2 if i else 0
+        if i == len(fs_blocks) - 1:
+            flags |= 0x8
+        blk += struct.pack(">IHH", b, 0, flags)
+        if i == 0:
+            blk += UUID
+    return bytes(blk)
+
+
+def journal_commit(sequence):
+    return struct.pack(">III", JBD2_MAGIC, 2, sequence)
+
+
+def build_ext4():
+    """The full test filesystem described in the module docstring."""
+    img = Ext4Image()
+    img.superblock(INCOMPAT_FILETYPE | INCOMPAT_EXTENTS | INCOMPAT_INLINE_DATA,
+                   COMPAT_HAS_JOURNAL)
+
+    def reg_extents(num, data):
+        n = (len(data) + BLOCK_SIZE - 1) // BLOCK_SIZE
+        first = img.alloc(n)
+        img.write_blocks(first, data)
+        img.set_inode(num, inode_bytes(S_IFREG | 0o644, len(data),
+                                       extent_area([extent(0, n, first)]),
+                                       FL_EXTENTS))
+        return first
+
+    reg_extents(INO_EXTENT, CONTENT["extent.txt"])
+
+    # deep.bin: depth-1 tree. Leaf block holds two extents whose physical
+    # blocks are deliberately not adjacent.
+    deep = CONTENT["deep.bin"]
+    leaf = img.alloc()
+    a = img.alloc(2)
+    img.alloc()                                   # gap on disk
+    b = img.alloc()
+    img.write_blocks(a, deep[:2 * BLOCK_SIZE])
+    img.write_blocks(b, deep[2 * BLOCK_SIZE:])
+    leaf_node = extent_header(2, (BLOCK_SIZE - 12) // 12, 0) + \
+        extent(0, 2, a) + extent(2, 1, b)
+    img.write_block(leaf, leaf_node)
+    img.set_inode(INO_DEEP, inode_bytes(
+        S_IFREG | 0o644, len(deep),
+        extent_area([extent_index(0, leaf)], depth=1), FL_EXTENTS))
+
+    # legacy.txt: 14 data blocks -> 12 direct + 2 via the indirect block.
+    legacy = CONTENT["legacy.txt"]
+    n = (len(legacy) + BLOCK_SIZE - 1) // BLOCK_SIZE
+    first = img.alloc(n)
+    img.write_blocks(first, legacy)
+    ind = img.alloc()
+    img.write_block(ind, struct.pack("<%dI" % (n - 12),
+                                     *range(first + 12, first + n)))
+    ptrs = list(range(first, first + 12)) + [ind, 0, 0]
+    img.set_inode(INO_LEGACY, inode_bytes(S_IFREG | 0o644, len(legacy),
+                                          struct.pack("<15I", *ptrs)))
+
+    small = CONTENT["inline.txt"]
+    img.set_inode(INO_INLINE, inode_bytes(S_IFREG | 0o644, len(small), small,
+                                          FL_INLINE_DATA))
+    long_ = CONTENT["inline_long.txt"]
+    img.set_inode(INO_INLINE_LONG, inode_bytes(
+        S_IFREG | 0o644, len(long_), long_[:60], FL_INLINE_DATA,
+        xattr=inline_data_xattr(long_[60:])))
+
+    img.set_inode(INO_LINK, inode_bytes(S_IFLNK | 0o777, len(LINK_TARGET),
+                                        LINK_TARGET))
+
+    reg_extents(INO_NESTED, CONTENT["sub/nested.txt"])
+    sub = img.alloc()
+    img.write_block(sub, dir_block([(INO_SUB, ".", 2), (INO_ROOT, "..", 2),
+                                    (INO_NESTED, "nested.txt", 1)]))
+    img.set_inode(INO_SUB, inode_bytes(S_IFDIR | 0o755, BLOCK_SIZE,
+                                       extent_area([extent(0, 1, sub)]),
+                                       FL_EXTENTS, links=2))
+
+    sparse = CONTENT["sparse.bin"]
+    s0 = img.alloc()
+    s2 = img.alloc()
+    img.write_block(s0, sparse[:BLOCK_SIZE])
+    img.write_block(s2, sparse[2 * BLOCK_SIZE:])
+    img.set_inode(INO_SPARSE, inode_bytes(
+        S_IFREG | 0o644, len(sparse),
+        extent_area([extent(0, 1, s0), extent(2, 1, s2)]), FL_EXTENTS))
+
+    # Inline directory: 4-byte parent inode, then dirents filling i_block.
+    inline_dir = struct.pack("<I", INO_ROOT) + dir_block(
+        [(INO_EXTENT, "again.txt", 1)], size=56)
+    img.set_inode(INO_INLINEDIR, inode_bytes(S_IFDIR | 0o755, 60, inline_dir,
+                                             FL_INLINE_DATA, links=2))
+
+    # deleted.txt: the live inode is cleared; journal holds the old one.
+    old = CONTENT["deleted.txt"]
+    old_block = img.alloc()
+    img.write_block(old_block, old)
+    img.set_inode(INO_DELETED, inode_bytes(
+        S_IFREG | 0o644, len(old), extent_area([extent(0, 1, old_block)]),
+        FL_EXTENTS))
+    itable_block = INODE_TABLE + (INO_DELETED - 1) * INODE_SIZE // BLOCK_SIZE
+    off = itable_block * BLOCK_SIZE
+    superseded = bytes(img.data[off:off + BLOCK_SIZE])
+    img.set_inode(INO_DELETED, inode_bytes(
+        S_IFREG | 0o644, 0, extent_header(0, 4, 0), FL_EXTENTS, links=0,
+        dtime=DTIME))
+
+    root = img.alloc()
+    img.write_block(root, dir_block([
+        (INO_ROOT, ".", 2), (INO_ROOT, "..", 2),
+        (INO_EXTENT, "extent.txt", 1), (INO_DEEP, "deep.bin", 1),
+        (INO_LEGACY, "legacy.txt", 1), (INO_INLINE, "inline.txt", 1),
+        (INO_INLINE_LONG, "inline_long.txt", 1), (INO_LINK, "link", 7),
+        (INO_SUB, "sub", 2), (INO_SPARSE, "sparse.bin", 1),
+        (INO_DELETED, "deleted.txt", 1), (INO_INLINEDIR, "inlinedir", 2),
+    ]))
+    img.set_inode(INO_ROOT, inode_bytes(S_IFDIR | 0o755, BLOCK_SIZE,
+                                        extent_area([extent(0, 1, root)]),
+                                        FL_EXTENTS, links=4))
+    # The journal is allocated last so it ends the used area of the image.
+    jfirst = img.alloc(JOURNAL_BLOCKS)
+    img.write_block(jfirst, journal_superblock())
+    img.write_block(jfirst + 1, journal_descriptor(JOURNAL_SEQUENCE,
+                                                   [itable_block]))
+    img.write_block(jfirst + 2, superseded)
+    img.write_block(jfirst + 3, journal_commit(JOURNAL_SEQUENCE))
+    img.set_inode(INO_JOURNAL, inode_bytes(
+        S_IFREG | 0o600, JOURNAL_BLOCKS * BLOCK_SIZE,
+        extent_area([extent(0, JOURNAL_BLOCKS, jfirst)]), FL_EXTENTS))
+
+    return img.to_bytes()
+
+
+def build_ext4_truncated_journal():
+    """build_ext4() with journal block 1 turned into a revoke block and the
+    image cut 14 bytes into that block (an interrupted acquisition).  Every
+    structure outside the journal is still intact."""
+    data = bytearray(build_ext4())
+    jfirst = journal_first_block(data)
+    at = (jfirst + 1) * BLOCK_SIZE
+    data[at:at + 16] = struct.pack(">IIII", JBD2_MAGIC, 5, JOURNAL_SEQUENCE, 20)
+    return bytes(data[:at + 14])
+
+
+def journal_first_block(image):
+    """Physical block of journal block 0 (reads inode 8's single extent)."""
+    off = Ext4Image.inode_offset(INO_JOURNAL) + 40 + 12
+    return struct.unpack_from("<I", image, off + 8)[0]
+
+
+def build_ext2_legacy():
+    """An ext2 image (no extents, no journal): root dir and one file, both
+    mapped by direct block pointers.  File is inode 12, "hello.txt"."""
+    img = Ext4Image(blocks=64)
+    img.superblock(INCOMPAT_FILETYPE, 0, journal_inum=0)
+    data = b"hello from ext2\n"
+    blk = img.alloc()
+    img.write_block(blk, data)
+    img.set_inode(12, inode_bytes(S_IFREG | 0o644, len(data),
+                                  struct.pack("<15I", blk, *([0] * 14))))
+    root = img.alloc()
+    img.write_block(root, dir_block([(2, ".", 2), (2, "..", 2),
+                                     (12, "hello.txt", 1)]))
+    img.set_inode(2, inode_bytes(S_IFDIR | 0o755, BLOCK_SIZE,
+                                 struct.pack("<15I", root, *([0] * 14)),
+                                 links=2))
+    return img.to_bytes()
+
+
+def build_ext4_extent_loop():
+    """Hostile image: inode 12 is a depth-1 extent tree whose index points at
+    an index block that points (84 times) back at itself with depth 1."""
+    img = Ext4Image(blocks=64)
+    img.superblock(INCOMPAT_FILETYPE | INCOMPAT_EXTENTS, 0, journal_inum=0)
+    loop = img.alloc()
+    fan = (BLOCK_SIZE - 12) // 12
+    img.write_block(loop, extent_header(fan, fan, 1)
+                    + extent_index(0, loop) * fan)
+    img.set_inode(12, inode_bytes(S_IFREG | 0o644, 4096,
+                                  extent_area([extent_index(0, loop)], 1),
+                                  FL_EXTENTS))
+    return img.to_bytes()
diff --git a/tests/imagebuild_fat.py b/tests/imagebuild_fat.py
new file mode 100644
index 0000000..40bf212
--- /dev/null
+++ b/tests/imagebuild_fat.py
@@ -0,0 +1,687 @@
+"""Synthetic FAT12/16/32 and exFAT volume builders for the parser tests.
+
+Everything here returns ``bytes``: a complete, minimal but valid volume (or a
+disk wrapping one) built in code, because the repository carries no binary
+fixtures. The layouts are fixed and described below so a test can assert
+exact offsets, and so the same images can later seed a fuzzer.
+
+Nothing in this module imports the engine; it only encodes the on-disk
+formats (Microsoft FAT specification 1.03 and the exFAT file system
+specification) so a builder mistake cannot be masked by an engine mistake.
+"""
+
+import datetime
+import struct
+
+SECTOR = 512
+
+# --------------------------------------------------------------------------
+# Shared helpers
+# --------------------------------------------------------------------------
+
+
+def pattern(length, seed):
+    """Deterministic, non-repeating-looking filler so misplaced reads show."""
+    return bytes(((i * 31 + seed * 7 + (i >> 8)) & 0xFF) for i in range(length))
+
+
+def fill(length, text):
+    """Repeat ``text`` to exactly ``length`` bytes (used to paint slack)."""
+    reps = length // len(text) + 1
+    return (text * reps)[:length]
+
+
+def wrap_mbr(volume, start_sector=63, ptype=0x06, bootable=False):
+    """A disk: classic MBR at sector 0, one primary partition holding ``volume``.
+
+    Layout: sector 0 = MBR (partition entry 1 at 0x1BE, signature 55AA);
+    sectors 1..start_sector-1 zero; ``volume`` from ``start_sector``; the
+    disk is padded to a whole number of sectors.
+    """
+    count = (len(volume) + SECTOR - 1) // SECTOR
+    mbr = bytearray(SECTOR)
+    entry = struct.pack("<B3sB3sII", 0x80 if bootable else 0x00,
+                        b"\xFE\xFF\xFF", ptype, b"\xFE\xFF\xFF",
+                        start_sector, count)
+    mbr[446:462] = entry
+    mbr[510:512] = b"\x55\xAA"
+    disk = bytearray(start_sector * SECTOR + count * SECTOR)
+    disk[0:SECTOR] = mbr
+    disk[start_sector * SECTOR:start_sector * SECTOR + len(volume)] = volume
+    return bytes(disk)
+
+
+# --------------------------------------------------------------------------
+# FAT12 / FAT16 / FAT32
+# --------------------------------------------------------------------------
+
+FAT_CLUSTER = 512            # every FAT geometry below uses 1 sector/cluster
+
+# bits -> (total_sectors, reserved, num_fats, fat_size_sectors, root_entries)
+# Cluster counts land squarely inside each width's range (spec section 3.5):
+#   FAT12: 2847 (< 4085)   FAT16: 8095 (< 65525)   FAT32: 66000 (>= 65525)
+FAT_GEOMETRY = {
+    12: (2880, 1, 2, 9, 224),
+    16: (8192, 1, 2, 32, 512),
+    32: (67064, 32, 2, 516, 0),
+}
+
+HELLO_TEXT = b"Hello, FAT!\n"
+LONG_NAME = "Long file name.txt"
+LONG_SHORT = b"LONGFI~1TXT"
+LONG_SIZE = 2 * FAT_CLUSTER + 100
+LONG_CLUSTERS = (4, 5, 9)                        # fragmented chain
+NESTED_SIZE = 1000
+DELETED_SIZE = FAT_CLUSTER + 188
+DELETED_LFN_NAME = "Removed document.txt"
+GONE_NAME = "Gone file.txt"                     # exactly 13 chars: one LFN part
+GONE_TEXT = b"deleted, single-part LFN\n\x00\x00\x00\x00\x00"
+SLACK_MARK = b"SLACK!"
+
+# Where each item lives. Cluster numbers are identical across the three
+# widths so the tests can share expectations.
+FAT_LAYOUT = {
+    "root_cluster_fat32": 2,
+    "hello": {"cluster": 3, "size": len(HELLO_TEXT)},
+    "long": {"clusters": LONG_CLUSTERS, "size": LONG_SIZE},
+    "subdir": {"clusters": (6, 25)},             # two-cluster directory chain
+    "nested": {"clusters": (26, 27), "size": NESTED_SIZE},
+    "deleted": {"cluster": 12, "size": DELETED_SIZE},   # FAT entries freed
+    "deleted_lfn": {"cluster": 15, "size": 50},
+    "cycle": {"clusters": (17, 18), "size": 5000},      # 17 -> 18 -> 17
+    "gone": {"cluster": 20, "size": 30},
+    "subdir_fillers": 14,
+}
+
+
+def long_content():
+    return pattern(LONG_SIZE, 1)
+
+
+def nested_content():
+    return pattern(NESTED_SIZE, 2)
+
+
+def deleted_content():
+    return pattern(DELETED_SIZE, 3)
+
+
+def deleted_lfn_content():
+    return pattern(50, 4)
+
+
+def dos_datetime(dt):
+    """(date, time) as packed by FAT: 7-bit year-1980, 4 month, 5 day /
+    5 hour, 6 minute, 5 two-second."""
+    date = ((dt.year - 1980) << 9) | (dt.month << 5) | dt.day
+    time_ = (dt.hour << 11) | (dt.minute << 5) | (dt.second // 2)
+    return date, time_
+
+
+HELLO_CREATED = datetime.datetime(2024, 3, 15, 10, 20, 30)    # + 1.50 s
+HELLO_MODIFIED = datetime.datetime(2024, 3, 15, 13, 45, 30)
+HELLO_ACCESSED = datetime.date(2024, 3, 16)
+
+
+def lfn_checksum(short11):
+    s = 0
+    for c in short11:
+        s = (((s & 1) << 7) + (s >> 1) + c) & 0xFF
+    return s
+
+
+def lfn_entries(name, short11, deleted=False):
+    """VFAT long-name entries in on-disk order (highest sequence first)."""
+    units = name.encode("utf-16-le")
+    chars = [units[i:i + 2] for i in range(0, len(units), 2)]
+    parts = [chars[i:i + 13] for i in range(0, len(chars), 13)]
+    last = parts[-1]
+    if len(last) < 13:
+        last.append(b"\x00\x00")
+        while len(last) < 13:
+            last.append(b"\xFF\xFF")
+    csum = lfn_checksum(short11)
+    out = []
+    for seq, part in enumerate(parts, 1):
+        raw = b"".join(part)
+        e = bytearray(32)
+        e[0] = seq | (0x40 if seq == len(parts) else 0)
+        e[1:11] = raw[0:10]
+        e[11] = 0x0F
+        e[13] = csum
+        e[14:26] = raw[10:22]
+        e[28:32] = raw[22:26]
+        if deleted:
+            e[0] = 0xE5
+        out.append(bytes(e))
+    return list(reversed(out))
+
+
+def short_entry(name11, attr, cluster, size, created=None, modified=None,
+                accessed=None, tenths=0):
+    e = bytearray(32)
+    e[0:11] = name11
+    e[11] = attr
+    if created is not None:
+        d, t = dos_datetime(created)
+        e[13] = tenths
+        struct.pack_into("<HH", e, 14, t, d)
+    if accessed is not None:
+        struct.pack_into("<H", e, 18, ((accessed.year - 1980) << 9)
+                         | (accessed.month << 5) | accessed.day)
+    struct.pack_into("<H", e, 20, (cluster >> 16) & 0xFFFF)
+    if modified is not None:
+        d, t = dos_datetime(modified)
+        struct.pack_into("<HH", e, 22, t, d)
+    struct.pack_into("<H", e, 26, cluster & 0xFFFF)
+    struct.pack_into("<I", e, 28, size)
+    return bytes(e)
+
+
+def _fat_set(fat, bits, n, value):
+    if bits == 12:
+        i = n + n // 2
+        value &= 0x0FFF
+        if n & 1:
+            fat[i] = (fat[i] & 0x0F) | ((value << 4) & 0xF0)
+            fat[i + 1] = (value >> 4) & 0xFF
+        else:
+            fat[i] = value & 0xFF
+            fat[i + 1] = (fat[i + 1] & 0xF0) | (value >> 8)
+    elif bits == 16:
+        struct.pack_into("<H", fat, n * 2, value & 0xFFFF)
+    else:
+        struct.pack_into("<I", fat, n * 4, value & 0x0FFFFFFF)
+
+
+class SparseImage:
+    """Write-only image of a fixed size that records only what is written,
+    so a FAT32 volume (which needs >= 65525 clusters, ~34 MB) costs about
+    the size of its FATs in memory. ``extents()`` lists (offset, bytes);
+    ``tobytes()`` materialises the whole image."""
+
+    def __init__(self, size):
+        self.size = size
+        self.chunks = []
+
+    def __setitem__(self, key, data):
+        start = key.start or 0
+        assert 0 <= start and start + len(data) <= self.size
+        self.chunks.append((start, bytes(data)))
+
+    def extents(self):
+        return list(self.chunks)
+
+    def tobytes(self):
+        out = bytearray(self.size)
+        for off, data in self.chunks:
+            out[off:off + len(data)] = data
+        return bytes(out)
+
+
+def write_sparse(path, size, extents):
+    """Write ``extents`` to ``path`` as a (filesystem-sparse where supported)
+    file of exactly ``size`` bytes."""
+    with open(path, "wb") as fh:
+        for off, data in extents:
+            fh.seek(off)
+            fh.write(data)
+        fh.truncate(size)
+
+
+def build_fat_extents(bits=16, label=b"STRATATEST "):
+    """``build_fat`` as (size, [(offset, bytes), ...]) without allocating
+    the whole volume. Later extents overwrite earlier ones."""
+    img = _build_fat(bits, label)
+    return img.size, img.extents()
+
+
+def build_fat(bits=16, label=b"STRATATEST "):
+    """The volume from ``_build_fat`` as bytes (FAT32 is ~34 MB; prefer
+    ``build_fat_extents`` for it)."""
+    return _build_fat(bits, label).tobytes()
+
+
+def _build_fat(bits=16, label=b"STRATATEST "):
+    """A FAT12, FAT16 or FAT32 volume (512-byte sectors, 1 sector/cluster).
+
+    Geometry per width is in ``FAT_GEOMETRY``; both FAT copies are written
+    identically. The first data sector holds cluster 2.
+
+    Root directory (fixed region on FAT12/16, cluster 2 on FAT32):
+      * volume label entry ``label`` (attr 0x08)
+      * ``HELLO.TXT``   12 bytes in cluster 3; its slack is painted SLACK!;
+        created 2024-03-15 10:20:31.50 (tenths byte 150), modified
+        2024-03-15 13:45:30, accessed 2024-03-16
+      * ``Long file name.txt`` (2 LFN entries + ``LONGFI~1.TXT``),
+        1124 bytes over the fragmented chain 4 -> 5 -> 9
+      * ``SUBDIR``       directory, chain 6 -> 25. Cluster 6 holds ``.``,
+        ``..`` and 14 empty files ``FILE00.DAT``..``FILE13.DAT``; cluster 25
+        holds ``NESTED.BIN`` (1000 bytes, clusters 26 -> 27)
+      * deleted ``DELETED.TXT`` (0xE5, no LFN), 700 bytes written
+        contiguously to clusters 12-13, FAT entries freed; the 324 bytes
+        after it in cluster 13 are painted SLACK!
+      * deleted ``Removed document.txt`` (2 deleted LFN entries + short
+        entry), 50 bytes in cluster 15, FAT entry freed
+      * ``CYCLE.BIN``   declares 5000 bytes on a corrupt chain 17 -> 18 -> 17
+      * deleted ``Gone file.txt`` (one deleted LFN entry, 13 characters so
+        no terminator) + short ``GONEFI~1.TXT``, 30 bytes in cluster 20
+    """
+    total, reserved, nfats, fat_size, root_entries = FAT_GEOMETRY[bits]
+    img = SparseImage(total * SECTOR)
+
+    # Boot sector / BPB.
+    b = bytearray(SECTOR)
+    b[0:3] = b"\xEB\x3C\x90"
+    b[3:11] = b"MSWIN4.1"
+    struct.pack_into("<HBHBHHBH", b, 11, SECTOR, 1, reserved, nfats,
+                     root_entries, total if (total < 0x10000 and bits != 32)
+                     else 0, 0xF8, fat_size if bits != 32 else 0)
+    struct.pack_into("<HHI", b, 24, 63, 255, 0)
+    struct.pack_into("<I", b, 32, 0 if (total < 0x10000 and bits != 32)
+                     else total)
+    if bits == 32:
+        struct.pack_into("<IHHIHH", b, 36, fat_size, 0, 0,
+                         FAT_LAYOUT["root_cluster_fat32"], 1, 6)
+        b[64] = 0x80
+        b[66] = 0x29
+        struct.pack_into("<I", b, 67, 0x32323232)
+        b[71:82] = label
+        b[82:90] = b"FAT32   "
+    else:
+        b[36] = 0x80
+        b[38] = 0x29
+        struct.pack_into("<I", b, 39, 0x16161616)
+        b[43:54] = label
+        b[54:62] = b"FAT12   " if bits == 12 else b"FAT16   "
+    b[510:512] = b"\x55\xAA"
+    img[0:SECTOR] = b
+    if bits == 32:
+        fsinfo = bytearray(SECTOR)
+        struct.pack_into("<I", fsinfo, 0, 0x41615252)
+        struct.pack_into("<I", fsinfo, 484, 0x61417272)
+        struct.pack_into("<II", fsinfo, 488, 0xFFFFFFFF, 0xFFFFFFFF)
+        fsinfo[510:512] = b"\x55\xAA"
+        img[SECTOR:2 * SECTOR] = fsinfo
+        img[6 * SECTOR:7 * SECTOR] = b
+
+    root_dir_sectors = (root_entries * 32 + SECTOR - 1) // SECTOR
+    root_region = (reserved + nfats * fat_size) * SECTOR
+    first_data = reserved + nfats * fat_size + root_dir_sectors
+
+    def coff(n):
+        return (first_data + (n - 2)) * SECTOR
+
+    def put(n, data):
+        img[coff(n):coff(n) + len(data)] = data
+
+    fat = bytearray(fat_size * SECTOR)
+    eoc = {12: 0xFFF, 16: 0xFFFF, 32: 0x0FFFFFFF}[bits]
+    _fat_set(fat, bits, 0, (eoc & ~0xFF) | 0xF8)
+    _fat_set(fat, bits, 1, eoc)
+
+    def link(chain):
+        for a, nxt in zip(chain, chain[1:]):
+            _fat_set(fat, bits, a, nxt)
+        _fat_set(fat, bits, chain[-1], eoc)
+
+    # HELLO.TXT
+    hello = FAT_LAYOUT["hello"]["cluster"]
+    link([hello])
+    put(hello, HELLO_TEXT + fill(FAT_CLUSTER - len(HELLO_TEXT), SLACK_MARK))
+
+    # Long file name.txt, fragmented
+    link(list(LONG_CLUSTERS))
+    data = long_content()
+    for k, c in enumerate(LONG_CLUSTERS):
+        put(c, data[k * FAT_CLUSTER:(k + 1) * FAT_CLUSTER])
+
+    # SUBDIR and its contents
+    sub1, sub2 = FAT_LAYOUT["subdir"]["clusters"]
+    link([sub1, sub2])
+    dot = short_entry(b".          ", 0x10, sub1, 0)
+    dotdot = short_entry(b"..         ", 0x10, 0, 0)
+    fillers = [short_entry(("FILE%02d  DAT" % k).encode(), 0x20, 0, 0)
+               for k in range(FAT_LAYOUT["subdir_fillers"])]
+    put(sub1, dot + dotdot + b"".join(fillers))
+    n1, n2 = FAT_LAYOUT["nested"]["clusters"]
+    link([n1, n2])
+    put(sub2, short_entry(b"NESTED  BIN", 0x20, n1, NESTED_SIZE))
+    ndata = nested_content()
+    put(n1, ndata[:FAT_CLUSTER])
+    put(n2, ndata[FAT_CLUSTER:])
+
+    # Deleted, no LFN, contiguous 12-13, FAT freed (left zero)
+    dc = FAT_LAYOUT["deleted"]["cluster"]
+    ddata = deleted_content()
+    put(dc, ddata[:FAT_CLUSTER])
+    put(dc + 1, ddata[FAT_CLUSTER:]
+        + fill(2 * FAT_CLUSTER - DELETED_SIZE, SLACK_MARK))
+
+    # Deleted with a two-part LFN
+    lc = FAT_LAYOUT["deleted_lfn"]["cluster"]
+    put(lc, deleted_lfn_content())
+
+    # Corrupt cyclic chain
+    c1, c2 = FAT_LAYOUT["cycle"]["clusters"]
+    _fat_set(fat, bits, c1, c2)
+    _fat_set(fat, bits, c2, c1)
+    put(c1, b"A" * FAT_CLUSTER)
+    put(c2, b"B" * FAT_CLUSTER)
+
+    root = bytearray()
+    root += short_entry(label, 0x08, 0, 0)
+    root += short_entry(b"HELLO   TXT", 0x20, hello, len(HELLO_TEXT),
+                        created=HELLO_CREATED, modified=HELLO_MODIFIED,
+                        accessed=HELLO_ACCESSED, tenths=150)
+    for e in lfn_entries(LONG_NAME, LONG_SHORT):
+        root += e
+    root += short_entry(LONG_SHORT, 0x20, LONG_CLUSTERS[0], LONG_SIZE)
+    root += short_entry(b"SUBDIR     ", 0x10, sub1, 0)
+    root += short_entry(b"\xE5ELETED TXT", 0x20, dc, DELETED_SIZE)
+    removed_short = b"REMOVE~1TXT"
+    for e in lfn_entries(DELETED_LFN_NAME, removed_short, deleted=True):
+        root += e
+    root += short_entry(b"\xE5" + removed_short[1:], 0x20, lc, 50)
+    root += short_entry(b"CYCLE   BIN", 0x20, c1, 5000)
+    gc = FAT_LAYOUT["gone"]["cluster"]
+    put(gc, GONE_TEXT)
+    for e in lfn_entries(GONE_NAME, b"GONEFI~1TXT", deleted=True):
+        root += e
+    root += short_entry(b"\xE5ONEFI~1TXT", 0x20, gc, len(GONE_TEXT))
+
+    if bits == 32:
+        rc = FAT_LAYOUT["root_cluster_fat32"]
+        link([rc])
+        assert len(root) <= FAT_CLUSTER
+        put(rc, bytes(root))
+    else:
+        assert len(root) <= root_entries * 32
+        img[root_region:root_region + len(root)] = root
+
+    for k in range(nfats):
+        at = (reserved + k * fat_size) * SECTOR
+        img[at:at + len(fat)] = fat
+    return img
+
+
+# --------------------------------------------------------------------------
+# exFAT
+# --------------------------------------------------------------------------
+
+EXFAT_SECTOR_SHIFT = 9       # 512-byte sectors
+EXFAT_CLUSTER_SHIFT = 1      # 2 sectors per cluster
+EXFAT_CLUSTER = 1 << (EXFAT_SECTOR_SHIFT + EXFAT_CLUSTER_SHIFT)   # 1024
+EXFAT_FAT_OFFSET = 24        # sectors (after main + backup boot regions)
+EXFAT_FAT_LENGTH = 1
+EXFAT_HEAP_OFFSET = 32
+EXFAT_CLUSTERS = 64
+EXFAT_SERIAL = 0x1234ABCD
+EXFAT_LABEL = "Strata"
+
+EXFAT_LAYOUT = {
+    "bitmap": 2, "upcase": 3, "root": (4, 15),
+    "hello": {"cluster": 6, "size": 13},                 # NoFatChain
+    "fragmented": {"clusters": (7, 9, 8), "size": 2500},  # FAT chain
+    "contiguous": {"cluster": 10, "count": 3, "size": 3000},  # NoFatChain
+    "deleted": {"cluster": 13, "size": 100},
+    "timezone": {"cluster": 14, "size": 5},
+    "longname": {"cluster": 16, "size": 10},
+    "subdir": {"cluster": 17, "count": 2},               # NoFatChain dir
+    "inner": {"cluster": 19, "size": 6},
+    "second": {"cluster": 20, "size": 7},
+    "tail": {"cluster": 21, "size": 4},
+}
+
+EXFAT_HELLO = b"Hello, exFAT\n"
+EXFAT_LONG_NAME = "Named with a rather long filename.txt"
+EXFAT_MODIFIED = datetime.datetime(2023, 11, 5, 8, 30, 44)
+EXFAT_TZ_LOCAL = datetime.datetime(2024, 6, 1, 10, 0, 0)
+EXFAT_TZ_OFFSET = 0x80 | 48          # valid, +12:00 (48 quarter hours)
+
+
+def exfat_fragmented_content():
+    return pattern(2500, 11)
+
+
+def exfat_contiguous_content():
+    return pattern(3000, 12)
+
+
+def exfat_timestamp(dt):
+    return (((dt.year - 1980) << 25) | (dt.month << 21) | (dt.day << 16)
+            | (dt.hour << 11) | (dt.minute << 5) | (dt.second // 2))
+
+
+def upcase_table():
+    """A short up-case table: 128 UTF-16 code points, a-z mapped to A-Z.
+    Code points past the end of a table map to themselves (spec 7.2)."""
+    return b"".join(struct.pack("<H", (c - 32) if 0x61 <= c <= 0x7A else c)
+                    for c in range(128))
+
+
+def _upcase_checksum(data):
+    c = 0
+    for byte in data:
+        c = (((c << 31) | (c >> 1)) + byte) & 0xFFFFFFFF
+    return c
+
+
+def _name_hash(name):
+    h = 0
+    for byte in name.upper().encode("utf-16-le"):
+        h = (((h << 15) | (h >> 1)) + byte) & 0xFFFF
+    return h
+
+
+def _set_checksum(entries):
+    blob = b"".join(entries)
+    c = 0
+    for i, byte in enumerate(blob):
+        if i in (2, 3):
+            continue
+        c = (((c << 15) | (c >> 1)) + byte) & 0xFFFF
+    first = bytearray(entries[0])
+    struct.pack_into("<H", first, 2, c)
+    return [bytes(first)] + list(entries[1:])
+
+
+def exfat_file_set(name, first_cluster, size, attrs=0x20, contiguous=False,
+                   deleted=False, modified=EXFAT_MODIFIED, created=None,
+                   created_tz=0, valid=None):
+    """File + Stream Extension + File Name entries for one file (32 bytes
+    each). ``deleted`` clears the InUse bit of every entry in the set."""
+    units = name.encode("utf-16-le")
+    names = [units[i:i + 30] for i in range(0, len(units), 30)]
+    f = bytearray(32)
+    f[0] = 0x85
+    f[1] = 1 + len(names)
+    struct.pack_into("<H", f, 4, attrs)
+    struct.pack_into("<III", f, 8,
+                     exfat_timestamp(created or modified),
+                     exfat_timestamp(modified), exfat_timestamp(modified))
+    f[22] = created_tz
+    s = bytearray(32)
+    s[0] = 0xC0
+    s[1] = 0x01 | (0x02 if contiguous else 0)
+    s[3] = len(name)
+    struct.pack_into("<H", s, 4, _name_hash(name))
+    struct.pack_into("<Q", s, 8, size if valid is None else valid)
+    struct.pack_into("<IQ", s, 20, first_cluster, size)
+    entries = [bytes(f), bytes(s)]
+    for part in names:
+        n = bytearray(32)
+        n[0] = 0xC1
+        n[2:2 + len(part)] = part
+        entries.append(bytes(n))
+    entries = _set_checksum(entries)
+    if deleted:
+        entries = [bytes([e[0] & 0x7F]) + e[1:] for e in entries]
+    return entries
+
+
+def _boot_checksum(sectors):
+    c = 0
+    for i, byte in enumerate(sectors):
+        if i in (106, 107, 112):
+            continue
+        c = (((c << 31) | (c >> 1)) + byte) & 0xFFFFFFFF
+    return c
+
+
+def build_exfat():
+    """An exFAT volume: 512-byte sectors, 1024-byte clusters, 64 clusters.
+
+    Sectors 0-11 main boot region (boot sector, 8 extended boot sectors with
+    AA550000 signatures, OEM, reserved, boot checksum sector); 12-23 backup
+    boot region (a copy); 24 the single FAT; 32 onwards the cluster heap
+    (cluster 2 at sector 32). Cluster placement is in ``EXFAT_LAYOUT``.
+
+    Clusters: 2 allocation bitmap (8 bytes); 3 up-case table (256 bytes,
+    checksummed); 4 -> 15 root directory (a FAT chain). Root entries: volume
+    label "Strata", bitmap, up-case, then
+      * ``Hello.txt``            13 bytes, cluster 6, NoFatChain; slack
+        painted SLACK!
+      * ``Fragmented file.bin``  2500 bytes on the FAT chain 7 -> 9 -> 8
+      * ``Contiguous.dat``       3000 bytes, clusters 10-12, NoFatChain,
+        FAT entries left zero (as a real driver does)
+      * ``Deleted file.txt``     InUse cleared on all entries, 100 bytes in
+        cluster 13 (bitmap bit clear)
+      * ``Timezone.txt``         created 2024-06-01 10:00:00 local with a
+        valid UTC offset of +12:00
+      * ``Empty.txt``            size 0, no cluster
+      * ``Named with a rather long filename.txt``  3 name entries, cluster 16
+      * ``Subdir``               directory, NoFatChain over clusters 17-18
+        (FAT zero). Cluster 17 holds ``Inner.txt`` then unused entries
+        (type 0x40); cluster 18 holds ``Second.txt``.
+      * ``Tail.txt``             its entry set straddles clusters 4 and 15
+    Every entry set carries a correct SetChecksum and NameHash.
+    """
+    L = EXFAT_LAYOUT
+    cs = EXFAT_CLUSTER
+    total_sectors = EXFAT_HEAP_OFFSET + EXFAT_CLUSTERS * (cs // SECTOR)
+    img = bytearray(total_sectors * SECTOR)
+
+    def coff(n):
+        return EXFAT_HEAP_OFFSET * SECTOR + (n - 2) * cs
+
+    def put(n, data):
+        img[coff(n):coff(n) + len(data)] = data
+
+    boot = bytearray(12 * SECTOR)
+    boot[0:3] = b"\xEB\x76\x90"
+    boot[3:11] = b"EXFAT   "
+    struct.pack_into("<QQIIIIIIHH", boot, 64, 0, total_sectors,
+                     EXFAT_FAT_OFFSET, EXFAT_FAT_LENGTH, EXFAT_HEAP_OFFSET,
+                     EXFAT_CLUSTERS, L["root"][0], EXFAT_SERIAL, 0x0100, 0)
+    boot[108] = EXFAT_SECTOR_SHIFT
+    boot[109] = EXFAT_CLUSTER_SHIFT
+    boot[110] = 1
+    boot[111] = 0x80
+    boot[112] = 30
+    boot[510:512] = b"\x55\xAA"
+    for k in range(1, 9):
+        boot[k * SECTOR + 508:k * SECTOR + 512] = b"\x00\x00\x55\xAA"
+    csum = struct.pack("<I", _boot_checksum(bytes(boot[:11 * SECTOR])))
+    boot[11 * SECTOR:12 * SECTOR] = csum * (SECTOR // 4)
+    img[0:12 * SECTOR] = boot
+    img[12 * SECTOR:24 * SECTOR] = boot
+
+    fat = bytearray(EXFAT_FAT_LENGTH * SECTOR)
+    used = set()
+
+    def link(chain):
+        for a, nxt in zip(chain, chain[1:]):
+            struct.pack_into("<I", fat, a * 4, nxt)
+        struct.pack_into("<I", fat, chain[-1] * 4, 0xFFFFFFFF)
+
+    struct.pack_into("<II", fat, 0, 0xFFFFFFF8, 0xFFFFFFFF)
+
+    # Allocation bitmap, up-case table, root chain.
+    link([L["bitmap"]])
+    link([L["upcase"]])
+    link(list(L["root"]))
+    upcase = upcase_table()
+    put(L["upcase"], upcase)
+    used.update([L["bitmap"], L["upcase"]] + list(L["root"]))
+
+    # File data.
+    put(L["hello"]["cluster"], EXFAT_HELLO
+        + fill(cs - len(EXFAT_HELLO), SLACK_MARK))
+    used.add(L["hello"]["cluster"])
+
+    frag = exfat_fragmented_content()
+    link(list(L["fragmented"]["clusters"]))
+    for k, c in enumerate(L["fragmented"]["clusters"]):
+        put(c, frag[k * cs:(k + 1) * cs])
+        used.add(c)
+
+    cont = exfat_contiguous_content()
+    c0 = L["contiguous"]["cluster"]
+    put(c0, cont)
+    used.update(range(c0, c0 + L["contiguous"]["count"]))
+
+    put(L["deleted"]["cluster"], pattern(100, 13))            # not in bitmap
+    put(L["timezone"]["cluster"], b"tz!!\n")
+    put(L["longname"]["cluster"], b"long name\n")
+    put(L["inner"]["cluster"], b"inner\n")
+    put(L["second"]["cluster"], b"second\n")
+    put(L["tail"]["cluster"], b"tail")
+    used.update([L["timezone"]["cluster"], L["longname"]["cluster"],
+                 L["inner"]["cluster"], L["second"]["cluster"],
+                 L["tail"]["cluster"]])
+    for n in (L["timezone"], L["longname"], L["inner"], L["second"],
+              L["tail"]):
+        link([n["cluster"]])
+
+    sub = L["subdir"]["cluster"]
+    used.update(range(sub, sub + L["subdir"]["count"]))
+    sub1 = b"".join(exfat_file_set("Inner.txt", L["inner"]["cluster"], 6))
+    unused = bytes([0x40]) + bytes(31)
+    sub1 += unused * ((cs - len(sub1)) // 32)
+    put(sub, sub1)
+    put(sub + 1, b"".join(exfat_file_set("Second.txt",
+                                         L["second"]["cluster"], 7)))
+
+    # Root directory entries.
+    label = bytearray(32)
+    label[0] = 0x83
+    label[1] = len(EXFAT_LABEL)
+    label[2:2 + 2 * len(EXFAT_LABEL)] = EXFAT_LABEL.encode("utf-16-le")
+    bitmap_e = bytearray(32)
+    bitmap_e[0] = 0x81
+    struct.pack_into("<IQ", bitmap_e, 20, L["bitmap"],
+                     (EXFAT_CLUSTERS + 7) // 8)
+    upcase_e = bytearray(32)
+    upcase_e[0] = 0x82
+    struct.pack_into("<I", upcase_e, 4, _upcase_checksum(upcase))
+    struct.pack_into("<IQ", upcase_e, 20, L["upcase"], len(upcase))
+
+    root = [bytes(label), bytes(bitmap_e), bytes(upcase_e)]
+    root += exfat_file_set("Hello.txt", L["hello"]["cluster"], 13,
+                           contiguous=True)
+    root += exfat_file_set("Fragmented file.bin",
+                           L["fragmented"]["clusters"][0], 2500)
+    root += exfat_file_set("Contiguous.dat", c0, 3000, contiguous=True)
+    root += exfat_file_set("Deleted file.txt", L["deleted"]["cluster"], 100,
+                           contiguous=True, deleted=True)
+    root += exfat_file_set("Timezone.txt", L["timezone"]["cluster"], 5,
+                           created=EXFAT_TZ_LOCAL, created_tz=EXFAT_TZ_OFFSET)
+    root += exfat_file_set("Empty.txt", 0, 0)
+    root += exfat_file_set(EXFAT_LONG_NAME, L["longname"]["cluster"], 10)
+    root += exfat_file_set("Subdir", sub, cs * L["subdir"]["count"],
+                           attrs=0x10, contiguous=True)
+    root += exfat_file_set("Tail.txt", L["tail"]["cluster"], 4)
+    blob = b"".join(root)
+    assert len(blob) - 96 < cs < len(blob) <= 2 * cs, \
+        "Tail.txt must straddle clusters"
+    put(L["root"][0], blob[:cs])
+    put(L["root"][1], blob[cs:])
+
+    bitmap = bytearray((EXFAT_CLUSTERS + 7) // 8)
+    for c in used:
+        bitmap[(c - 2) // 8] |= 1 << ((c - 2) % 8)
+    put(L["bitmap"], bytes(bitmap))
+
+    img[EXFAT_FAT_OFFSET * SECTOR:EXFAT_FAT_OFFSET * SECTOR + len(fat)] = fat
+    return bytes(img)
diff --git a/tests/imagebuild_ntfs.py b/tests/imagebuild_ntfs.py
new file mode 100644
index 0000000..36ef298
--- /dev/null
+++ b/tests/imagebuild_ntfs.py
@@ -0,0 +1,545 @@
+"""Synthetic NTFS volume (and GPT disk) builders for the parser tests.
+
+Returns ``bytes`` built in code — the repository carries no binary fixtures.
+The layout is fixed and described in ``build_ntfs``'s docstring so tests can
+assert exact record numbers, cluster offsets and timestamps, and so the image
+can later seed a fuzzer. This module does not import the engine: it encodes
+the on-disk format directly (MFT FILE records with update sequence arrays,
+resident/non-resident attributes, run lists, $I30 index roots).
+"""
+
+import binascii
+import datetime
+import struct
+import uuid
+
+SECTOR = 512
+SECTORS_PER_CLUSTER = 2
+CLUSTER = SECTOR * SECTORS_PER_CLUSTER          # 1024
+RECORD = 1024
+TOTAL_CLUSTERS = 128
+MFT_LCN = 4
+MFT_RECORDS = 32
+MFTMIRR_LCN = 36
+BITMAP_LCN = 90
+ROOT_INDX_LCN = 100
+INDEX_BLOCK = CLUSTER                            # clusters-per-index 1
+SERIAL = 0x0123456789ABCDEF
+USN = b"\x42\x42"
+VOLUME_LABEL = "STRATA"
+
+# Record numbers of the user-visible content.
+REC = {
+    "hello": 16, "big": 17, "ads": 18, "deleted": 19, "docs": 20,
+    "note": 21, "sparse": 22, "compressed": 23, "twonames": 24,
+    "fixup": 25, "torn": 26, "empty_slot": 27,
+}
+
+HELLO_TEXT = b"Hello, NTFS!\n"
+BIG_SIZE = 3 * CLUSTER - 300                     # slack of 300 in last cluster
+BIG_RUNS = ((40, 2), (60, 1))                    # fragmented, backwards jump
+ADS_MAIN = b"main stream\n"
+ZONE_ID = b"[ZoneTransfer]\r\nZoneId=3\r\n"
+SECRET_LCN = 70
+SECRET_SIZE = 100
+DELETED_TEXT = b"gone but not forgotten\n"
+NOTE_TEXT = b"a note inside Docs\n"
+SPARSE_RUNS = ((50, 1), (None, 2), (51, 1))
+SPARSE_SIZE = 4 * CLUSTER
+COMPRESSED_LCN = 80
+COMPRESSED_TEXT = b"abc" * 400                   # 1200 bytes
+FIXUP_SIZE = 700                                 # resident, spans byte 510
+SLACK_MARK = b"NTFSSLACK"
+
+SI_TIMES = {
+    "created": datetime.datetime(2021, 1, 2, 3, 4, 5),
+    "modified": datetime.datetime(2022, 6, 7, 8, 9, 10),
+    "mft_modified": datetime.datetime(2022, 6, 7, 8, 9, 11),
+    "accessed": datetime.datetime(2023, 1, 1, 0, 0, 0),
+}
+# $FILE_NAME times deliberately differ from $STANDARD_INFORMATION, as they
+# would after a timestamp-tampering tool rewrote only $SI.
+FN_TIMES = {
+    "created": datetime.datetime(2019, 5, 5, 5, 5, 5),
+    "modified": datetime.datetime(2019, 5, 5, 5, 5, 6),
+    "mft_modified": datetime.datetime(2019, 5, 5, 5, 5, 7),
+    "accessed": datetime.datetime(2019, 5, 5, 5, 5, 8),
+}
+
+
+def pattern(length, seed):
+    return bytes(((i * 29 + seed * 13 + (i >> 7)) & 0xFF) for i in range(length))
+
+
+def fill(length, text):
+    return (text * (length // len(text) + 1))[:length]
+
+
+def big_content():
+    return pattern(BIG_SIZE, 1)
+
+
+def secret_content():
+    return pattern(SECRET_SIZE, 2)
+
+
+def sparse_content():
+    """What reading the sparse file must yield: data, zeros, data."""
+    return (pattern(CLUSTER, 3) + bytes(2 * CLUSTER) + pattern(CLUSTER, 4))
+
+
+def fixup_content():
+    return pattern(FIXUP_SIZE, 5)
+
+
+def iso(dt):
+    return dt.isoformat() + "Z"
+
+
+def filetime(dt):
+    delta = dt - datetime.datetime(1601, 1, 1)
+    return (delta.days * 86400 + delta.seconds) * 10 ** 7 \
+        + delta.microseconds * 10
+
+
+def _align8(n):
+    return (n + 7) & ~7
+
+
+def encode_runs(runs):
+    """NTFS mapping pairs. ``runs`` is (lcn or None for sparse, length)."""
+    out = bytearray()
+    prev = 0
+    for lcn, length in runs:
+        lb = (length.bit_length() + 8) // 8
+        lbytes = length.to_bytes(lb, "little")
+        if lcn is None:
+            out.append(lb)
+            out += lbytes
+            continue
+        delta = lcn - prev
+        prev = lcn
+        ob = 1
+        while True:
+            try:
+                obytes = delta.to_bytes(ob, "little", signed=True)
+                break
+            except OverflowError:
+                ob += 1
+        out.append((ob << 4) | lb)
+        out += lbytes + obytes
+    out.append(0)
+    return bytes(out)
+
+
+def resident_attr(type_id, body, name="", attr_id=0, indexed=False):
+    name_u = name.encode("utf-16-le")
+    header_len = 24
+    name_off = header_len
+    content_off = _align8(header_len + len(name_u))
+    length = _align8(content_off + len(body))
+    a = bytearray(length)
+    struct.pack_into("<IIBBHHH", a, 0, type_id, length, 0, len(name),
+                     name_off, 0, attr_id)
+    struct.pack_into("<IHBB", a, 16, len(body), content_off,
+                     1 if indexed else 0, 0)
+    a[name_off:name_off + len(name_u)] = name_u
+    a[content_off:content_off + len(body)] = body
+    return bytes(a)
+
+
+def nonresident_attr(type_id, runs, real_size, name="", attr_id=0, flags=0,
+                     compression_unit=0):
+    name_u = name.encode("utf-16-le")
+    header_len = 72 if compression_unit else 64
+    name_off = header_len
+    run_off = _align8(header_len + len(name_u))
+    mp = encode_runs(runs)
+    length = _align8(run_off + len(mp))
+    clusters = sum(n for _, n in runs)
+    alloc = clusters * CLUSTER
+    a = bytearray(length)
+    struct.pack_into("<IIBBHHH", a, 0, type_id, length, 1, len(name),
+                     name_off, flags, attr_id)
+    struct.pack_into("<QQHH", a, 16, 0, clusters - 1, run_off,
+                     compression_unit)
+    struct.pack_into("<QQQ", a, 40, alloc, real_size, real_size)
+    if compression_unit:
+        struct.pack_into("<Q", a, 64, sum(n for l, n in runs if l is not None)
+                         * CLUSTER)
+    a[name_off:name_off + len(name_u)] = name_u
+    a[run_off:run_off + len(mp)] = mp
+    return bytes(a)
+
+
+def std_info(times=None, flags=0x20):
+    t = times or SI_TIMES
+    body = struct.pack("<QQQQIIII", filetime(t["created"]),
+                       filetime(t["modified"]), filetime(t["mft_modified"]),
+                       filetime(t["accessed"]), flags, 0, 0, 0)
+    return body + bytes(72 - len(body))
+
+
+def file_name_body(name, parent, size=0, times=None, namespace=3,
+                   is_dir=False, parent_seq=None):
+    t = times or FN_TIMES
+    seq = parent if parent_seq is None else parent_seq
+    ref = parent | ((seq & 0xFFFF) << 48)
+    alloc = (size + CLUSTER - 1) // CLUSTER * CLUSTER
+    body = struct.pack("<QQQQQQQII", ref, filetime(t["created"]),
+                       filetime(t["modified"]), filetime(t["mft_modified"]),
+                       filetime(t["accessed"]), alloc, size,
+                       0x10000000 if is_dir else 0x20, 0)
+    body += struct.pack("<BB", len(name), namespace) + name.encode("utf-16-le")
+    return body
+
+
+def _index_entries(entries, subnode_vcn=None):
+    blob = bytearray()
+    for ref, fn in entries:
+        length = _align8(16 + len(fn))
+        e = bytearray(length)
+        struct.pack_into("<QHHI", e, 0, ref | (ref << 48), length, len(fn), 0)
+        e[16:16 + len(fn)] = fn
+        blob += e
+    if subnode_vcn is None:
+        blob += struct.pack("<QHHI", 0, 16, 0, 0x02)          # last entry
+    else:
+        blob += struct.pack("<QHHIQ", 0, 24, 0, 0x03, subnode_vcn)
+    return bytes(blob)
+
+
+def index_root(entries, subnode_vcn=None):
+    """$INDEX_ROOT body for a $I30 index. With ``subnode_vcn`` None the
+    ``entries`` (a sorted list of (mft_ref, file_name_body)) sit in the root
+    node; otherwise the root holds only an end entry pointing at that VCN
+    of $INDEX_ALLOCATION and the "large index" flag is set."""
+    blob = _index_entries(entries if subnode_vcn is None else [],
+                          subnode_vcn)
+    header = struct.pack("<IIIB3x", 16, 16 + len(blob), 16 + len(blob),
+                         0 if subnode_vcn is None else 1)
+    root = struct.pack("<IIIB3x", 0x30, 1, INDEX_BLOCK, 1)
+    return root + header + blob
+
+
+def _apply_usa(body, usa_off):
+    usa_count = len(body) // SECTOR + 1
+    body[usa_off:usa_off + 2] = USN
+    for i in range(1, usa_count):
+        end = i * SECTOR
+        body[usa_off + 2 * i:usa_off + 2 * i + 2] = body[end - 2:end]
+        body[end - 2:end] = USN
+
+
+def indx_block(entries, vcn=0):
+    """One INDX record (INDEX_BLOCK bytes, fixups applied) holding sorted
+    leaf ``entries``."""
+    body = bytearray(INDEX_BLOCK)
+    usa_off = 0x28
+    usa_count = INDEX_BLOCK // SECTOR + 1
+    first = _align8(usa_off + usa_count * 2)
+    blob = _index_entries(entries)
+    assert first + len(blob) <= INDEX_BLOCK, "INDX block overflows"
+    body[0:4] = b"INDX"
+    struct.pack_into("<HHQQ", body, 4, usa_off, usa_count, 0, vcn)
+    struct.pack_into("<IIIB", body, 0x18, first - 0x18,
+                     first - 0x18 + len(blob), INDEX_BLOCK - 0x18, 0)
+    body[first:first + len(blob)] = blob
+    _apply_usa(body, usa_off)
+    return bytes(body)
+
+
+def mft_record(number, attrs, in_use=True, is_dir=False, seq=None,
+               tear=False):
+    """A FILE record: header, update sequence array (USN + one saved pair
+    per 512-byte stride), attributes, 0xFFFFFFFF end marker, then fixups
+    applied. ``tear`` corrupts the second stride's check value so the record
+    fails fixup verification, as a torn write would."""
+    strides = RECORD // SECTOR
+    usa_off = 0x30
+    usa_count = strides + 1
+    first_attr = _align8(usa_off + usa_count * 2)
+    body = bytearray(RECORD)
+    body[0:4] = b"FILE"
+    flags = (0x01 if in_use else 0) | (0x02 if is_dir else 0)
+    pos = first_attr
+    for k, a in enumerate(attrs):
+        a = bytearray(a)
+        struct.pack_into("<H", a, 14, k)
+        body[pos:pos + len(a)] = a
+        pos += len(a)
+    body[pos:pos + 4] = b"\xFF\xFF\xFF\xFF"
+    used = _align8(pos + 8)
+    assert used <= RECORD, "record %d overflows" % number
+    struct.pack_into("<HHQHHHHIIQHHI", body, 4, usa_off, usa_count, 0,
+                     number if seq is None else seq, 1, first_attr, flags,
+                     used, RECORD, 0, len(attrs), 0, number)
+    _apply_usa(body, usa_off)
+    if tear:
+        body[2 * SECTOR - 2:2 * SECTOR] = b"\x00\x00"
+    return bytes(body)
+
+
+def _named_file(number, name, parent, data_attrs, size=0, in_use=True,
+                is_dir=False, extra=()):
+    fn = file_name_body(name, parent, size=size, is_dir=is_dir)
+    attrs = [resident_attr(0x10, std_info()),
+             resident_attr(0x30, fn, indexed=True)]
+    attrs += list(extra) + list(data_attrs)
+    return mft_record(number, attrs, in_use=in_use, is_dir=is_dir), fn
+
+
+def build_ntfs():
+    """An NTFS volume: 512-byte sectors, 2 sectors/cluster (1024-byte
+    clusters), 128 clusters, 1024-byte FILE records.
+
+    Boot sector at 0 (OEM "NTFS    ", MFT at LCN 4, $MFTMirr at LCN 36,
+    clusters-per-record 0xF6 = 2^10 bytes, clusters-per-index 1) and a backup
+    boot sector in the volume's last sector. The MFT is 32 records at
+    LCN 4-35 (its own $DATA run list says so); $MFTMirr holds copies of
+    records 0-3; $Bitmap's data sits at LCN 90. Every record carries a
+    3-entry update sequence array (USN 0x4242) with fixups applied.
+
+    Records 0-11 are the system files ($MFT, $MFTMirr, $LogFile, $Volume with
+    $VOLUME_NAME "STRATA", $AttrDef, the root ".", $Bitmap, $Boot, $BadClus,
+    $Secure, $UpCase, $Extend); the root has a $I30 $INDEX_ROOT listing its
+    children in an INDX block at LCN 100 ($INDEX_ROOT flags it as a large
+    index; $INDEX_ALLOCATION and $BITMAP "$I30" accompany it; the index holds
+    the in-use user files only, Win32 names). Records 12-15 are unused-but-formatted. Then:
+
+      16 hello.txt      resident $DATA "Hello, NTFS!\\n"
+      17 big.bin        non-resident, runs (LCN 40 x2)(LCN 60 x1), 2772 bytes;
+                        the 300 slack bytes in LCN 60 are painted NTFSSLACK
+      18 ads.txt        resident "main stream\\n" + resident ADS
+                        "Zone.Identifier" + non-resident ADS "secret"
+                        (100 bytes at LCN 70)
+      19 deleted.txt    record flags 0 (not in use), resident data
+      20 Docs           directory with $INDEX_ROOT listing note.txt
+      21 note.txt       resident, parent Docs
+      22 sparse.bin     runs (LCN 50 x1)(sparse x2)(LCN 51 x1), 4096 bytes
+      23 compressed.txt LZNT1-compressed $DATA, compression unit 16 clusters:
+                        (LCN 80 x1)(sparse x15); decompresses to "abc" * 400
+      24 two-name file  Win32 name "Long filename document.txt" and DOS name
+                        "LONGFI~1.TXT"
+      25 fixup.txt      700-byte resident $DATA straddling the stride end at
+                        byte 510, so it is only correct once fixups apply
+      26 torn.txt       fixup check value wrong in stride 2 (torn write)
+      27-31             zeroed — never formatted
+
+    Every user file's $STANDARD_INFORMATION times are ``SI_TIMES`` and its
+    $FILE_NAME times ``FN_TIMES``.
+    """
+    img = bytearray(TOTAL_CLUSTERS * CLUSTER)
+
+    def put_lcn(lcn, data):
+        img[lcn * CLUSTER:lcn * CLUSTER + len(data)] = data
+
+    boot = bytearray(SECTOR)
+    boot[0:3] = b"\xEB\x52\x90"
+    boot[3:11] = b"NTFS    "
+    struct.pack_into("<HB", boot, 11, SECTOR, SECTORS_PER_CLUSTER)
+    boot[21] = 0xF8
+    struct.pack_into("<HHI", boot, 24, 63, 255, 0)
+    struct.pack_into("<I", boot, 36, 0x00800080)
+    struct.pack_into("<QQQ", boot, 40, TOTAL_CLUSTERS * SECTORS_PER_CLUSTER
+                     - 1, MFT_LCN, MFTMIRR_LCN)
+    boot[64] = 0xF6
+    boot[68] = 0x01
+    struct.pack_into("<Q", boot, 72, SERIAL)
+    boot[510:512] = b"\x55\xAA"
+    img[0:SECTOR] = boot
+    img[len(img) - SECTOR:] = boot
+
+    records = {}
+    root_children = []
+
+    def sysfile(n, name, data_attrs=(), is_dir=False, extra=()):
+        rec, fn = _named_file(n, name, 5, data_attrs, is_dir=is_dir,
+                              extra=extra)
+        records[n] = rec
+        return fn
+
+    mft_bytes = MFT_RECORDS * RECORD
+    sysfile(0, "$MFT", [nonresident_attr(
+        0x80, [(MFT_LCN, mft_bytes // CLUSTER)], mft_bytes)])
+    sysfile(1, "$MFTMirr", [nonresident_attr(
+        0x80, [(MFTMIRR_LCN, 4)], 4 * RECORD)])
+    sysfile(2, "$LogFile", [resident_attr(0x80, b"")])
+    sysfile(3, "$Volume", [resident_attr(0x80, b"")], extra=[
+        resident_attr(0x60, VOLUME_LABEL.encode("utf-16-le")),
+        resident_attr(0x70, struct.pack("<QBBH", 0, 3, 1, 0))])
+    sysfile(4, "$AttrDef", [resident_attr(0x80, b"")])
+    sysfile(6, "$Bitmap", [nonresident_attr(
+        0x80, [(BITMAP_LCN, 1)], (TOTAL_CLUSTERS + 7) // 8)])
+    sysfile(7, "$Boot", [nonresident_attr(0x80, [(0, 1)], CLUSTER)])
+    sysfile(8, "$BadClus", [resident_attr(0x80, b"")])
+    sysfile(9, "$Secure", [])
+    sysfile(10, "$UpCase", [resident_attr(0x80, b"")])
+    sysfile(11, "$Extend", [], is_dir=True)
+    for n in range(12, 16):
+        records[n] = mft_record(n, [], in_use=False)
+
+    def user(key, name, data_attrs, size, parent=5, in_use=True,
+             is_dir=False, extra=()):
+        n = REC[key]
+        rec, fn = _named_file(n, name, parent, data_attrs, size=size,
+                              in_use=in_use, is_dir=is_dir, extra=extra)
+        records[n] = rec
+        if parent == 5 and in_use:
+            root_children.append((n, fn))
+        return fn
+
+    user("hello", "hello.txt", [resident_attr(0x80, HELLO_TEXT)],
+         len(HELLO_TEXT))
+
+    user("big", "big.bin", [nonresident_attr(0x80, BIG_RUNS, BIG_SIZE)],
+         BIG_SIZE)
+    data = big_content()
+    put_lcn(40, data[:2 * CLUSTER])
+    put_lcn(60, data[2 * CLUSTER:]
+            + fill(3 * CLUSTER - BIG_SIZE, SLACK_MARK))
+
+    user("ads", "ads.txt", [
+        resident_attr(0x80, ADS_MAIN),
+        resident_attr(0x80, ZONE_ID, name="Zone.Identifier"),
+        nonresident_attr(0x80, [(SECRET_LCN, 1)], SECRET_SIZE, name="secret"),
+    ], len(ADS_MAIN))
+    put_lcn(SECRET_LCN, secret_content())
+
+    user("deleted", "deleted.txt", [resident_attr(0x80, DELETED_TEXT)],
+         len(DELETED_TEXT), in_use=False)
+
+    note_fn = file_name_body("note.txt", REC["docs"], size=len(NOTE_TEXT))
+    user("docs", "Docs", [], 0, is_dir=True, extra=[
+        resident_attr(0x90, index_root([(REC["note"], note_fn)]),
+                      name="$I30")])
+    user("note", "note.txt", [resident_attr(0x80, NOTE_TEXT)],
+         len(NOTE_TEXT), parent=REC["docs"])
+
+    user("sparse", "sparse.bin", [nonresident_attr(
+        0x80, SPARSE_RUNS, SPARSE_SIZE, flags=0x8000)], SPARSE_SIZE)
+    sc = sparse_content()
+    put_lcn(50, sc[:CLUSTER])
+    put_lcn(51, sc[3 * CLUSTER:])
+
+    user("compressed", "compressed.txt", [nonresident_attr(
+        0x80, [(COMPRESSED_LCN, 1), (None, 15)], len(COMPRESSED_TEXT),
+        flags=0x0001, compression_unit=4)], len(COMPRESSED_TEXT))
+    # One LZNT1 chunk: literals "abc", then a back-reference (offset 3,
+    # length 1197). Header 0xB005 = compressed | signature 3 | size-1 = 5.
+    put_lcn(COMPRESSED_LCN, bytes([0x05, 0xB0, 0x08, 0x61, 0x62, 0x63])
+            + struct.pack("<H", (2 << 12) | (1197 - 3)) + b"\x00\x00")
+
+    n = REC["twonames"]
+    win32 = file_name_body("Long filename document.txt", 5, size=4,
+                           namespace=1)
+    dos = file_name_body("LONGFI~1.TXT", 5, size=4, namespace=2)
+    records[n] = mft_record(n, [
+        resident_attr(0x10, std_info()), resident_attr(0x30, dos, indexed=True),
+        resident_attr(0x30, win32, indexed=True),
+        resident_attr(0x80, b"two\n")])
+    root_children.append((n, win32))
+
+    user("fixup", "fixup.txt", [resident_attr(0x80, fixup_content())],
+         FIXUP_SIZE)
+    n = REC["torn"]
+    fn = file_name_body("torn.txt", 5, size=5)
+    records[n] = mft_record(n, [
+        resident_attr(0x10, std_info()), resident_attr(0x30, fn, indexed=True),
+        resident_attr(0x80, b"torn\n")], tear=True)
+    root_children.append((n, fn))
+
+    root_children_sorted = sorted(
+        root_children,
+        key=lambda item: item[1][66:].decode("utf-16-le").upper())
+    root_fn = file_name_body(".", 5, is_dir=True)
+    records[5] = mft_record(5, [
+        resident_attr(0x10, std_info()),
+        resident_attr(0x30, root_fn, indexed=True),
+        resident_attr(0x90, index_root([], subnode_vcn=0), name="$I30"),
+        nonresident_attr(0xA0, [(ROOT_INDX_LCN, 1)], INDEX_BLOCK,
+                         name="$I30"),
+        resident_attr(0xB0, b"\x01\x00\x00\x00\x00\x00\x00\x00",
+                      name="$I30"),
+    ], is_dir=True)
+    put_lcn(ROOT_INDX_LCN, indx_block(root_children_sorted))
+
+    for n, rec in records.items():
+        at = MFT_LCN * CLUSTER + n * RECORD
+        img[at:at + RECORD] = rec
+    for n in range(4):
+        at = MFTMIRR_LCN * CLUSTER + n * RECORD
+        img[at:at + RECORD] = records[n]
+
+    used = set(range(0, MFT_LCN + MFT_RECORDS)) | set(range(MFTMIRR_LCN, 40))
+    used |= {40, 41, 60, SECRET_LCN, 50, 51, COMPRESSED_LCN, BITMAP_LCN, ROOT_INDX_LCN,
+             TOTAL_CLUSTERS - 1}
+    bitmap = bytearray((TOTAL_CLUSTERS + 7) // 8)
+    for c in used:
+        bitmap[c // 8] |= 1 << (c % 8)
+    put_lcn(BITMAP_LCN, bytes(bitmap))
+    return bytes(img)
+
+
+# --------------------------------------------------------------------------
+# GPT
+# --------------------------------------------------------------------------
+
+BASIC_DATA = "ebd0a0a2-b9e5-4433-87c0-68b6b72699c7"
+GPT_ENTRIES = 128
+GPT_ENTRY_SIZE = 128
+GPT_ARRAY_SECTORS = 32
+
+
+def _gpt_header(this_lba, alt_lba, entry_lba, first, last, disk_guid,
+                array_crc):
+    h = bytearray(92)
+    h[0:8] = b"EFI PART"
+    struct.pack_into("<IIIIQQQQ16sQIII", h, 8, 0x00010000, 92, 0, 0,
+                     this_lba, alt_lba, first, last, disk_guid, entry_lba,
+                     GPT_ENTRIES, GPT_ENTRY_SIZE, array_crc)
+    struct.pack_into("<I", h, 16, binascii.crc32(bytes(h)) & 0xFFFFFFFF)
+    return bytes(h) + bytes(SECTOR - 92)
+
+
+def wrap_gpt(volume, start_lba=2048, name="Strata data"):
+    """A GPT disk holding ``volume`` as partition 1 (Microsoft Basic Data).
+
+    LBA 0 protective MBR (type 0xEE); LBA 1 primary header; LBA 2-33 the
+    128-entry partition array; ``volume`` from ``start_lba``; the backup
+    array and header occupy the last 33 LBAs. Both CRC32s are valid.
+    """
+    count = (len(volume) + SECTOR - 1) // SECTOR
+    total = start_lba + count + 1 + GPT_ARRAY_SECTORS
+    last_lba = total - 1
+    disk = bytearray(total * SECTOR)
+
+    mbr = bytearray(SECTOR)
+    mbr[446:462] = struct.pack("<B3sB3sII", 0, b"\x00\x02\x00", 0xEE,
+                               b"\xFF\xFF\xFF", 1, min(last_lba, 0xFFFFFFFF))
+    mbr[510:512] = b"\x55\xAA"
+    disk[0:SECTOR] = mbr
+
+    entry = bytearray(GPT_ENTRY_SIZE)
+    entry[0:16] = uuid.UUID(BASIC_DATA).bytes_le
+    entry[16:32] = uuid.UUID("5c1b2a3d-0000-4000-8000-000000000001").bytes_le
+    struct.pack_into("<QQQ", entry, 32, start_lba, start_lba + count - 1, 0)
+    nm = name.encode("utf-16-le")[:72]
+    entry[56:56 + len(nm)] = nm
+    array = bytes(entry) + bytes((GPT_ENTRIES - 1) * GPT_ENTRY_SIZE)
+    crc = binascii.crc32(array) & 0xFFFFFFFF
+    disk_guid = uuid.UUID("5c1b2a3d-0000-4000-8000-0000000000aa").bytes_le
+    first_usable = 2 + GPT_ARRAY_SECTORS
+    last_usable = last_lba - 1 - GPT_ARRAY_SECTORS
+
+    disk[SECTOR:2 * SECTOR] = _gpt_header(1, last_lba, 2, first_usable,
+                                          last_usable, disk_guid, crc)
+    disk[2 * SECTOR:2 * SECTOR + len(array)] = array
+    disk[start_lba * SECTOR:start_lba * SECTOR + len(volume)] = volume
+    backup_array_lba = last_lba - GPT_ARRAY_SECTORS
+    disk[backup_array_lba * SECTOR:backup_array_lba * SECTOR
+         + len(array)] = array
+    disk[last_lba * SECTOR:] = _gpt_header(last_lba, 1, backup_array_lba,
+                                           first_usable, last_usable,
+                                           disk_guid, crc)
+    return bytes(disk)
diff --git a/tests/imagebuild_registry.py b/tests/imagebuild_registry.py
new file mode 100644
index 0000000..b6f4f6a
--- /dev/null
+++ b/tests/imagebuild_registry.py
@@ -0,0 +1,255 @@
+"""Build synthetic Windows registry hives (regf) and transaction logs.
+
+Formats follow Maxim Suhanov's "Windows registry file format specification".
+
+Hive file:
+
+    0x0000  base block (4096 bytes): "regf", primary seq (4), secondary seq
+            (4), last written FILETIME (8), major 1, minor 5, type 0,
+            format 1, root cell offset (4, @36), hive bins data size (4, @40),
+            clustering factor 1, file name (UTF-16LE, @48, 64 bytes),
+            checksum (@508) = XOR of the 127 dwords before it (0 -> 1,
+            0xFFFFFFFF -> 0xFFFFFFFE)
+    0x1000  hive bins data: one "hbin" whose size is a multiple of 4096.
+            32-byte header ("hbin", offset, size, reserved, timestamp, spare),
+            then cells: int32 size (negative = allocated, positive = free),
+            aligned to 8 bytes.  Cell offsets are relative to 0x1000.
+
+build_hive() produces this key tree (root name "ROOT"):
+
+    ROOT                       subkeys via an lh list
+      Software                 subkeys via an lf list
+        Strata                 values: see VALUES
+      System                   subkeys via an ri list -> [li, lf]
+        Alpha
+        Beta
+      Ünïcode                  name stored as UTF-16LE (no COMP_NAME flag)
+
+plus a free (positive-size) nk cell "Removed" and a free vk cell
+"OldValue" = REG_SZ "gone", as left behind by a deletion.
+
+Transaction log (new format, .LOG1/.LOG2):
+
+    0x000   512-byte log base block ("regf" + sequence numbers)
+    0x200   log entries: "HvLE", size (multiple of 512), flags, sequence,
+            hive bins data size, dirty page count, hash-1 (Marvin32 of the
+            entry bytes from 40 to size), hash-2 (Marvin32 of the first 32
+            entry bytes, hash-1 included); then (offset, size) page
+            references and the page bytes.
+"""
+
+import struct
+
+BASE_BLOCK = 4096
+MARVIN_SEED = 0x82EF4D887A4E55C5
+MASK = 0xFFFFFFFF
+FILETIME = 133000000000000000          # 2022-06-18T04:26:40Z
+BIG_DATA_SEGMENT = 16344
+
+KEY_HIVE_ENTRY = 0x0004
+KEY_NO_DELETE = 0x0008
+KEY_COMP_NAME = 0x0020
+VALUE_COMP_NAME = 0x0001
+
+REG_SZ, REG_BINARY, REG_DWORD, REG_MULTI_SZ = 1, 3, 4, 7
+
+BIG_BLOB = bytes((i * 7 + 3) & 0xFF for i in range(20000))
+
+# name -> (type, raw data)
+VALUES = [
+    ("", REG_SZ, "default value\x00".encode("utf-16-le")),
+    ("Name", REG_SZ, "Strata\x00".encode("utf-16-le")),
+    ("Count", REG_DWORD, struct.pack("<I", 42)),
+    ("Blob", REG_BINARY, bytes(range(16))),
+    ("Tiny", REG_BINARY, b"\x01\x02\x03"),
+    ("Paths", REG_MULTI_SZ, "C:\\a\x00D:\\b\x00\x00".encode("utf-16-le")),
+    ("Big", REG_BINARY, BIG_BLOB),
+]
+
+
+def base_checksum(block):
+    acc = 0
+    for i in range(0, 508, 4):
+        acc ^= struct.unpack_from("<I", block, i)[0]
+    if acc == 0:
+        return 1
+    if acc == MASK:
+        return MASK - 1
+    return acc
+
+
+def _rotl(v, n):
+    return ((v << n) | (v >> (32 - n))) & MASK
+
+
+def marvin32(data, seed=MARVIN_SEED):
+    """Marvin32 (as used by Windows for registry log entry hashes)."""
+    lo, hi = seed & MASK, (seed >> 32) & MASK
+
+    def mix(lo, hi, v):
+        lo = (lo + v) & MASK
+        hi ^= lo
+        lo = (_rotl(lo, 20) + hi) & MASK
+        hi = _rotl(hi, 9) ^ lo
+        lo = (_rotl(lo, 27) + hi) & MASK
+        hi = _rotl(hi, 19)
+        return lo, hi
+
+    n = len(data) // 4 * 4
+    for i in range(0, n, 4):
+        lo, hi = mix(lo, hi, struct.unpack_from("<I", data, i)[0])
+    tail = data[n:] + b"\x80"
+    lo, hi = mix(lo, hi, struct.unpack("<I", tail.ljust(4, b"\x00"))[0])
+    lo, hi = mix(lo, hi, 0)
+    return (hi << 32) | lo
+
+
+class HiveBuilder(object):
+    """Appends cells into a single hbin; offsets returned are cell offsets."""
+
+    def __init__(self):
+        self.cells = bytearray(32)          # hbin header filled in at the end
+
+    def cell(self, body, free=False):
+        off = len(self.cells)
+        size = (4 + len(body) + 7) // 8 * 8
+        self.cells += struct.pack("<i", size if free else -size)
+        self.cells += body + bytes(size - 4 - len(body))
+        return off
+
+    def nk(self, name, parent, subkeys=0, subkey_list=0xFFFFFFFF, values=0,
+           value_list=0xFFFFFFFF, flags=0, free=False):
+        try:
+            raw = name.encode("ascii")
+            flags |= KEY_COMP_NAME
+        except UnicodeEncodeError:
+            raw = name.encode("utf-16-le")
+        body = struct.pack("<2sHQIIIIIIIIIIIIIIIHH", b"nk", flags, FILETIME,
+                           0, parent, subkeys, 0, subkey_list, 0xFFFFFFFF,
+                           values, value_list, 0xFFFFFFFF, 0xFFFFFFFF,
+                           0, 0, 0, 0, 0, len(raw), 0)
+        return self.cell(body + raw, free=free)
+
+    def vk(self, name, vtype, data, free=False):
+        raw = name.encode("ascii")
+        if len(data) <= 4:
+            size = len(data) | 0x80000000
+            off = struct.unpack("<I", data.ljust(4, b"\x00"))[0]
+        elif len(data) > BIG_DATA_SEGMENT:
+            size, off = len(data), self.big_data(data)
+        else:
+            size, off = len(data), self.cell(data)
+        body = struct.pack("<2sHIIIHH", b"vk", len(raw), size, off, vtype,
+                           VALUE_COMP_NAME if raw else 0, 0)
+        return self.cell(body + raw, free=free)
+
+    def big_data(self, data):
+        segs = [self.cell(data[i:i + BIG_DATA_SEGMENT])
+                for i in range(0, len(data), BIG_DATA_SEGMENT)]
+        seglist = self.cell(struct.pack("<%dI" % len(segs), *segs))
+        return self.cell(struct.pack("<2sHI", b"db", len(segs), seglist))
+
+    def hashed_list(self, sig, offsets):
+        body = struct.pack("<2sH", sig, len(offsets))
+        for o in offsets:
+            body += struct.pack("<I4s", o, b"\x00\x00\x00\x00")
+        return self.cell(body)
+
+    def index_list(self, sig, offsets):
+        return self.cell(struct.pack("<2sH%dI" % len(offsets), sig,
+                                     len(offsets), *offsets))
+
+    def hbins(self):
+        size = (len(self.cells) + 16 + BASE_BLOCK - 1) // BASE_BLOCK * BASE_BLOCK
+        out = bytearray(self.cells)
+        remaining = size - len(out)
+        out += struct.pack("<i", remaining) + bytes(remaining - 4)
+        struct.pack_into("<4sIIIQI", out, 0, b"hbin", 0, size, 0, FILETIME, 0)
+        return bytes(out)
+
+
+def base_block(root_offset, hbins_size, seq1=1, seq2=1, name="ROOT"):
+    blk = bytearray(BASE_BLOCK)
+    struct.pack_into("<4sIIQIIIIIII", blk, 0, b"regf", seq1, seq2, FILETIME,
+                     1, 5, 0, 1, root_offset, hbins_size, 1)
+    fname = ("\\??\\C:\\" + name).encode("utf-16-le")[:64]
+    blk[48:48 + len(fname)] = fname
+    struct.pack_into("<I", blk, 508, base_checksum(blk))
+    return blk
+
+
+def build_hive(name_value="Strata", seq1=1, seq2=1):
+    """The hive described in the module docstring.  `name_value` replaces
+    the Software\\Strata "Name" string (keep its length to keep offsets)."""
+    b = HiveBuilder()
+    # Children are written before their parents, so parent offsets (and the
+    # root's subkey list) are patched in once every offset is known.
+    root = b.nk("ROOT", 0, flags=KEY_HIVE_ENTRY | KEY_NO_DELETE)
+
+    vals = []
+    for vname, vtype, data in VALUES:
+        if vname == "Name":
+            data = (name_value + "\x00").encode("utf-16-le")
+        vals.append(b.vk(vname, vtype, data))
+    vlist = b.cell(struct.pack("<%dI" % len(vals), *vals))
+
+    strata = b.nk("Strata", 0, values=len(vals), value_list=vlist)
+    software = b.nk("Software", root, subkeys=1,
+                    subkey_list=b.hashed_list(b"lf", [strata]))
+    alpha = b.nk("Alpha", 0)
+    beta = b.nk("Beta", 0)
+    ri = b.index_list(b"ri", [b.index_list(b"li", [alpha]),
+                              b.hashed_list(b"lf", [beta])])
+    system = b.nk("System", root, subkeys=2, subkey_list=ri)
+    uni = b.nk(u"\u00dcn\u00efcode", root)
+    root_list = b.hashed_list(b"lh", [software, system, uni])
+
+    # Deleted leftovers: free cells that still hold records.
+    b.nk("Removed", software, free=True)
+    b.vk("OldValue", REG_SZ, "gone\x00".encode("utf-16-le"), free=True)
+
+    # Patch parents and the root's subkey list now offsets are known.
+    def patch_u32(cell_off, field_off, value):
+        struct.pack_into("<I", b.cells, cell_off + 4 + field_off, value)
+
+    for child, parent in ((strata, software), (alpha, system),
+                          (beta, system)):
+        patch_u32(child, 16, parent)
+    patch_u32(root, 20, 3)
+    patch_u32(root, 28, root_list)
+
+    hbins = b.hbins()
+    return bytes(base_block(root, len(hbins), seq1, seq2)) + hbins
+
+
+def log_entry(sequence, hbins_size, pages):
+    """One HvLE entry. `pages` is a list of (offset, bytes)."""
+    refs = b"".join(struct.pack("<II", off, len(data)) for off, data in pages)
+    body = refs + b"".join(data for _off, data in pages)
+    size = (40 + len(body) + 511) // 512 * 512
+    body = body + bytes(size - 40 - len(body))
+    head = struct.pack("<4sIIIII", b"HvLE", size, 0, sequence, hbins_size,
+                       len(pages))
+    head += struct.pack("<Q", marvin32(body))
+    return head + struct.pack("<Q", marvin32(head)) + body
+
+
+def build_log(entries, sequence=1):
+    """A transaction log: 512-byte base block then the given entries."""
+    blk = bytearray(512)
+    struct.pack_into("<4sII", blk, 0, b"regf", sequence, sequence)
+    return bytes(blk) + b"".join(entries)
+
+
+def build_dirty_pair():
+    """(dirty hive, log, expected replayed hive bins).
+
+    The on-disk hive is at primary 11 / secondary 10 and still says
+    Name = "Strata"; the log holds entry 10 rewriting the whole hive bins
+    area so that Name = "Replay".
+    """
+    stale = build_hive("Strata", seq1=11, seq2=10)
+    fresh = build_hive("Replay")
+    fresh_bins = fresh[BASE_BLOCK:]
+    log = build_log([log_entry(10, len(fresh_bins), [(0, fresh_bins)])], 10)
+    return stale, log, fresh_bins
diff --git a/tests/test_ewf.py b/tests/test_ewf.py
new file mode 100644
index 0000000..470ad7b
--- /dev/null
+++ b/tests/test_ewf.py
@@ -0,0 +1,352 @@
+"""Unit tests for image containers (engine.ewf): EWF v1 segment sets, raw
+images, split raw sets and OffsetReader, fed files from imagebuild_ewf."""
+
+import hashlib
+import io
+import os
+import struct
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import imagebuild_ewf as build                                    # noqa: E402
+from engine import ewf                                            # noqa: E402
+
+MEDIA = build.media()                  # 14 sectors: 3 full chunks + 1 short
+
+
+class TempDir(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="strata-ewf-test-")
+        self.addCleanup(self._tmp.cleanup)
+        self.dir = self._tmp.name
+
+    def write(self, name, data):
+        path = os.path.join(self.dir, name)
+        with open(path, "wb") as fh:
+            fh.write(data)
+        return path
+
+    def write_segments(self, segments, stem="x"):
+        paths = [self.write(os.path.basename(n), s) for n, s in
+                 zip(build.segment_names(stem, len(segments)), segments)]
+        return paths[0]
+
+    def open(self, path):
+        img = ewf.open_image(path)
+        self.addCleanup(img.close)
+        return img
+
+
+class SingleSegment(TempDir):
+    def setUp(self):
+        super(SingleSegment, self).setUp()
+        self.img = self.open(self.write_segments(build.build_e01()))
+
+    def test_opens_as_ewf(self):
+        self.assertIsInstance(self.img, ewf.EwfImage)
+
+    def test_volume_geometry(self):
+        info = self.img.info()
+        self.assertEqual(info["format"], "EWF v1 (E01)")
+        self.assertEqual(info["segments"], ["x.E01"])
+        self.assertEqual(info["size"], len(MEDIA))
+        self.assertEqual(info["sector_count"], 14)
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_chunk"], build.SECTORS_PER_CHUNK)
+        self.assertEqual(info["chunk_size"], build.CHUNK_SIZE)
+        self.assertEqual(info["chunk_count"], 4)
+        self.assertEqual(info["compressed_chunks"], 2)
+        self.assertEqual(info["media_type"], 1)
+        self.assertEqual(info["compression_level"], 1)
+        self.assertEqual(info["findings"], [])
+
+    def test_header_section(self):
+        acq = self.img.info()["acquisition"]
+        self.assertEqual(acq["case_number"], "CASE-1")
+        self.assertEqual(acq["evidence_number"], "EV-7")
+        self.assertEqual(acq["examiner"], "Examiner")
+        self.assertEqual(acq["acquisition_date"], "2026 9 16 10 0 0")
+
+    def test_read_back_mixed_chunks(self):
+        self.assertEqual(self.img.read_at(0, len(MEDIA)), MEDIA)
+        self.assertEqual(self.img.findings, [])
+
+    def test_read_across_chunk_boundaries(self):
+        for off, n in ((2000, 100), (4095, 2), (6000, 5000), (0, 1)):
+            self.assertEqual(self.img.read_at(off, n), MEDIA[off:off + n])
+
+    def test_read_past_end(self):
+        self.assertEqual(self.img.read_at(len(MEDIA), 10), b"")
+        with self.assertRaises(ValueError):
+            self.img.read_at(-1, 10)
+
+    def test_file_like_read_and_seek(self):
+        self.img.seek(100)
+        self.assertEqual(self.img.read(10), MEDIA[100:110])
+        self.assertEqual(self.img.seek(5, io.SEEK_CUR), 115)
+        self.img.seek(-12, io.SEEK_END)
+        self.assertEqual(self.img.read(), MEDIA[-12:])
+
+    def test_stored_md5_and_verify(self):
+        md5 = hashlib.md5(MEDIA).hexdigest()
+        self.assertEqual(self.img.stored_md5, md5)
+        got = self.img.verify()
+        self.assertEqual(got["computed_md5"], md5)
+        self.assertEqual(got["computed_sha1"], hashlib.sha1(MEDIA).hexdigest())
+        self.assertTrue(got["md5_match"])
+        self.assertIsNone(got["stored_sha1"])
+
+    def test_all_uncompressed_and_all_compressed(self):
+        for name, fn in (("u", lambda i: False), ("c", lambda i: True)):
+            path = self.write_segments(build.build_e01(compress=fn), name)
+            img = self.open(path)
+            self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+            self.assertEqual(img.findings, [])
+
+
+class SplitSegments(TempDir):
+    def test_e01_e02_read_back(self):
+        segs = build.build_e01(per_segment=2)
+        self.assertEqual(len(segs), 2)
+        img = self.open(self.write_segments(segs))
+        self.assertEqual(img.info()["segments"], ["x.E01", "x.E02"])
+        self.assertEqual(len(img.chunks), 4)
+        self.assertEqual([c.seg for c in img.chunks], [0, 0, 1, 1])
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+        self.assertTrue(img.verify()["md5_match"])
+        self.assertEqual(img.findings, [])
+
+    def test_three_segments_opened_from_the_middle(self):
+        self.write_segments(build.build_e01(per_segment=1), "m")
+        img = self.open(os.path.join(self.dir, "m.E02"))
+        self.assertEqual(len(img.segment_paths), 4)
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_discover_segments_orders_numerically(self):
+        for ext in ("E10", "E02", "E01", "E09"):
+            self.write("s." + ext, b"")
+        self.write("other.E03", b"")
+        got = [os.path.basename(p) for p in
+               ewf.discover_segments(os.path.join(self.dir, "s.E01"))]
+        self.assertEqual(got, ["s.E01", "s.E02", "s.E09", "s.E10"])
+
+    # Engine bug: engine/ewf.py:58-61 the [A-Z]{3} alternative (IGNORECASE)
+    # makes any 3-letter sibling such as x.txt part of the segment set.
+    @unittest.expectedFailure
+    def test_unrelated_sidecar_file_is_not_a_segment(self):
+        path = self.write_segments(build.build_e01())
+        self.write("x.txt", b"acquisition notes\n")
+        img = self.open(path)
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+
+class Integrity(TempDir):
+    def corrupt(self, index, fn):
+        def mutate(i, raw):
+            return fn(raw) if i == index else raw
+        img = self.open(self.write_segments(
+            build.build_e01(chunk_mutator=mutate)))
+        return img, img.read_at(0, len(MEDIA))
+
+    @staticmethod
+    def flip(pos):
+        def fn(raw):
+            b = bytearray(raw)
+            b[pos] ^= 0x01
+            return bytes(b)
+        return fn
+
+    def test_uncompressed_chunk_checksum_mismatch_is_reported(self):
+        img, data = self.corrupt(1, self.flip(5))
+        self.assertNotEqual(data, MEDIA)
+        self.assertTrue(any("Chunk 1" in f and "Adler-32" in f
+                            for f in img.findings), img.findings)
+
+    def test_corrupt_compressed_chunk_is_reported(self):
+        img, data = self.corrupt(0, self.flip(20))
+        self.assertEqual(len(data), len(MEDIA))
+        self.assertEqual(data[:build.CHUNK_SIZE], bytes(build.CHUNK_SIZE))
+        self.assertTrue(any("Chunk 0" in f for f in img.findings))
+
+    def test_verify_detects_mismatch(self):
+        img, _data = self.corrupt(1, self.flip(5))
+        self.assertFalse(img.verify()["md5_match"])
+
+    # Engine bug: engine/ewf.py:307-318 (with engine/inflate.py) accepts a
+    # zlib stream that ends early: the short chunk is returned, no finding.
+    @unittest.expectedFailure
+    def test_truncated_compressed_chunk_is_reported(self):
+        img, data = self.corrupt(0, lambda raw: raw[:len(raw) // 2])
+        self.assertTrue(any("Chunk 0" in f for f in img.findings),
+                        "short read (%d of %d bytes) with no finding"
+                        % (len(data), len(MEDIA)))
+
+    def test_section_descriptor_checksum_mismatch_is_reported(self):
+        seg = bytearray(build.build_e01()[0])
+        seg[13 + 60] ^= 0xFF                 # padding of the header section
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(any("descriptor checksum" in f for f in img.findings))
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_table_header_checksum_mismatch_is_reported(self):
+        seg = bytearray(build.build_e01()[0])
+        table = self.find_section(seg, "table")
+        seg[table + build.DESC + 4] ^= 0xFF    # padding inside table header
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(any("Table header checksum" in f
+                            for f in img.findings))
+
+    @staticmethod
+    def find_section(seg, type_):
+        off = 13
+        while True:
+            name = bytes(seg[off:off + 16]).split(b"\x00")[0].decode()
+            if name == type_:
+                return off
+            off = struct.unpack_from("<Q", seg, off + 16)[0]
+
+
+class Robustness(TempDir):
+    def test_garbage_after_signature(self):
+        path = self.write("g.E01", build.EVF_SIG + bytes(500))
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(path)
+
+    def test_signature_only(self):
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(self.write("s.E01", build.EVF_SIG))
+
+    def test_not_ewf_at_all(self):
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(self.write("n.E01", b"hello world" * 100))
+
+    def test_ewf2_is_refused(self):
+        with self.assertRaises(ewf.EwfError):
+            ewf.open_image(self.write("v2.Ex01", ewf.EVF2_SIG + bytes(100)))
+
+    def test_known_unsupported_container(self):
+        with self.assertRaises(ewf.UnsupportedContainer) as cm:
+            ewf.open_image(self.write("q.qcow2", b"QFI\xfb" + bytes(100)))
+        self.assertIn("QCOW", cm.exception.format)
+
+    def test_truncated_at_every_section_boundary(self):
+        seg = build.build_e01()[0]
+        cuts = [13 + 38, len(seg) // 3, len(seg) // 2, len(seg) - 200,
+                len(seg) - build.DESC - 10]
+        for cut in cuts:
+            path = self.write("t%d.E01" % cut, seg[:cut])
+            try:
+                img = ewf.EwfImage(path)
+            except ewf.EwfError:
+                continue
+            try:
+                img.read_at(0, len(MEDIA))
+                img.info()
+            finally:
+                img.close()
+
+    def test_truncated_before_hash_still_reads(self):
+        seg = build.build_e01()[0]
+        hash_at = Integrity.find_section(seg, "hash")
+        img = self.open(self.write_segments([seg[:hash_at]]))
+        self.assertIsNone(img.stored_md5)
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+        self.assertFalse(img.verify()["md5_match"])
+
+    def test_non_advancing_section_chain(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table2")
+        struct.pack_into("<Q", seg, at + 16, at)
+        struct.pack_into("<I", seg, at + 72, build.adler(bytes(seg[at:at + 72])))
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(any("non-advancing" in f for f in img.findings))
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_backwards_section_pointer(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table2")
+        struct.pack_into("<Q", seg, at + 16, 13)
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(img.findings)
+
+    def test_implausible_table_entry_count(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table")
+        struct.pack_into("<I", seg, at + build.DESC, 0xFFFFFFFF)
+        at2 = Integrity.find_section(seg, "table2")
+        struct.pack_into("<I", seg, at2 + build.DESC, 0)
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(self.write_segments([bytes(seg)]))
+
+    def test_section_size_beyond_file(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table")
+        struct.pack_into("<Q", seg, at + 16, 1 << 40)
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+
+class Raw(TempDir):
+    def test_raw_image(self):
+        path = self.write("disk.dd", MEDIA)
+        img = self.open(path)
+        self.assertIsInstance(img, ewf.RawImage)
+        self.assertEqual(img.size, len(MEDIA))
+        self.assertEqual(img.read_at(1000, 50), MEDIA[1000:1050])
+        self.assertEqual(img.read_at(len(MEDIA) - 5, 50), MEDIA[-5:])
+        self.assertEqual(img.read_at(len(MEDIA), 1), b"")
+        img.seek(-3, io.SEEK_END)
+        self.assertEqual(img.read(), MEDIA[-3:])
+        got = img.verify()
+        self.assertEqual(got["computed_md5"], hashlib.md5(MEDIA).hexdigest())
+        self.assertIsNone(got["md5_match"])
+        self.assertEqual(img.info()["format"], "Raw / dd")
+
+    def test_empty_raw_image(self):
+        img = self.open(self.write("empty.img", b""))
+        self.assertEqual(img.size, 0)
+        self.assertEqual(img.read_at(0, 10), b"")
+
+    # Engine bug: engine/ewf.py:538 open_image hands .001 to RawImage, which
+    # opens that one file only; README promises split raw sets.
+    @unittest.expectedFailure
+    def test_split_raw_set(self):
+        for i, piece in enumerate(build.split_raw(MEDIA, 3000)):
+            self.write("split.%03d" % (i + 1), piece)
+        img = self.open(os.path.join(self.dir, "split.001"))
+        self.assertEqual(img.size, len(MEDIA))
+        self.assertEqual(img.read_at(2990, 20), MEDIA[2990:3010])
+
+
+class OffsetReaderTests(unittest.TestCase):
+    class Mem(object):
+        bytes_per_sector = 4096
+
+        def read_at(self, off, n):
+            return MEDIA[off:off + n] if off >= 0 else b""
+
+    def setUp(self):
+        self.r = ewf.OffsetReader(self.Mem(), 1000, 2000, "p1")
+
+    def test_window(self):
+        self.assertEqual(self.r.bytes_per_sector, 4096)
+        self.assertEqual(self.r.read_at(0, 10), MEDIA[1000:1010])
+        self.assertEqual(self.r.read_at(1990, 100), MEDIA[2990:3000])
+        self.assertEqual(self.r.read_at(2000, 1), b"")
+
+    def test_negative_and_empty(self):
+        self.assertEqual(self.r.read_at(-10, 20), b"")
+        self.assertEqual(self.r.read_at(10, 0), b"")
+
+    def test_read_and_seek(self):
+        self.r.seek(-4, io.SEEK_END)
+        self.assertEqual(self.r.read(), MEDIA[2996:3000])
+        self.r.seek(0)
+        self.assertEqual(len(self.r.read()), 2000)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_fs_exfat.py b/tests/test_fs_exfat.py
new file mode 100644
index 0000000..b4f54d4
--- /dev/null
+++ b/tests/test_fs_exfat.py
@@ -0,0 +1,322 @@
+"""Unit tests for the exFAT parser (engine.fs.exfat).
+
+The image comes from tests/imagebuild_fat.build_exfat() and is opened the
+way the server opens evidence: ewf.open_image -> volume.scan -> OffsetReader
+-> ntfs.open_fs (the filesystem dispatcher).
+"""
+
+import os
+import random
+import struct
+import sys
+import unittest
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.dirname(HERE))
+sys.path.insert(0, HERE)
+
+import imagebuild_fat as build                                   # noqa: E402
+from test_fs_fat import BytesImage, ImageFiles, by_name, \
+    open_first_volume                                            # noqa: E402
+from engine import volume                                        # noqa: E402
+from engine.ewf import OffsetReader                              # noqa: E402
+from engine.fs import exfat, ntfs                                # noqa: E402
+from engine.fs.streams import UnsupportedStream                  # noqa: E402
+
+C = build.EXFAT_CLUSTER
+L = build.EXFAT_LAYOUT
+
+
+class Exfat(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.data = build.build_exfat()
+        cls.image = cls.files.open(cls.data)
+        cls.layout, cls.part, cls.fs = open_first_volume(cls.image)
+        cls.root = by_name(cls.fs.listdir(0))
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    # -- boot record and volume metadata ---------------------------------
+
+    def test_dispatcher_and_probe(self):
+        self.assertIsInstance(self.fs, exfat.ExfatFS)
+        self.assertEqual(volume.identify_fs(self.image, 0), "exFAT")
+        self.assertEqual(self.part["detected"], "exFAT")
+        self.assertEqual(self.part["label"], build.EXFAT_LABEL)
+
+    def test_boot_record_fields(self):
+        info = self.fs.info()
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_cluster"], 2)
+        self.assertEqual(info["cluster_size"], C)
+        self.assertEqual(info["cluster_count"], build.EXFAT_CLUSTERS)
+        self.assertEqual(info["fat_count"], 1)
+        self.assertEqual(info["first_data_offset"],
+                         build.EXFAT_HEAP_OFFSET * 512)
+        self.assertEqual(info["root_cluster"], L["root"][0])
+        self.assertEqual(info["serial"], "%08X" % build.EXFAT_SERIAL)
+        self.assertEqual(info["revision"], "1.0")
+        self.assertEqual(info["percent_in_use"], 30)
+        self.assertFalse(info["volume_dirty"])
+        self.assertEqual(info["label"], build.EXFAT_LABEL)
+
+    def test_allocation_bitmap(self):
+        self.assertEqual(self.fs._bitmap_start, L["bitmap"])
+        bitmap = self.fs._load_bitmap()
+        self.assertEqual(len(bitmap), (build.EXFAT_CLUSTERS + 7) // 8)
+
+        def allocated(c):
+            return bool(bitmap[(c - 2) // 8] >> ((c - 2) % 8) & 1)
+
+        for c in (L["bitmap"], L["upcase"], L["hello"]["cluster"],
+                  L["contiguous"]["cluster"] + 2, L["subdir"]["cluster"] + 1):
+            self.assertTrue(allocated(c), c)
+        self.assertFalse(allocated(L["deleted"]["cluster"]))
+        self.assertFalse(allocated(40))
+        # The bitmap's own cluster is reported as allocated space.
+        off = self.fs.cluster_offset(L["bitmap"])
+        self.assertIn((off, off + C), self.fs.allocated_extents())
+
+    def test_up_case_table_is_metadata_not_a_file(self):
+        # The up-case entry sits between the bitmap entry and the files;
+        # it must neither appear as a file nor stop the root scan.
+        names = set(self.root)
+        self.assertFalse(any("upcase" in n.lower() for n in names))
+        self.assertIn("Hello.txt", names)
+        table = self.fs.source.read_at(self.fs.cluster_offset(L["upcase"]),
+                                       256)
+        self.assertEqual(table, build.upcase_table())
+
+    # -- directory listing ------------------------------------------------
+
+    def test_root_listing(self):
+        self.assertEqual(set(self.root), {
+            "Hello.txt", "Fragmented file.bin", "Contiguous.dat",
+            "Deleted file.txt", "Timezone.txt", "Empty.txt",
+            build.EXFAT_LONG_NAME, "Subdir", "Tail.txt"})
+        # Directories sort first.
+        self.assertEqual(self.fs.listdir(0)[0]["name"], "Subdir")
+        self.assertTrue(self.root["Subdir"]["is_dir"])
+        self.assertTrue(self.root["Subdir"]["contiguous"])
+
+    def test_root_directory_follows_its_fat_chain(self):
+        self.assertEqual(self.fs.chain(L["root"][0]), list(L["root"]))
+        tail = self.root["Tail.txt"]           # entry set straddles clusters
+        self.assertEqual(self.fs.read_file(tail), b"tail")
+
+    def test_three_part_file_name(self):
+        e = self.root[build.EXFAT_LONG_NAME]
+        self.assertEqual(e["path"], "/" + build.EXFAT_LONG_NAME)
+        self.assertEqual(self.fs.read_file(e), b"long name\n")
+
+    def test_timestamps_and_attributes(self):
+        e = self.root["Hello.txt"]
+        self.assertEqual(e["modified"], "2023-11-05T08:30:44Z")
+        self.assertEqual(e["accessed"], "2023-11-05T08:30:44Z")
+        self.assertEqual(e["attributes"], ["archive"])
+
+    # Bug: exfat.py ignores the UTC-offset bytes (22-24) — _ts() takes a tz
+    # argument but never uses it — yet labels local times "Z". 10:00 at
+    # +12:00 is 22:00 UTC the previous day.
+    @unittest.expectedFailure
+    def test_timestamp_honours_utc_offset(self):
+        self.assertEqual(self.root["Timezone.txt"]["created"],
+                         "2024-05-31T22:00:00Z")
+
+    def test_subdirectory_first_cluster(self):
+        sub = self.root["Subdir"]
+        inner = by_name(self.fs.listdir(sub["start_cluster"], "/Subdir"))
+        self.assertIn("Inner.txt", inner)
+        self.assertEqual(inner["Inner.txt"]["path"], "/Subdir/Inner.txt")
+        self.assertEqual(self.fs.read_file(inner["Inner.txt"]), b"inner\n")
+
+    # Bug: exfat.py listdir() always walks the FAT; a NoFatChain directory's
+    # FAT entries are zero, so only its first cluster is read and entries
+    # in later clusters (here Second.txt in cluster 18) are never listed.
+    @unittest.expectedFailure
+    def test_contiguous_subdirectory_second_cluster_listed(self):
+        sub = self.root["Subdir"]
+        inner = by_name(self.fs.listdir(sub["start_cluster"], "/Subdir"))
+        self.assertIn("Second.txt", inner)
+
+    # -- file content ------------------------------------------------------
+
+    def test_fat_chain_stream(self):
+        e = self.root["Fragmented file.bin"]
+        self.assertFalse(e["contiguous"])
+        want = build.exfat_fragmented_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_file(e, max_bytes=1500), want[:1500])
+        self.assertEqual(self.fs.read_range(e, 1000, 1100), want[1000:2100])
+        runs = self.fs.runs(e)
+        self.assertEqual([(r["cluster"], r["clusters"], r["used"])
+                          for r in runs], [(7, 1, C), (9, 1, C), (8, 1, 452)])
+
+    def test_no_fat_chain_contiguous_stream(self):
+        e = self.root["Contiguous.dat"]
+        self.assertTrue(e["contiguous"])
+        # Nothing in the FAT describes this file; the extent comes from the
+        # stream extension alone.
+        c0 = L["contiguous"]["cluster"]
+        for c in range(c0, c0 + L["contiguous"]["count"]):
+            self.assertEqual(self.fs._fat_entry(c), 0)
+        want = build.exfat_contiguous_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_range(e, 2000, 2000), want[2000:])
+        runs = self.fs.runs(e)
+        self.assertEqual(len(runs), 1)
+        self.assertEqual(runs[0]["offset"], self.fs.cluster_offset(c0))
+        self.assertEqual(runs[0]["length"], 3 * C)
+        self.assertEqual(runs[0]["used"], 3000)
+        self.assertTrue(self.fs.stat(e)["contiguous"])
+
+    def test_empty_file(self):
+        e = self.root["Empty.txt"]
+        self.assertEqual(self.fs.read_file(e), b"")
+        self.assertEqual(self.fs.read_range(e, 0, 10), b"")
+        self.assertIsNone(self.fs.slack(e))
+        self.assertEqual(self.fs.runs(e), [])
+
+    def test_named_streams_are_refused(self):
+        with self.assertRaises(UnsupportedStream):
+            self.fs.read_file(self.root["Hello.txt"], stream="ads")
+
+    def test_deleted_entry(self):
+        e = self.root["Deleted file.txt"]
+        self.assertTrue(e["deleted"])
+        self.assertTrue(e["contiguous"])
+        self.assertEqual(e["size"], 100)
+        self.assertEqual(self.fs.read_file(e), build.pattern(100, 13))
+        self.assertIn("contiguous", self.fs.stat(e)["recovery"])
+        # Deleted files are not allocated space.
+        off = self.fs.cluster_offset(L["deleted"]["cluster"])
+        self.assertNotIn(off, {s for s, _ in self.fs.allocated_extents()})
+
+    def test_slack(self):
+        e = self.root["Hello.txt"]
+        n = len(build.EXFAT_HELLO)
+        slack = self.fs.slack(e)
+        self.assertEqual(slack, {
+            "offset": self.fs.cluster_offset(L["hello"]["cluster"]) + n,
+            "length": C - n})
+        self.assertEqual(self.fs.source.read_at(slack["offset"],
+                                                slack["length"]),
+                         build.fill(C - n, build.SLACK_MARK))
+        self.assertEqual(self.fs.stat(e)["slack"], slack)
+
+        cont = self.fs.slack(self.root["Contiguous.dat"])
+        self.assertEqual(cont, {
+            "offset": self.fs.cluster_offset(L["contiguous"]["cluster"] + 2)
+            + (3000 - 2 * C),
+            "length": 3 * C - 3000})
+        self.assertIsNone(self.fs.slack(self.root["Subdir"]))
+
+
+class ExfatRobustness(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.good = build.build_exfat()
+
+    def open_bytes(self, data):
+        return ntfs.open_fs(OffsetReader(BytesImage(data), 0, len(data)))
+
+    def test_truncated_to_boot_sector(self):
+        files = ImageFiles()
+        self.addCleanup(files.close)
+        image = files.open(self.good[:512])
+        try:
+            fs = ntfs.open_fs(OffsetReader(image, 0, image.size))
+        except ValueError:
+            return
+        self.assertEqual(fs.listdir(0), [])
+
+    def test_truncated_mid_heap(self):
+        fs = self.open_bytes(self.good[:self.good.index(b"Hello, exFAT")])
+        for e in fs.listdir(0):
+            self.assertIsInstance(fs.read_file(e), bytes)
+
+    def test_implausible_shifts_rejected(self):
+        for at, value in ((108, 0), (108, 20), (109, 40)):
+            data = bytearray(self.good)
+            data[at] = value
+            with self.subTest(offset=at, value=value):
+                with self.assertRaises(ValueError):
+                    exfat.ExfatFS(BytesImage(data))
+
+    def test_signature_only_is_not_exfat(self):
+        data = bytearray(self.good)
+        data[3:11] = b"EXFAX   "
+        with self.assertRaises(ValueError):
+            exfat.ExfatFS(BytesImage(data))
+
+    def fat_offset(self, cluster):
+        return build.EXFAT_FAT_OFFSET * 512 + cluster * 4
+
+    def test_root_chain_loop_terminates(self):
+        data = bytearray(self.good)
+        struct.pack_into("<I", data, self.fat_offset(L["root"][1]),
+                         L["root"][0])
+        fs = exfat.ExfatFS(BytesImage(data))
+        self.assertEqual(fs.chain(L["root"][0]), list(L["root"]))
+        self.assertEqual(len(fs.listdir(0)), 9)
+
+    def test_absurd_secondary_count(self):
+        data = bytearray(self.good)
+        # Tail.txt's set straddles root clusters 4 and 15; its File entry is
+        # the last entry of cluster 4.
+        file_entry = (build.EXFAT_HEAP_OFFSET * 512
+                      + (L["root"][0] - 2) * C + C - 32)
+        self.assertEqual(data[file_entry], 0x85)
+        data[file_entry + 1] = 0xFF
+        fs = exfat.ExfatFS(BytesImage(data))
+        self.assertIsInstance(fs.listdir(0), list)
+
+    def test_random_entry_header_damage_does_not_crash(self):
+        # Damage confined to each entry's type, secondary-count, flag and
+        # name-length bytes. Length fields are left alone: a huge
+        # NoFatChain length is the unbounded case tested separately below.
+        root = build.EXFAT_HEAP_OFFSET * 512 + (L["root"][0] - 2) * C
+        rng = random.Random(4321)
+        for trial in range(40):
+            data = bytearray(self.good)
+            for _ in range(12):
+                data[root + rng.randrange(0, C // 32) * 32
+                     + rng.randrange(0, 4)] = rng.getrandbits(8)
+            with self.subTest(trial=trial):
+                fs = exfat.ExfatFS(BytesImage(data))
+                for e in fs.listdir(0):
+                    if not e["is_dir"] and e["size"] <= 1 << 20:
+                        fs.read_file(e, max_bytes=1 << 16)
+                        fs.stat(e)
+
+    # Bug: exfat.py chain() (line 86) expands a NoFatChain stream into one
+    # list element per cluster from the untrusted length, unbounded by the
+    # cluster count, so a corrupt length of 2^50 means a 2^40-element list
+    # (hang / MemoryError) on any read. Kept small here: 64 MiB, 65536 items.
+    @unittest.expectedFailure
+    def test_contiguous_run_bounded_by_cluster_heap(self):
+        data = bytearray(self.good)
+        stream = self.good.index("Contiguous.dat".encode("utf-16-le")) - 34
+        self.assertEqual(data[stream], 0xC0)
+        struct.pack_into("<Q", data, stream + 24, 64 << 20)
+        fs = exfat.ExfatFS(BytesImage(data))
+        e = by_name(fs.listdir(0))["Contiguous.dat"]
+        heap_end = fs.cluster_offset(fs.cluster_count + 2)
+        for r in fs.runs(e):
+            self.assertLessEqual(r["offset"] + r["length"], heap_end)
+
+    def test_random_garbage_is_not_exfat(self):
+        rng = random.Random(5)
+        junk = bytes(rng.getrandbits(8) for _ in range(16384))
+        with self.assertRaises(ValueError):
+            exfat.ExfatFS(BytesImage(junk))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_fs_ext4.py b/tests/test_fs_ext4.py
new file mode 100644
index 0000000..c3871dd
--- /dev/null
+++ b/tests/test_fs_ext4.py
@@ -0,0 +1,333 @@
+"""Unit tests for the ext2/3/4 reader (engine.fs.ext4) and jbd2 journal
+(engine.fs.jbd2), fed synthetic images from imagebuild_ext4."""
+
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import imagebuild_ext4 as build                                   # noqa: E402
+from engine.ewf import OffsetReader, open_image, RawImage         # noqa: E402
+from engine.fs import ext4                                        # noqa: E402
+from engine.fs.ntfs import open_fs                                # noqa: E402
+
+
+class MemImage(object):
+    """The read_at/size surface an image object offers, over bytes."""
+
+    bytes_per_sector = 512
+
+    def __init__(self, data, read_budget=None):
+        self.data = data
+        self.size = len(data)
+        self.reads = 0
+        self.read_budget = read_budget
+
+    def read_at(self, offset, length):
+        self.reads += 1
+        if self.read_budget is not None and self.reads > self.read_budget:
+            raise RuntimeError("read budget exhausted (runaway traversal)")
+        if offset < 0 or offset >= self.size:
+            return b""
+        return self.data[offset:offset + length]
+
+
+def mount(data, offset=0, **kw):
+    """Open a filesystem the way the server does: OffsetReader -> open_fs."""
+    img = MemImage(data, **kw)
+    return open_fs(OffsetReader(img, offset, img.size - offset))
+
+
+class Ext4Fixture(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.image = build.build_ext4()
+
+    def setUp(self):
+        self.fs = mount(self.image)
+        self.root = {e["name"]: e for e in self.fs.listdir(2, "/")}
+
+
+class Superblock(Ext4Fixture):
+    def test_open_fs_detects_ext4(self):
+        self.assertIsInstance(self.fs, ext4.Ext4FS)
+        self.assertEqual(self.fs.name, "ext4")
+
+    def test_info_reports_superblock_fields(self):
+        info = self.fs.info()
+        self.assertEqual(info["type"], "ext4")
+        self.assertEqual(info["label"], "strata-test")
+        self.assertEqual(info["uuid"], build.UUID.hex())
+        self.assertEqual(info["block_size"], 1024)
+        self.assertEqual(info["blocks"], build.BLOCKS_COUNT)
+        self.assertEqual(info["inodes"], build.INODES_PER_GROUP)
+        self.assertEqual(info["inode_size"], 256)
+        self.assertEqual(info["groups"], 1)
+        self.assertEqual(info["first_inode"], 11)
+        self.assertEqual(info["last_mounted"], "/mnt")
+        self.assertTrue(info["clean"])
+        self.assertEqual(info["journal_inode"], 8)
+        for feat in ("extents", "inline_data", "filetype", "has_journal"):
+            self.assertIn(feat, info["features"])
+
+    def test_ext2_without_extents_or_journal(self):
+        fs = mount(build.build_ext2_legacy())
+        self.assertEqual(fs.name, "ext2")
+        entries = fs.listdir(2)
+        self.assertEqual([e["name"] for e in entries], ["hello.txt"])
+        self.assertEqual(fs.read_file(entries[0]), b"hello from ext2\n")
+        self.assertFalse(fs.journal_info()["present"])
+
+    def test_through_open_image_on_disk(self):
+        tmp = tempfile.mkdtemp(prefix="strata-ext4-test-")
+        self.addCleanup(lambda: shutil.rmtree(tmp, ignore_errors=True))
+        path = os.path.join(tmp, "disk.dd")
+        pad = bytes(4096)                  # filesystem starts at 4096
+        with open(path, "wb") as fh:
+            fh.write(pad + self.image)
+        img = open_image(path)
+        self.addCleanup(img.close)
+        self.assertIsInstance(img, RawImage)
+        fs = open_fs(OffsetReader(img, len(pad), img.size - len(pad)))
+        entry = {e["name"]: e for e in fs.listdir(2)}["extent.txt"]
+        self.assertEqual(fs.read_file(entry), build.CONTENT["extent.txt"])
+
+
+class Inodes(Ext4Fixture):
+    def test_inode_fields(self):
+        ino = self.fs.inode(build.INO_EXTENT)
+        self.assertEqual(ino.size, 1500)
+        self.assertEqual(ino.uid, 1000)
+        self.assertEqual(ino.links, 1)
+        self.assertTrue(ino.uses_extents)
+        self.assertFalse(ino.deleted)
+        self.assertEqual(ino.mtime, "2023-11-14T22:13:20Z")
+        self.assertEqual(ino.crtime, "2023-11-14T22:13:20Z")
+        self.assertEqual(ino.table_offset, build.Ext4Image.inode_offset(12))
+
+    def test_out_of_range_inode_is_none(self):
+        self.assertIsNone(self.fs.inode(0))
+        self.assertIsNone(self.fs.inode(build.INODES_PER_GROUP + 1))
+
+
+class Directories(Ext4Fixture):
+    def test_root_listing(self):
+        self.assertEqual(
+            sorted(self.root),
+            sorted(["extent.txt", "deep.bin", "legacy.txt", "inline.txt",
+                    "inline_long.txt", "link", "sub", "sparse.bin",
+                    "deleted.txt", "inlinedir"]))
+        self.assertNotIn(".", self.root)
+        self.assertNotIn("..", self.root)
+
+    def test_directories_sort_first(self):
+        names = [e["name"] for e in self.fs.listdir(2)]
+        dirs = [n for n in names if self.root[n]["is_dir"]]
+        self.assertEqual(names[:len(dirs)], sorted(dirs))
+
+    def test_entry_metadata(self):
+        e = self.root["extent.txt"]
+        self.assertEqual(e["path"], "/extent.txt")
+        self.assertEqual(e["inode"], build.INO_EXTENT)
+        self.assertEqual(e["size"], 1500)
+        self.assertEqual(e["mode"], "-rw-r--r--")
+        self.assertEqual(e["type"], "file")
+        self.assertEqual(e["id"], "ext:12")
+        self.assertFalse(e["deleted"])
+        self.assertFalse(e["system"])
+        self.assertTrue(self.root["sub"]["is_dir"])
+        self.assertEqual(self.root["sub"]["mode"], "drwxr-xr-x")
+        self.assertEqual(self.root["link"]["type"], "symlink")
+
+    def test_subdirectory(self):
+        entries = self.fs.listdir(build.INO_SUB, "/sub")
+        self.assertEqual([e["name"] for e in entries], ["nested.txt"])
+        self.assertEqual(entries[0]["path"], "/sub/nested.txt")
+        self.assertEqual(self.fs.read_file(entries[0]),
+                         build.CONTENT["sub/nested.txt"])
+
+    def test_listdir_of_a_file_is_empty(self):
+        self.assertEqual(self.fs.listdir(build.INO_EXTENT), [])
+
+    # Engine bug: engine/fs/ext4.py:311 _dir_entries parses an inline-data
+    # directory as ordinary dirents, ignoring its 4-byte parent-inode prefix.
+    @unittest.expectedFailure
+    def test_inline_directory(self):
+        entries = self.fs.listdir(build.INO_INLINEDIR, "/inlinedir")
+        self.assertEqual([(e["name"], e["inode"]) for e in entries],
+                         [("again.txt", build.INO_EXTENT)])
+
+
+class FileContent(Ext4Fixture):
+    def read(self, name):
+        return self.fs.read_file(self.root[name])
+
+    def test_extent_depth0(self):
+        self.assertEqual(self.read("extent.txt"), build.CONTENT["extent.txt"])
+        self.assertEqual(self.fs.stat(self.root["extent.txt"])["mapping"],
+                         "extent tree")
+
+    def test_extent_depth1(self):
+        self.assertEqual(self.read("deep.bin"), build.CONTENT["deep.bin"])
+        runs = self.fs.runs(self.fs.inode(build.INO_DEEP))
+        self.assertEqual([r["blocks"] for r in runs], [2, 1])
+        self.assertEqual(runs[1]["block"] - runs[0]["block"], 3)
+
+    def test_legacy_block_map_with_indirect_block(self):
+        self.assertEqual(self.read("legacy.txt"), build.CONTENT["legacy.txt"])
+        st = self.fs.stat(self.root["legacy.txt"])
+        self.assertEqual(st["mapping"], "indirect blocks")
+        self.assertEqual(sum(r["blocks"] for r in st["runs"]), 14)
+        self.assertEqual(st["slack"]["length"], 1024 - 100)
+
+    def test_inline_data_small(self):
+        self.assertEqual(self.read("inline.txt"), build.CONTENT["inline.txt"])
+        self.assertTrue(self.root["inline.txt"]["inline"])
+        st = self.fs.stat(self.root["inline.txt"])
+        self.assertEqual(st["mapping"], "inline")
+
+    # Engine bug: engine/fs/ext4.py:296 reads inline data past 60 bytes from
+    # raw[128:] (i_extra_isize...) instead of the "system.data" xattr.
+    @unittest.expectedFailure
+    def test_inline_data_spilling_into_xattr(self):
+        self.assertEqual(self.read("inline_long.txt"),
+                         build.CONTENT["inline_long.txt"])
+
+    def test_fast_symlink(self):
+        self.assertEqual(self.read("link"), build.LINK_TARGET)
+
+    def test_read_range(self):
+        data = build.CONTENT["legacy.txt"]
+        self.assertEqual(
+            self.fs.read_range(self.root["legacy.txt"], 12000, 2000),
+            data[12000:14000])
+        self.assertEqual(
+            self.fs.read_range(self.root["inline.txt"], 6, 4),
+            build.CONTENT["inline.txt"][6:10])
+
+    def test_max_bytes(self):
+        self.assertEqual(self.fs.read_file(self.root["deep.bin"], 10),
+                         build.CONTENT["deep.bin"][:10])
+
+    def test_named_stream_unsupported(self):
+        with self.assertRaises(ValueError):
+            self.fs.read_file(self.root["extent.txt"], stream="ads")
+
+    # Engine bug: engine/fs/ext4.py:261-271 drops ee_block (logical start),
+    # so holes between extents vanish and later extents shift down.
+    @unittest.expectedFailure
+    def test_sparse_extent_hole_reads_as_zeros(self):
+        self.assertEqual(self.read("sparse.bin"), build.CONTENT["sparse.bin"])
+
+
+class Journal(Ext4Fixture):
+    def test_journal_info(self):
+        info = self.fs.journal_info()
+        self.assertTrue(info["present"])
+        self.assertEqual(info["blocks"], build.JOURNAL_BLOCKS)
+        self.assertEqual(info["sequence"], build.JOURNAL_SEQUENCE)
+        self.assertEqual(info["uuid"], build.UUID.hex())
+        self.assertEqual(info["transactions"], 1)
+        self.assertEqual(info["committed"], 1)
+        self.assertEqual(info["blocks_journalled"], 1)
+        self.assertEqual(info["findings"], [])
+
+    def test_deleted_inode_is_flagged(self):
+        e = self.root["deleted.txt"]
+        self.assertTrue(e["deleted"])
+        self.assertEqual(e["deleted_at"], "2023-11-14T22:21:40Z")
+        self.assertEqual(e["size"], 0)
+
+    def test_superseded_inode_version_found(self):
+        versions = self.fs.journal.inode_versions(build.INO_DELETED)
+        self.assertEqual(len(versions), 1)
+        v = versions[0]
+        self.assertEqual(v["sequence"], build.JOURNAL_SEQUENCE)
+        self.assertTrue(v["committed"])
+        self.assertFalse(v["deleted"])
+        self.assertEqual(v["size"], len(build.CONTENT["deleted.txt"]))
+
+    def test_stat_reports_journal_recovery(self):
+        st = self.fs.stat(self.root["deleted.txt"])
+        rec = st["journal_recovery"]
+        self.assertEqual(rec["sequence"], build.JOURNAL_SEQUENCE)
+        self.assertTrue(rec["committed"])
+        self.assertEqual(st["recovered_size"],
+                         len(build.CONTENT["deleted.txt"]))
+        self.assertIn("journal", st["recovery"])
+
+    def test_read_file_returns_recovered_content(self):
+        self.assertEqual(self.fs.read_file(self.root["deleted.txt"]),
+                         build.CONTENT["deleted.txt"])
+
+    def test_no_recovery_for_inode_not_in_journal(self):
+        self.assertIsNone(self.fs.journal.recover(build.INO_EXTENT))
+
+
+class Robustness(unittest.TestCase):
+    def test_garbage_is_rejected(self):
+        with self.assertRaises(ValueError):
+            ext4.Ext4FS(MemImage(bytes(range(256)) * 16))
+
+    def test_empty_source(self):
+        with self.assertRaises(ValueError):
+            ext4.Ext4FS(MemImage(b""))
+
+    def test_zero_group_sizing_is_rejected(self):
+        data = bytearray(build.build_ext4())
+        data[1024 + 32:1024 + 36] = bytes(4)          # blocks_per_group
+        with self.assertRaises(ValueError):
+            ext4.Ext4FS(MemImage(bytes(data)))
+
+    def test_truncated_after_superblock(self):
+        fs = ext4.Ext4FS(MemImage(build.build_ext4()[:2048]))
+        self.assertEqual(fs.listdir(2), [])
+        self.assertIsNone(fs.inode(12))
+        self.assertFalse(fs.journal_info()["present"])
+
+    def test_truncated_inside_inode_table(self):
+        fs = ext4.Ext4FS(MemImage(build.build_ext4()[:7 * 1024]))
+        self.assertEqual(fs.listdir(2), [])
+
+    def test_corrupt_extent_magic_gives_no_runs(self):
+        data = bytearray(build.build_ext4())
+        off = build.Ext4Image.inode_offset(build.INO_EXTENT) + 40
+        data[off:off + 2] = b"\x00\x00"
+        fs = mount(bytes(data))
+        self.assertEqual(fs.runs(fs.inode(build.INO_EXTENT)), [])
+
+    def test_directory_with_zero_rec_len_terminates(self):
+        data = bytearray(build.build_ext4())
+        fs = mount(bytes(data))
+        root_block = fs.runs(fs.inode(2))[0]["block"]
+        data[root_block * 1024 + 4:root_block * 1024 + 6] = b"\x00\x00"
+        self.assertEqual(mount(bytes(data)).listdir(2), [])
+
+    # Engine bug: engine/fs/ext4.py:214-222 bounds extent-tree depth (8) but
+    # not fan-out or revisits; a self-referencing index node costs 84^7 reads.
+    @unittest.expectedFailure
+    def test_self_referencing_extent_index_is_bounded(self):
+        fs = mount(build.build_ext4_extent_loop(), read_budget=20000)
+        fs.runs(fs.inode(12))
+
+    def test_truncated_journal_is_reported_absent(self):
+        fs = mount(build.build_ext4_truncated_journal())
+        info = fs.journal_info()
+        self.assertFalse(info["present"])
+        self.assertTrue(info["findings"])
+        self.assertIn("extent.txt", [e["name"] for e in fs.listdir(2)])
+
+    # Engine bug: engine/fs/ext4.py:140-151 the _Absent journal stand-in has
+    # no read_recovered(), which read_file calls for deleted files (line 368).
+    @unittest.expectedFailure
+    def test_deleted_file_read_with_unreadable_journal(self):
+        fs = mount(build.build_ext4_truncated_journal())
+        entry = {e["name"]: e for e in fs.listdir(2)}["deleted.txt"]
+        self.assertEqual(fs.read_file(entry), b"")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_fs_fat.py b/tests/test_fs_fat.py
new file mode 100644
index 0000000..7978c7a
--- /dev/null
+++ b/tests/test_fs_fat.py
@@ -0,0 +1,411 @@
+"""Unit tests for the FAT12/16/32 parser (engine.fs.fat) and the MBR probe.
+
+Images come from tests/imagebuild_fat.py. They are written to a temporary
+file and opened the way the server opens evidence: ewf.open_image ->
+volume.scan -> OffsetReader over the partition -> ntfs.open_fs (the
+filesystem dispatcher).
+"""
+
+import os
+import random
+import shutil
+import sys
+import tempfile
+import unittest
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.dirname(HERE))
+sys.path.insert(0, HERE)
+
+import imagebuild_fat as build                                   # noqa: E402
+from engine import volume                                        # noqa: E402
+from engine.ewf import OffsetReader, open_image                  # noqa: E402
+from engine.fs import fat, ntfs                                  # noqa: E402
+
+C = build.FAT_CLUSTER
+L = build.FAT_LAYOUT
+
+
+class BytesImage:
+    """In-memory stand-in for ewf.RawImage (read_at + size), used only where
+    a test mutates an image many times and a file per mutation is wasteful."""
+
+    def __init__(self, data):
+        self.data = bytes(data)
+        self.size = len(self.data)
+        self.bytes_per_sector = 512
+
+    def read_at(self, offset, length):
+        if offset < 0 or length <= 0 or offset >= self.size:
+            return b""
+        return self.data[offset:offset + length]
+
+
+class ImageFiles:
+    """Write built images to a temp dir and open them with ewf.open_image."""
+
+    def __init__(self):
+        self.dir = tempfile.mkdtemp(prefix="strata-fs-test-")
+        self.images = []
+
+    def open(self, data, name="image.raw"):
+        path = os.path.join(self.dir, "%d-%s" % (len(self.images), name))
+        with open(path, "wb") as fh:
+            fh.write(data)
+        img = open_image(path)
+        self.images.append(img)
+        return img
+
+    def open_extents(self, size, extents, name="image.raw"):
+        """Like ``open`` for a SparseImage's extents, never holding the
+        whole image in memory."""
+        path = os.path.join(self.dir, "%d-%s" % (len(self.images), name))
+        build.write_sparse(path, size, extents)
+        img = open_image(path)
+        self.images.append(img)
+        return img
+
+    def close(self):
+        for img in self.images:
+            img.close()
+        shutil.rmtree(self.dir, ignore_errors=True)
+
+
+def open_first_volume(image):
+    """What the server does for /api/dir: scan, pick the partition, wrap it
+    in an OffsetReader and hand that to the dispatcher."""
+    layout = volume.scan(image)
+    part = next(p for p in layout["partitions"] if p.get("detected"))
+    src = OffsetReader(image, part["offset"], part["size"], part["slot"])
+    return layout, part, ntfs.open_fs(src)
+
+
+def by_name(entries):
+    return {e["name"]: e for e in entries}
+
+
+class _FatWidth:
+    """Width-sensitive checks, run once per FAT width by the subclasses."""
+
+    bits = None
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.image = cls.files.open_extents(*build.build_fat_extents(cls.bits))
+        cls.layout, cls.part, cls.fs = open_first_volume(cls.image)
+        cls.root = by_name(cls.fs.listdir(0))
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    def test_dispatcher_returns_fat_with_detected_width(self):
+        self.assertIsInstance(self.fs, fat.FatFS)
+        self.assertEqual(self.fs.bits, self.bits)
+        self.assertEqual(self.fs.name, "FAT%d" % self.bits)
+        self.assertEqual(self.fs.info()["type"], "FAT%d" % self.bits)
+
+    def test_volume_probe_names_the_width(self):
+        self.assertEqual(volume.identify_fs(self.image, 0), "FAT%d" % self.bits)
+        self.assertEqual(self.layout["scheme"], "None (unpartitioned)")
+        self.assertEqual(self.part["detected"], "FAT%d" % self.bits)
+        self.assertEqual(self.part["label"], "STRATATEST")
+
+    def test_bpb_fields(self):
+        total, reserved, nfats, fat_size, root_entries = \
+            build.FAT_GEOMETRY[self.bits]
+        root_sectors = (root_entries * 32 + 511) // 512
+        first_data = reserved + nfats * fat_size + root_sectors
+        info = self.fs.info()
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_cluster"], 1)
+        self.assertEqual(info["cluster_size"], C)
+        self.assertEqual(info["fat_count"], nfats)
+        self.assertEqual(info["fat_size_sectors"], fat_size)
+        self.assertEqual(info["first_data_offset"], first_data * 512)
+        self.assertEqual(info["cluster_count"], total - first_data)
+        self.assertEqual(info["root_cluster"],
+                         L["root_cluster_fat32"] if self.bits == 32 else 0)
+        self.assertEqual(info["label"], "STRATATEST")
+        self.assertEqual(self.fs.total_sectors, total)
+        self.assertEqual(self.fs.reserved_sectors, reserved)
+        self.assertEqual(self.fs.root_entries, root_entries)
+
+    def test_root_listing(self):
+        self.assertEqual(set(self.root), {
+            "HELLO.TXT", "Long file name.txt", "SUBDIR", "_ELETED.TXT",
+            self.root_deleted_lfn_name(), "CYCLE.BIN", build.GONE_NAME})
+        # The volume label entry is metadata, not a file.
+        self.assertNotIn("STRATATEST", self.root)
+        self.assertTrue(self.root["SUBDIR"]["is_dir"])
+        self.assertEqual(self.root["HELLO.TXT"]["path"], "/HELLO.TXT")
+
+    def root_deleted_lfn_name(self):
+        # Deliberately taken from the listing: its exact spelling is covered
+        # (as a known bug) in FatDirectoryEntries.
+        return next(e["name"] for e in self.root.values()
+                    if e["short_name"] == "_EMOVE~1.TXT")
+
+    def test_single_cluster_file_content(self):
+        e = self.root["HELLO.TXT"]
+        self.assertEqual(e["start_cluster"], L["hello"]["cluster"])
+        self.assertEqual(self.fs.read_file(e), build.HELLO_TEXT)
+        self.assertEqual(self.fs.read_file(e, max_bytes=5), b"Hello")
+
+    def test_fragmented_chain_content_and_runs(self):
+        e = self.root["Long file name.txt"]
+        self.assertEqual(self.fs.chain(e["start_cluster"]),
+                         list(build.LONG_CLUSTERS))
+        self.assertEqual(self.fs.read_file(e), build.long_content())
+        runs = self.fs.runs(e["start_cluster"], e["size"])
+        self.assertEqual(
+            [(r["offset"], r["length"], r["used"], r["clusters"])
+             for r in runs],
+            [(self.fs.cluster_offset(4), 2 * C, 2 * C, 2),
+             (self.fs.cluster_offset(9), C, 100, 1)])
+
+    def test_read_range_across_fragment_boundary(self):
+        e = self.root["Long file name.txt"]
+        want = build.long_content()
+        self.assertEqual(self.fs.read_range(e, 1000, 100), want[1000:1100])
+        # Reads are clamped to the file size.
+        self.assertEqual(self.fs.read_range(e, 1100, 500), want[1100:])
+        self.assertEqual(self.fs.read_range(e, 5000, 10), b"")
+
+    def test_subdirectory_spanning_two_clusters(self):
+        sub = self.root["SUBDIR"]
+        self.assertEqual(self.fs.chain(sub["start_cluster"]),
+                         list(L["subdir"]["clusters"]))
+        entries = by_name(self.fs.listdir(sub["start_cluster"], "/SUBDIR"))
+        self.assertNotIn(".", entries)
+        self.assertNotIn("..", entries)
+        self.assertEqual(len(entries), L["subdir_fillers"] + 1)
+        nested = entries["NESTED.BIN"]
+        self.assertEqual(nested["path"], "/SUBDIR/NESTED.BIN")
+        self.assertEqual(self.fs.read_file(nested), build.nested_content())
+
+    def test_cyclic_chain_is_cut_not_followed_forever(self):
+        e = self.root["CYCLE.BIN"]
+        self.assertEqual(self.fs.chain(e["start_cluster"]),
+                         list(L["cycle"]["clusters"]))
+        self.assertEqual(self.fs.read_file(e), b"A" * C + b"B" * C)
+
+    def test_allocated_extents_cover_live_files_only(self):
+        extents = self.fs.allocated_extents()
+        starts = {s for s, _ in extents}
+        self.assertIn(self.fs.cluster_offset(L["hello"]["cluster"]), starts)
+        self.assertIn(self.fs.cluster_offset(L["nested"]["clusters"][0]),
+                      starts)
+        self.assertNotIn(self.fs.cluster_offset(L["deleted"]["cluster"]),
+                         starts)
+
+
+class Fat12(_FatWidth, unittest.TestCase):
+    bits = 12
+
+
+class Fat16(_FatWidth, unittest.TestCase):
+    bits = 16
+
+
+class Fat32(_FatWidth, unittest.TestCase):
+    bits = 32
+
+
+class FatDirectoryEntries(unittest.TestCase):
+    """Entry-level behaviour that does not depend on the FAT width (FAT16)."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.image = cls.files.open(build.build_fat(16))
+        _layout, _part, cls.fs = open_first_volume(cls.image)
+        cls.entries = cls.fs.listdir(0)
+        cls.root = by_name(cls.entries)
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    def test_timestamps(self):
+        e = self.root["HELLO.TXT"]
+        # 10:20:30 plus a 10 ms-resolution byte of 150 -> 31 s.
+        self.assertEqual(e["created"], "2024-03-15T10:20:31Z")
+        self.assertEqual(e["modified"], "2024-03-15T13:45:30Z")
+        self.assertEqual(e["accessed"], "2024-03-16T00:00:00Z")
+        self.assertIsNone(self.root["CYCLE.BIN"]["modified"])
+
+    def test_attributes(self):
+        self.assertEqual(self.root["HELLO.TXT"]["attributes"], ["archive"])
+        self.assertEqual(self.root["SUBDIR"]["attributes"], ["directory"])
+
+    def test_long_filename_and_short_alias(self):
+        e = self.root["Long file name.txt"]
+        self.assertEqual(e["short_name"], "LONGFI~1.TXT")
+        self.assertFalse(e["deleted"])
+
+    def test_deleted_entry_without_lfn(self):
+        e = self.root["_ELETED.TXT"]
+        self.assertTrue(e["deleted"])
+        self.assertEqual(e["size"], build.DELETED_SIZE)
+        # The FAT chain is gone; content is read contiguously from the start.
+        self.assertEqual(self.fs.read_file(e), build.deleted_content())
+        self.assertEqual(self.fs.read_range(e, 500, 50),
+                         build.deleted_content()[500:550])
+        self.assertIn("recovery", self.fs.stat(e))
+
+    def test_deleted_entry_first_character_recovered_from_lfn(self):
+        # Deletion overwrites only the first byte of each entry; the long
+        # name keeps the character the short name lost.
+        e = self.root[build.GONE_NAME]
+        self.assertTrue(e["deleted"])
+        self.assertEqual(e["short_name"], "_ONEFI~1.TXT")
+        self.assertEqual(self.fs.read_file(e), build.GONE_TEXT)
+        by_short = {x["short_name"]: x for x in self.entries if x["deleted"]}
+        self.assertEqual(self.fs.read_file(by_short["_EMOVE~1.TXT"]),
+                         build.deleted_lfn_content())
+
+    # Bug: fat.py sorts LFN parts by (seq & 0x3F), but deletion overwrites
+    # every sequence byte with 0xE5, so multi-part deleted names come out in
+    # on-disk (reverse) order: "ent.txtRemoved docum".
+    @unittest.expectedFailure
+    def test_deleted_multi_part_lfn_is_in_order(self):
+        names = {e["name"] for e in self.entries if e["deleted"]}
+        self.assertIn(build.DELETED_LFN_NAME, names)
+
+    def test_file_slack(self):
+        e = self.root["HELLO.TXT"]
+        slack = self.fs.slack(e)
+        off = self.fs.cluster_offset(L["hello"]["cluster"])
+        self.assertEqual(slack, {"offset": off + len(build.HELLO_TEXT),
+                                 "length": C - len(build.HELLO_TEXT)})
+        got = self.fs.source.read_at(slack["offset"], slack["length"])
+        self.assertEqual(got, build.fill(slack["length"], build.SLACK_MARK))
+        self.assertEqual(self.fs.stat(e)["slack"], slack)
+
+    def test_no_slack_for_directories_or_exact_fit(self):
+        self.assertIsNone(self.fs.slack(self.root["SUBDIR"]))
+        exact = dict(self.root["HELLO.TXT"], size=C)
+        self.assertIsNone(self.fs.slack(exact))
+
+    # Bug: fat.py slack() walks the (freed) FAT chain for deleted files, so it
+    # reports slack inside the first cluster (offset of cluster 12 + 188),
+    # i.e. inside the content read_file() just returned, instead of after it.
+    @unittest.expectedFailure
+    def test_deleted_multi_cluster_file_slack_follows_its_content(self):
+        e = self.root["_ELETED.TXT"]
+        tail = build.DELETED_SIZE - C
+        self.assertEqual(self.fs.slack(e), {
+            "offset": self.fs.cluster_offset(L["deleted"]["cluster"] + 1)
+            + tail,
+            "length": C - tail})
+
+
+class FatInMbrPartition(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    def test_partition_found_and_opened(self):
+        image = self.files.open(build.wrap_mbr(build.build_fat(16), 63, 0x06))
+        scheme, parts = volume.parse_mbr(image)
+        self.assertEqual(scheme, "MBR")
+        self.assertEqual(len(parts), 1)
+        self.assertEqual(parts[0]["offset"], 63 * 512)
+        self.assertEqual(parts[0]["type"], "FAT16")
+        layout, part, fs = open_first_volume(image)
+        self.assertEqual(layout["scheme"], "MBR")
+        self.assertEqual(part["detected"], "FAT16")
+        self.assertEqual(part["label"], "STRATATEST")
+        self.assertIn("HELLO.TXT", by_name(fs.listdir(0)))
+        self.assertEqual(fs.read_file(by_name(fs.listdir(0))["HELLO.TXT"]),
+                         build.HELLO_TEXT)
+
+    def test_table_type_disagreeing_with_boot_record_is_noted(self):
+        image = self.files.open(build.wrap_mbr(build.build_fat(12), 63, 0x83))
+        part = next(p for p in volume.scan(image)["partitions"]
+                    if p.get("slot") == "MBR 1")
+        self.assertEqual(part["detected"], "FAT12")
+        self.assertIn("FAT12", part.get("note", ""))
+
+
+class FatRobustness(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.good = build.build_fat(12)
+
+    def open_bytes(self, data):
+        return ntfs.open_fs(OffsetReader(BytesImage(data), 0, len(data)))
+
+    def test_random_garbage_is_not_a_filesystem(self):
+        rng = random.Random(1234)
+        junk = bytes(rng.getrandbits(8) for _ in range(64 * 1024))
+        with self.assertRaises(ValueError):
+            self.open_bytes(junk)
+        with self.assertRaises(ValueError):
+            fat.FatFS(BytesImage(junk))
+
+    def test_garbage_bpb_with_boot_signature_is_rejected(self):
+        rng = random.Random(99)
+        junk = bytearray(rng.getrandbits(8) for _ in range(8192))
+        junk[11:13] = b"\x00\x03"         # 768 bytes per sector: implausible
+        junk[510:512] = b"\x55\xAA"
+        with self.assertRaises(ValueError):
+            fat.FatFS(BytesImage(junk))
+
+    def test_empty_and_tiny_images(self):
+        for data in (b"", b"\x00" * 100, self.good[:511]):
+            with self.assertRaises(ValueError):
+                self.open_bytes(data)
+
+    def test_truncated_volume_is_refused(self):
+        files = ImageFiles()
+        self.addCleanup(files.close)
+        image = files.open(self.good[:4096])
+        with self.assertRaises(ValueError):
+            ntfs.open_fs(OffsetReader(image, 0, image.size))
+
+    def test_listing_a_nonsense_cluster_is_empty(self):
+        fs = fat.FatFS(BytesImage(self.good))
+        self.assertEqual(fs.listdir(0x0FFFFFF0), [])
+        self.assertEqual(fs.chain(1), [])
+
+    def test_mutated_boot_sector_fails_cleanly(self):
+        # Every BPB byte set to 0x00 and 0xFF in turn: the parser either
+        # refuses the volume with ValueError or lists it without crashing.
+        for at in range(11, 62):
+            for value in (0x00, 0xFF):
+                data = bytearray(self.good)
+                data[at] = value
+                try:
+                    fs = fat.FatFS(BytesImage(data))
+                except ValueError:
+                    continue
+                with self.subTest(offset=at, value=value):
+                    self.assertIsInstance(fs.listdir(0), list)
+
+    def test_mutated_root_directory_does_not_crash(self):
+        fs = fat.FatFS(BytesImage(self.good))
+        root = (fs.reserved_sectors + fs.num_fats * fs.fat_size) * 512
+        rng = random.Random(7)
+        for trial in range(40):
+            data = bytearray(self.good)
+            for _ in range(16):
+                data[root + rng.randrange(0, 12 * 32)] = rng.getrandbits(8)
+            fs = fat.FatFS(BytesImage(data))
+            with self.subTest(trial=trial):
+                for e in fs.listdir(0):
+                    if not e["is_dir"]:
+                        fs.read_file(e, max_bytes=1 << 16)
+                        fs.stat(e)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_fs_ntfs.py b/tests/test_fs_ntfs.py
new file mode 100644
index 0000000..664c359
--- /dev/null
+++ b/tests/test_fs_ntfs.py
@@ -0,0 +1,413 @@
+"""Unit tests for the NTFS parser (engine.fs.ntfs), LZNT1 (engine.fs.lznt1)
+and the GPT reader (engine.volume.parse_gpt).
+
+Images come from tests/imagebuild_ntfs.py and are opened the way the server
+opens evidence: ewf.open_image -> volume.scan -> OffsetReader -> ntfs.open_fs.
+"""
+
+import os
+import random
+import struct
+import sys
+import unittest
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.dirname(HERE))
+sys.path.insert(0, HERE)
+
+import imagebuild_ntfs as build                                  # noqa: E402
+from test_fs_fat import BytesImage, ImageFiles, by_name, \
+    open_first_volume                                            # noqa: E402
+from engine import volume                                        # noqa: E402
+from engine.ewf import OffsetReader                              # noqa: E402
+from engine.fs import lznt1, ntfs                                # noqa: E402
+from engine.fs.streams import NoSuchStream                       # noqa: E402
+
+C = build.CLUSTER
+REC = build.REC
+
+
+class NtfsOnGpt(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.volume = build.build_ntfs()
+        cls.image = cls.files.open(build.wrap_gpt(cls.volume))
+        cls.layout, cls.part, cls.fs = open_first_volume(cls.image)
+        cls.root = by_name(cls.fs.listdir(5))
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    # -- partition table and boot sector ------------------------------------
+
+    def test_gpt_partition_detected(self):
+        scheme, parts, findings = volume.parse_gpt(self.image)
+        self.assertEqual(scheme, "GPT")
+        self.assertEqual(findings, [])
+        self.assertEqual(len(parts), 1)
+        p = parts[0]
+        self.assertEqual(p["type"], "Microsoft Basic Data")
+        self.assertEqual(p["name"], "Strata data")
+        self.assertEqual(p["offset"], 2048 * 512)
+        self.assertEqual(p["size"], len(self.volume))
+        self.assertEqual(self.layout["scheme"], "GPT")
+        self.assertEqual(self.part["detected"], "NTFS")
+        self.assertEqual(self.part["label"], build.VOLUME_LABEL)
+
+    def test_damaged_primary_gpt_falls_back_to_backup(self):
+        disk = bytearray(build.wrap_gpt(self.volume))
+        disk[2 * 512 + 60] ^= 0xFF                 # inside the entry name
+        scheme, parts, findings = volume.parse_gpt(BytesImage(disk))
+        self.assertEqual(scheme, "GPT")
+        self.assertEqual(len(parts), 1)
+        self.assertEqual(parts[0]["name"], "Strata data")
+        text = " ".join(findings)
+        self.assertIn("checksum", text)
+        self.assertIn("backup", text)
+
+    def test_mbr_view_is_protective(self):
+        scheme, parts = volume.parse_mbr(self.image)
+        self.assertEqual(scheme, "GPT protective")
+
+    def test_boot_sector_fields(self):
+        self.assertIsInstance(self.fs, ntfs.NtfsFS)
+        info = self.fs.info()
+        self.assertEqual(info["label"], build.VOLUME_LABEL)
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_cluster"], 2)
+        self.assertEqual(info["cluster_size"], C)
+        self.assertEqual(info["mft_offset"], build.MFT_LCN * C)
+        self.assertEqual(info["mft_record_size"], build.RECORD)
+        self.assertEqual(info["mft_records"], build.MFT_RECORDS)
+        self.assertEqual(info["serial"], "%016X" % build.SERIAL)
+        self.assertEqual(self.fs.mftmirr_cluster, build.MFTMIRR_LCN)
+
+    # -- records, fixups, names, timestamps ---------------------------------
+
+    def test_root_listing(self):
+        for name in ("hello.txt", "big.bin", "ads.txt", "deleted.txt", "Docs",
+                     "sparse.bin", "compressed.txt",
+                     "Long filename document.txt", "fixup.txt", "torn.txt",
+                     "$MFT", "$Volume"):
+            self.assertIn(name, self.root)
+        self.assertNotIn("note.txt", self.root)
+        self.assertEqual(self.root["hello.txt"]["path"], "/hello.txt")
+        self.assertTrue(self.root["Docs"]["is_dir"])
+        self.assertTrue(self.root["$MFT"]["system"])
+
+    def test_directory_listing(self):
+        docs = self.root["Docs"]
+        inside = self.fs.listdir(docs["mft"], "/Docs")
+        self.assertEqual([e["name"] for e in inside], ["note.txt"])
+        self.assertEqual(inside[0]["path"], "/Docs/note.txt")
+        self.assertEqual(self.fs.read_file(inside[0]), build.NOTE_TEXT)
+
+    def test_fixups_restore_bytes_at_stride_end(self):
+        e = self.root["fixup.txt"]
+        self.assertTrue(e["fixup_ok"])
+        self.assertEqual(self.fs.read_file(e), build.fixup_content())
+
+    def test_torn_record_flagged(self):
+        e = self.root["torn.txt"]
+        self.assertFalse(e["fixup_ok"])
+        self.assertTrue(self.root["hello.txt"]["fixup_ok"])
+
+    def test_apply_fixups_directly(self):
+        raw = build.mft_record(40, [build.resident_attr(
+            0x80, bytes(range(256)) * 3)])
+        self.assertEqual(raw[510:512], build.USN)
+        fixed, ok = ntfs.apply_fixups(raw, 512)
+        self.assertTrue(ok)
+        self.assertNotEqual(fixed[510:512], build.USN)
+        torn = build.mft_record(40, [], tear=True)
+        self.assertFalse(ntfs.apply_fixups(torn, 512)[1])
+        self.assertEqual(ntfs.apply_fixups(b"FILE", 512), (b"FILE", False))
+
+    def test_si_and_fn_timestamps_are_kept_apart(self):
+        rec = self.fs.record(REC["hello"])
+        si, fn = build.SI_TIMES, build.FN_TIMES
+        self.assertEqual(rec.si["created"], build.iso(si["created"]))
+        self.assertEqual(rec.si["modified"], build.iso(si["modified"]))
+        self.assertEqual(rec.si["mft_modified"], build.iso(si["mft_modified"]))
+        self.assertEqual(rec.si["accessed"], build.iso(si["accessed"]))
+        name = rec.names[0]
+        self.assertEqual(name["fn_created"], build.iso(fn["created"]))
+        self.assertEqual(name["fn_modified"], build.iso(fn["modified"]))
+        self.assertEqual(name["fn_mft_modified"],
+                         build.iso(fn["mft_modified"]))
+        self.assertEqual(name["fn_accessed"], build.iso(fn["accessed"]))
+        node = self.root["hello.txt"]
+        self.assertEqual(node["created"], build.iso(si["created"]))
+        self.assertEqual(node["fn_created"], build.iso(fn["created"]))
+        self.assertEqual(node["fn_modified"], build.iso(fn["modified"]))
+
+    def test_win32_name_preferred_over_dos_name(self):
+        e = self.root["Long filename document.txt"]
+        names = self.fs.stat(e)["names"]
+        self.assertEqual({n["name"]: n["namespace"] for n in names},
+                         {"Long filename document.txt": 1, "LONGFI~1.TXT": 2})
+        self.assertNotIn("LONGFI~1.TXT", self.root)
+
+    def test_deleted_record(self):
+        e = self.root["deleted.txt"]
+        self.assertTrue(e["deleted"])
+        self.assertFalse(self.fs.record(REC["deleted"]).in_use)
+        self.assertEqual(self.fs.read_file(e), build.DELETED_TEXT)
+        self.assertIn("recovery", self.fs.stat(e))
+        live = {s for s, _ in self.fs.allocated_extents()}
+        self.assertIn(40 * C, live)
+
+    # -- $DATA --------------------------------------------------------------
+
+    def test_resident_data(self):
+        e = self.root["hello.txt"]
+        self.assertTrue(e["resident"])
+        self.assertEqual(e["size"], len(build.HELLO_TEXT))
+        self.assertEqual(self.fs.read_file(e), build.HELLO_TEXT)
+        self.assertEqual(self.fs.read_range(e, 7, 4), b"NTFS")
+        data = [a for a in self.fs.stat(e)["attributes"]
+                if a["type"] == "$DATA"]
+        self.assertTrue(data[0]["resident"])
+        self.assertNotIn("slack", self.fs.stat(e))
+
+    def test_non_resident_data_runs_and_slack(self):
+        e = self.root["big.bin"]
+        self.assertIsNone(e["resident"])
+        want = build.big_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_range(e, 2000, 100), want[2000:2100])
+        self.assertEqual(self.fs.read_file(e, max_bytes=10), want[:10])
+        info = self.fs.stat(e)
+        self.assertEqual(
+            [(r["offset"], r["length"], r["used"]) for r in info["runs"]],
+            [(40 * C, 2 * C, 2 * C), (60 * C, C, build.BIG_SIZE - 2 * C)])
+        self.assertEqual(info["slack"], {"offset": 60 * C + C - 300,
+                                         "length": 300})
+        self.assertEqual(self.fs.source.read_at(60 * C + C - 300, 300),
+                         build.fill(300, build.SLACK_MARK))
+
+    def test_sparse_runs_read_as_zeros(self):
+        e = self.root["sparse.bin"]
+        want = build.sparse_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_range(e, 1000, 2200),
+                         want[1000:3200])
+        runs = self.fs.stat(e)["runs"]
+        self.assertEqual([r["sparse"] for r in runs], [False, True, False])
+
+    def test_decode_runlist_vector(self):
+        # (40 x2) (+20 -> 60 x1) (sparse x3) (-50 -> 10 x1)
+        raw = b"\x11\x02\x28\x11\x01\x14\x01\x03\x11\x01\xCE\x00"
+        self.assertEqual(ntfs.decode_runlist(raw),
+                         [(40, 2), (60, 1), (None, 3), (10, 1)])
+        # The builder encodes the same list to the same bytes.
+        self.assertEqual(build.encode_runs(
+            [(40, 2), (60, 1), (None, 3), (10, 1)]), raw)
+
+    def test_decode_runlist_stops_at_impossible_runs(self):
+        findings = []
+        runs = ntfs.decode_runlist(b"\x11\x02\x05\x11\x40\x01\x00", 20,
+                                   findings)
+        self.assertEqual(runs, [(5, 2)])
+        self.assertEqual(findings, [ntfs.RUN_TOO_LONG])
+        findings = []
+        self.assertEqual(ntfs.decode_runlist(b"\x11\x01\xF0\x00", 20,
+                                             findings), [])
+        self.assertEqual(findings, [ntfs.RUN_OUT_OF_VOLUME])
+        self.assertEqual(ntfs.decode_runlist(b"\x44\x01"), [])
+
+    # -- alternate data streams ---------------------------------------------
+
+    def test_alternate_data_streams(self):
+        e = self.root["ads.txt"]
+        self.assertEqual(e["size"], len(build.ADS_MAIN))
+        self.assertEqual(e["streams"], [
+            {"name": "Zone.Identifier", "size": len(build.ZONE_ID)},
+            {"name": "secret", "size": build.SECRET_SIZE}])
+        self.assertEqual(self.fs.read_file(e), build.ADS_MAIN)
+        self.assertEqual(self.fs.read_file(e, stream="Zone.Identifier"),
+                         build.ZONE_ID)
+        self.assertEqual(self.fs.read_file(e, stream="secret"),
+                         build.secret_content())
+        self.assertEqual(self.fs.read_range(e, 10, 5, stream="secret"),
+                         build.secret_content()[10:15])
+        streams = {s["name"]: s for s in self.fs.streams(e)}
+        self.assertTrue(streams[""]["default"])
+        self.assertTrue(streams["Zone.Identifier"]["resident"])
+        self.assertFalse(streams["secret"]["resident"])
+        info = self.fs.stat(e, "secret")
+        self.assertEqual(info["runs"][0]["offset"], build.SECRET_LCN * C)
+        self.assertEqual(info["slack"]["length"], C - build.SECRET_SIZE)
+
+    def test_missing_stream(self):
+        e = self.root["ads.txt"]
+        with self.assertRaises(NoSuchStream) as ctx:
+            self.fs.read_file(e, stream="nope")
+        self.assertEqual(ctx.exception.available,
+                         ["Zone.Identifier", "secret"])
+        self.assertTrue(self.fs.stat(e, "nope")["stream_missing"])
+
+    # -- compression --------------------------------------------------------
+
+    def test_lznt1_compressed_attribute(self):
+        e = self.root["compressed.txt"]
+        self.assertEqual(self.fs.read_file(e), build.COMPRESSED_TEXT)
+        self.assertEqual(self.fs.read_range(e, 600, 30),
+                         build.COMPRESSED_TEXT[600:630])
+        info = self.fs.stat(e)
+        self.assertTrue(info["runs_compressed"])
+        self.assertEqual(self.fs.findings, [])
+
+    # -- known engine bugs --------------------------------------------------
+
+    # Bug: ntfs.py record() caches the parsed record before checking
+    # rec.valid (lines 428-430) and returns the cache hit unchecked (418), so
+    # an unformatted record is None the first time and an invalid MftRecord
+    # (no .sequence; stat() then raises AttributeError) every time after.
+    @unittest.expectedFailure
+    def test_invalid_record_stays_invalid_on_second_lookup(self):
+        fs = ntfs.NtfsFS(BytesImage(self.volume))
+        self.assertIsNone(fs.record(30))
+        self.assertIsNone(fs.record(30))
+
+
+class Lznt1(unittest.TestCase):
+
+    def test_back_reference(self):
+        self.assertEqual(lznt1.decompress(b"\x05\xb0\x08abc\x06\x20"),
+                         b"abcabcabcabc")
+
+    def test_displacement_width_grows_with_position(self):
+        # 17 literals, then token 0x8007 at position 17: 5 displacement bits
+        # and 11 length bits -> offset 17, length 10. A decoder still on the
+        # 4/12 split would read offset 9 instead.
+        body = (b"\x00ABCDEFGH" + b"\x00IJKLMNOP" + b"\x02Q"
+                + struct.pack("<H", 0x8007))
+        chunk = struct.pack("<H", 0xB000 | (len(body) - 1)) + body
+        self.assertEqual(lznt1.decompress(chunk),
+                         b"ABCDEFGHIJKLMNOPQ" + b"ABCDEFGHIJ")
+
+    def test_uncompressed_chunk_and_padding(self):
+        self.assertEqual(lznt1.decompress(b"\x04\x30hello"), b"hello")
+        self.assertEqual(lznt1.decompress(b"\x04\x30hello", 8),
+                         b"hello\x00\x00\x00")
+        self.assertEqual(lznt1.decompress(b"\x00\x00trailing"), b"")
+
+    def test_malformed_input_does_not_raise(self):
+        good = b"\x05\xb0\x08abc\x06\x20"
+        for cut in range(len(good)):
+            self.assertIsInstance(lznt1.decompress(good[:cut]), bytes)
+        # Back-reference before the start of output.
+        self.assertEqual(lznt1.decompress(b"\x02\xb0\x01\x05\x00"), b"")
+        rng = random.Random(3)
+        for _ in range(200):
+            junk = bytes(rng.getrandbits(8) for _ in range(64))
+            self.assertIsInstance(lznt1.decompress(junk, 4096), bytes)
+
+
+class NtfsRobustness(unittest.TestCase):
+    """Nothing here lists a damaged volume: listdir walks every record the
+    MFT claims, and see test_record_count_bounded_by_volume for why that can
+    be millions on a damaged one."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.good = build.build_ntfs()
+
+    def open_bytes(self, data):
+        return ntfs.open_fs(OffsetReader(BytesImage(data), 0, len(data)))
+
+    def test_unpartitioned_probe(self):
+        img = BytesImage(self.good)
+        self.assertEqual(volume.identify_fs(img, 0), "NTFS")
+        part = volume.scan(img)["partitions"][0]
+        self.assertEqual(part["detected"], "NTFS")
+        self.assertEqual(part["label"], build.VOLUME_LABEL)
+
+    def test_random_garbage_is_not_a_filesystem(self):
+        rng = random.Random(11)
+        junk = bytes(rng.getrandbits(8) for _ in range(16384))
+        with self.assertRaises(ValueError):
+            self.open_bytes(junk)
+        with self.assertRaises(ValueError):
+            ntfs.NtfsFS(BytesImage(junk))
+
+    def test_truncated_volume(self):
+        files = ImageFiles()
+        self.addCleanup(files.close)
+        image = files.open(self.good[:8192])
+        fs = ntfs.open_fs(OffsetReader(image, 0, image.size))
+        self.assertIsNone(fs.record(REC["hello"]))
+        self.assertIsInstance(fs.info(), dict)
+
+    def test_mutated_boot_sector(self):
+        for at in range(11, 80):
+            for value in (0x00, 0x80, 0xFF):
+                data = bytearray(self.good)
+                data[at] = value
+                with self.subTest(offset=at, value=value):
+                    try:
+                        fs = self.open_bytes(data)
+                    except ValueError:
+                        continue
+                    rec = fs.record(REC["hello"])
+                    if rec is not None:
+                        self.assertIsInstance(rec.names, list)
+
+    def record_offset(self, n):
+        return build.MFT_LCN * C + n * build.RECORD
+
+    def test_zero_attribute_length(self):
+        data = bytearray(self.good)
+        at = self.record_offset(REC["hello"]) + 56 + 4       # first attr
+        struct.pack_into("<I", data, at, 0)
+        fs = ntfs.NtfsFS(BytesImage(data))
+        rec = fs.record(REC["hello"])
+        self.assertTrue(rec.valid)
+        self.assertEqual(rec.attrs, [])
+        self.assertEqual(fs.read_file({"mft": REC["hello"]}), b"")
+
+    def test_run_longer_than_volume(self):
+        data = bytearray(self.good)
+        base = self.record_offset(REC["big"])
+        at = self.good.index(b"\x11\x02\x28", base, base + build.RECORD)
+        data[at + 1] = 0xF0                           # 240 clusters > 127
+        fs = ntfs.NtfsFS(BytesImage(data))
+        self.assertEqual(fs.read_file({"mft": REC["big"]}), b"")
+        self.assertIn(ntfs.RUN_TOO_LONG, fs.findings)
+
+    def test_random_record_damage(self):
+        base = self.record_offset(REC["big"])
+        rng = random.Random(8)
+        for trial in range(60):
+            data = bytearray(self.good)
+            for _ in range(8):
+                data[base + rng.randrange(0, 510)] = rng.getrandbits(8)
+            with self.subTest(trial=trial):
+                fs = ntfs.NtfsFS(BytesImage(data))
+                rec = fs.record(REC["big"])
+                if rec is None:
+                    continue
+                for a in rec.data_attrs():
+                    fs.read_attr(a, max_bytes=1 << 16)
+                fs.stat({"mft": REC["big"]})
+
+    # Bug: when record 0's $DATA cannot be read, ntfs.py line 401 assumes an
+    # MFT of 1 << 20 clusters, not bounded by cluster_count. A 4 KB image
+    # with 4 KB clusters then claims 4,194,304 records, and build_tree()
+    # (every listdir) reads them all: ~1.8 s here, and it scales with
+    # cluster size — minutes for 64 KB clusters.
+    @unittest.expectedFailure
+    def test_record_count_bounded_by_volume(self):
+        data = bytearray(self.good[:4096])
+        data[13] = 8                                  # 4096-byte clusters
+        fs = ntfs.NtfsFS(BytesImage(data))
+        most = fs.cluster_count * fs.cluster_size // fs.record_size
+        self.assertLessEqual(fs.record_count, most)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_gate.py b/tests/test_gate.py
new file mode 100644
index 0000000..5aa629d
--- /dev/null
+++ b/tests/test_gate.py
@@ -0,0 +1,314 @@
+"""Unit tests for the HTTP request gate (engine.server): host_allowed,
+origin_allowed, and the Handler._gate method that combines them with the
+Sec-Fetch-Site check.
+
+These lock in the anti-DNS-rebinding / anti-CSRF behaviour of the local
+HTTP interface: a browser page on another origin must not be able to
+drive the API just because it can reach 127.0.0.1.
+"""
+
+import os
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from engine import server                                         # noqa: E402
+
+
+class _Headers(dict):
+    """Minimal stand-in for http.client.HTTPMessage: case-sensitive here
+    (tests pass canonical casing) but exposes the .get() the gate uses."""
+
+    def get(self, key, default=None):
+        return dict.get(self, key, default)
+
+
+class _FakeHandler:
+    """Just enough of Handler for _gate(): headers + a _send() that
+    records what was sent instead of writing to a socket."""
+
+    def __init__(self, headers):
+        self.headers = _Headers(headers)
+        self.sent = None
+
+    def _send(self, code, body, ctype="application/json"):
+        self.sent = (code, body)
+
+
+class _BoundStateMixin(unittest.TestCase):
+    """Saves/restores the module-level _BOUND dict so tests can point the
+    gate at whatever bind address they're exercising without leaking
+    state into other tests."""
+
+    def setUp(self):
+        self._saved_bound = dict(server._BOUND)
+        self.addCleanup(lambda: server._BOUND.update(self._saved_bound))
+
+
+class HostAllowedLoopbackBind(_BoundStateMixin):
+    """Bound to 127.0.0.1 (the default): only loopback names/addresses,
+    on the bound port, get through."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_matching_ip_and_port_allowed(self):
+        self.assertTrue(server.host_allowed("127.0.0.1:8722"))
+
+    def test_localhost_name_and_port_allowed(self):
+        self.assertTrue(server.host_allowed("localhost:8722"))
+
+    def test_wrong_port_rejected(self):
+        self.assertFalse(server.host_allowed("127.0.0.1:9999"))
+        self.assertFalse(server.host_allowed("localhost:9999"))
+
+    def test_missing_host_rejected(self):
+        self.assertFalse(server.host_allowed(""))
+        self.assertFalse(server.host_allowed(None))
+
+    def test_rebinding_hostname_rejected(self):
+        # The classic DNS-rebinding case: attacker.example resolves to
+        # 127.0.0.1 at request time, but the Host header still names the
+        # attacker's hostname, not localhost/127.0.0.1.
+        self.assertFalse(server.host_allowed("evil.com:8722"))
+        self.assertFalse(server.host_allowed("attacker.example:8722"))
+
+    def test_host_without_a_port_matches_on_name_alone(self):
+        # _split_host treats a missing port as "don't care" rather than
+        # "must equal the bound port" -- a bare "Host: localhost" (no
+        # ":8722") is accepted purely because the name is a loopback
+        # name. Documented here so a future change to this is deliberate.
+        self.assertTrue(server.host_allowed("localhost"))
+        self.assertTrue(server.host_allowed("127.0.0.1"))
+        self.assertFalse(server.host_allowed("evil.com"))
+
+    def test_ipv6_loopback_literal_allowed(self):
+        self.assertTrue(server.host_allowed("[::1]:8722"))
+
+    def test_case_insensitive(self):
+        self.assertTrue(server.host_allowed("LOCALHOST:8722"))
+
+
+class HostAllowedWildcardBind(_BoundStateMixin):
+    """Bound to 0.0.0.0 / :: (listening on every interface): loopback
+    names and any syntactic IP literal are accepted, but not arbitrary
+    hostnames -- the server can't tell in advance which of its own
+    interface addresses a legitimate client will use."""
+
+    def test_ipv4_wildcard_allows_loopback_and_ip_literals(self):
+        server.set_bound_address("0.0.0.0", 8722)
+        self.assertTrue(server.host_allowed("127.0.0.1:8722"))
+        self.assertTrue(server.host_allowed("localhost:8722"))
+        self.assertTrue(server.host_allowed("10.0.0.5:8722"))
+        self.assertTrue(server.host_allowed("[::1]:8722"))
+        self.assertTrue(server.host_allowed("[2001:db8::1]:8722"))
+
+    def test_ipv4_wildcard_rejects_hostnames(self):
+        server.set_bound_address("0.0.0.0", 8722)
+        self.assertFalse(server.host_allowed("attacker.example:8722"))
+        self.assertFalse(server.host_allowed("router.lan:8722"))
+
+    def test_ipv6_wildcard_behaves_the_same(self):
+        server.set_bound_address("::", 8722)
+        self.assertTrue(server.host_allowed("127.0.0.1:8722"))
+        self.assertTrue(server.host_allowed("[::1]:8722"))
+        self.assertFalse(server.host_allowed("attacker.example:8722"))
+
+    def test_wildcard_still_enforces_port(self):
+        server.set_bound_address("0.0.0.0", 8722)
+        self.assertFalse(server.host_allowed("127.0.0.1:9999"))
+
+
+class HostAllowedSpecificLanBind(_BoundStateMixin):
+    """Bound to one specific LAN address: only that host (any port
+    variant of it) is allowed -- notably, loopback stops working."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("192.168.1.50", 8722)
+
+    def test_bound_address_allowed(self):
+        self.assertTrue(server.host_allowed("192.168.1.50:8722"))
+
+    def test_loopback_rejected_when_bound_elsewhere(self):
+        self.assertFalse(server.host_allowed("127.0.0.1:8722"))
+        self.assertFalse(server.host_allowed("localhost:8722"))
+
+    def test_other_ip_rejected(self):
+        self.assertFalse(server.host_allowed("192.168.1.51:8722"))
+        self.assertFalse(server.host_allowed("10.0.0.5:8722"))
+
+    def test_wrong_port_rejected(self):
+        self.assertFalse(server.host_allowed("192.168.1.50:9999"))
+
+
+class OriginAllowed(_BoundStateMixin):
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_no_origin_header_allowed(self):
+        # Not every legitimate request carries Origin (plain navigations,
+        # same-origin requests in older browsers, non-browser tooling).
+        self.assertTrue(server.origin_allowed("", "127.0.0.1:8722"))
+        self.assertTrue(server.origin_allowed(None, "127.0.0.1:8722"))
+
+    def test_null_origin_rejected(self):
+        # Sandboxed iframes / some redirects send the literal string
+        # "null" as Origin.
+        self.assertFalse(server.origin_allowed("null", "127.0.0.1:8722"))
+
+    def test_file_scheme_rejected(self):
+        self.assertFalse(server.origin_allowed("file://", "127.0.0.1:8722"))
+
+    def test_extension_scheme_rejected(self):
+        self.assertFalse(server.origin_allowed(
+            "chrome-extension://abcdefghijklmnop", "127.0.0.1:8722"))
+
+    def test_matching_origin_allowed(self):
+        self.assertTrue(server.origin_allowed(
+            "http://127.0.0.1:8722", "127.0.0.1:8722"))
+
+    def test_matching_origin_by_name_allowed(self):
+        self.assertTrue(server.origin_allowed(
+            "http://localhost:8722", "localhost:8722"))
+
+    def test_cross_site_origin_rejected(self):
+        self.assertFalse(server.origin_allowed(
+            "http://evil.com:8722", "127.0.0.1:8722"))
+
+    def test_origin_host_mismatch_against_host_header_rejected(self):
+        # Origin says localhost but the request claims to be addressed
+        # to 127.0.0.1 -- inconsistent, refuse it.
+        self.assertFalse(server.origin_allowed(
+            "http://localhost:8722", "127.0.0.1:8722"))
+
+    def test_wrong_port_in_origin_rejected(self):
+        self.assertFalse(server.origin_allowed(
+            "http://127.0.0.1:9999", "127.0.0.1:8722"))
+
+    def test_https_scheme_also_accepted(self):
+        self.assertTrue(server.origin_allowed(
+            "https://127.0.0.1:8722", "127.0.0.1:8722"))
+
+    def test_garbage_origin_rejected(self):
+        self.assertFalse(server.origin_allowed("not-a-url", "127.0.0.1:8722"))
+
+
+class GateHostCheck(_BoundStateMixin):
+    """Handler._gate(): the Host header gate, checked first (421)."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_bad_host_returns_421(self):
+        fh = _FakeHandler({"Host": "evil.com:8722"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 421)
+
+    def test_missing_host_returns_421(self):
+        fh = _FakeHandler({})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 421)
+
+    def test_good_host_no_other_headers_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722"})
+        self.assertTrue(server.Handler._gate(fh))
+        self.assertIsNone(fh.sent)
+
+
+class GateSecFetchSiteCheck(_BoundStateMixin):
+    """Handler._gate(): Sec-Fetch-Site is checked before Origin, and a
+    cross-site value is refused outright regardless of Origin."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_cross_site_rejected_with_403(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "cross-site"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+    def test_cross_site_rejected_even_with_matching_origin(self):
+        # Belt and braces: even if Origin somehow matched, a browser
+        # that says cross-site is telling the truth about the request's
+        # provenance and must not be second-guessed.
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "cross-site",
+                           "Origin": "http://127.0.0.1:8722"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+    def test_same_origin_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "same-origin"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_same_site_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "same-site"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_none_value_allowed(self):
+        # "none" means the browser itself typed the URL / used a
+        # bookmark -- not driven by another page.
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "none"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_absent_header_falls_through_to_origin_check(self):
+        # Older browsers and non-browser clients don't send
+        # Sec-Fetch-Site at all; the gate must not require it.
+        fh = _FakeHandler({"Host": "127.0.0.1:8722"})
+        self.assertTrue(server.Handler._gate(fh))
+
+
+class GateOriginCheck(_BoundStateMixin):
+    """Handler._gate(): Origin is checked last, after Host and
+    Sec-Fetch-Site both pass."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_cross_origin_rejected_with_403(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Origin": "http://evil.com:8722"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+    def test_matching_origin_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Origin": "http://127.0.0.1:8722"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_null_origin_rejected(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722", "Origin": "null"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+
+class HostAllowedLooseIpLiteralCheck(_BoundStateMixin):
+    """_is_ip_literal() is a syntactic check only (used to decide whether
+    a Host string "looks like" an address rather than a hostname when
+    bound to a wildcard address); it does not validate octet ranges. Not
+    exploitable on its own -- a Host header still has to reach the
+    process over a socket bound to that literal interface, or be one of
+    the fixed loopback names -- but locked in here so a tightening or
+    loosening of the check is a deliberate change, not a surprise."""
+
+    def test_out_of_range_octets_still_treated_as_ip_shaped(self):
+        self.assertTrue(server._is_ip_literal("999.999.999.999"))
+
+    def test_real_hostname_not_ip_shaped(self):
+        self.assertFalse(server._is_ip_literal("attacker.example"))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_registry.py b/tests/test_registry.py
new file mode 100644
index 0000000..d865a44
--- /dev/null
+++ b/tests/test_registry.py
@@ -0,0 +1,369 @@
+"""Unit tests for the registry hive parser (engine.registry) and transaction
+log replay (engine.reglog), fed synthetic hives from imagebuild_registry."""
+
+import os
+import random
+import struct
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import imagebuild_registry as build                              # noqa: E402
+from engine import registry, reglog                              # noqa: E402
+
+
+class HiveFixture(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.data = build.build_hive()
+
+    def setUp(self):
+        self.hive = registry.open_hive(self.data, "SOFTWARE")
+        self.assertIsNotNone(self.hive)
+
+    def values(self, path="Software\\Strata"):
+        key = self.hive.open_path(path)
+        return {v["name"]: v for v in self.hive.values(key)}
+
+
+class BaseBlock(HiveFixture):
+    def test_info(self):
+        info = self.hive.info()
+        self.assertEqual(info["type"], "regf")
+        self.assertEqual(info["name"], "SOFTWARE")
+        self.assertEqual(info["embedded_name"], "\\??\\C:\\ROOT")
+        self.assertEqual(info["version"], "1.5")
+        self.assertEqual(info["sequence"], [1, 1])
+        self.assertFalse(info["dirty"])
+        self.assertEqual(info["modified"], "2022-06-18T04:26:40Z")
+        self.assertEqual(info["findings"], [])
+
+    def test_base_block_checksum(self):
+        stored = struct.unpack_from("<I", self.data, 508)[0]
+        self.assertEqual(reglog.base_checksum(self.data[:4096]), stored)
+
+    def test_base_block_checksum_edge_values(self):
+        self.assertEqual(reglog.base_checksum(bytes(512)), 1)
+        blk = bytearray(512)
+        struct.pack_into("<I", blk, 0, 0xFFFFFFFF)
+        self.assertEqual(reglog.base_checksum(bytes(blk)), 0xFFFFFFFE)
+
+    def test_dirty_hive_is_flagged(self):
+        h = registry.open_hive(build.build_hive(seq1=3, seq2=2))
+        self.assertTrue(h.dirty)
+        self.assertTrue(h.findings)
+
+    def test_classify_well_known(self):
+        self.assertEqual(
+            registry.classify("C:/Windows/System32/config/SOFTWARE")["label"],
+            "SOFTWARE")
+        self.assertIsNone(registry.classify("notes.txt"))
+
+
+class Keys(HiveFixture):
+    def test_root(self):
+        root = self.hive.root()
+        self.assertEqual(root["name"], "ROOT")
+        self.assertTrue(root["root"])
+        self.assertEqual(root["modified"], "2022-06-18T04:26:40Z")
+
+    def test_lh_subkey_list(self):
+        names = [k["name"] for k in self.hive.subkeys(self.hive.root())]
+        self.assertEqual(names, ["Software", "System", u"\u00dcn\u00efcode"])
+
+    def test_lf_subkey_list(self):
+        sw = self.hive.open_path("Software")
+        self.assertEqual([k["name"] for k in self.hive.subkeys(sw)],
+                         ["Strata"])
+
+    def test_ri_list_of_li_and_lf(self):
+        sysk = self.hive.open_path("\\System")
+        self.assertEqual([k["name"] for k in self.hive.subkeys(sysk)],
+                         ["Alpha", "Beta"])
+
+    def test_open_path_variants(self):
+        self.assertEqual(self.hive.open_path("software/STRATA")["name"],
+                         "Strata")
+        self.assertEqual(self.hive.open_path("\\")["name"], "ROOT")
+        self.assertIsNone(self.hive.open_path("Software\\Missing"))
+
+    def test_parent_pointer(self):
+        sw = self.hive.open_path("Software")
+        self.assertEqual(self.hive.open_path("Software\\Strata")["parent"],
+                         sw["offset"])
+
+
+class Values(HiveFixture):
+    def test_value_names(self):
+        self.assertEqual(sorted(self.values()),
+                         sorted(["(Default)", "Name", "Count", "Blob", "Tiny",
+                                 "Paths", "Big"]))
+
+    def test_reg_sz(self):
+        v = self.values()["Name"]
+        self.assertEqual(v["type"], "REG_SZ")
+        self.assertEqual(v["value"], "Strata")
+        self.assertFalse(v["resident"])
+        self.assertEqual(self.values()["(Default)"]["value"], "default value")
+
+    def test_reg_dword_resident(self):
+        v = self.values()["Count"]
+        self.assertEqual(v["type"], "REG_DWORD")
+        self.assertEqual(v["value"], 42)
+        self.assertTrue(v["resident"])
+        self.assertIsNone(v["data_offset"])
+
+    def test_reg_binary(self):
+        v = self.values()["Blob"]
+        self.assertEqual(v["type"], "REG_BINARY")
+        self.assertEqual(v["size"], 16)
+        self.assertEqual(self.hive.value_bytes(v["offset"]), bytes(range(16)))
+        self.assertEqual(v["value"].split()[:3], ["00", "01", "02"])
+
+    def test_resident_binary_shorter_than_four_bytes(self):
+        v = self.values()["Tiny"]
+        self.assertTrue(v["resident"])
+        self.assertEqual(self.hive.value_bytes(v["offset"]), b"\x01\x02\x03")
+
+    def test_reg_multi_sz(self):
+        v = self.values()["Paths"]
+        self.assertEqual(v["type"], "REG_MULTI_SZ")
+        self.assertEqual(v["value"], ["C:\\a", "D:\\b"])
+
+    def test_big_data(self):
+        v = self.values()["Big"]
+        self.assertEqual(v["size"], len(build.BIG_BLOB))
+        self.assertTrue(v["truncated"])
+        self.assertIsNone(v["value"])
+        self.assertEqual(self.hive.value_bytes(v["offset"]), build.BIG_BLOB)
+
+    def test_decode_other_types(self):
+        self.assertEqual(registry.Hive.decode(5, b"\x00\x00\x01\x00"), 256)
+        self.assertEqual(registry.Hive.decode(11, struct.pack("<Q", 2 ** 40)),
+                         2 ** 40)
+        self.assertEqual(registry.Hive.decode(2, "%x%\x00".encode("utf-16-le")),
+                         "%x%")
+
+
+class DeletedCells(HiveFixture):
+    def test_carve_recovers_deleted_key_and_value(self):
+        got = self.hive.carve_deleted()
+        self.assertEqual([k["name"] for k in got["keys"]], ["Removed"])
+        self.assertTrue(got["keys"][0]["deleted"])
+        self.assertEqual(got["keys"][0]["parent"],
+                         self.hive.open_path("Software")["offset"])
+        self.assertEqual([(v["name"], v["value"]) for v in got["values"]],
+                         [("OldValue", "gone")])
+        self.assertTrue(got["values"][0]["deleted"])
+
+    def test_deleted_records_not_in_live_tree(self):
+        self.assertIsNone(self.hive.open_path("Software\\Removed"))
+
+
+class Marvin32(unittest.TestCase):
+    # Vectors from the .NET runtime's Marvin tests, seed 0x004FB61A001BDBCC.
+    SEED = 0x004FB61A001BDBCC
+    VECTORS = [
+        (b"\xaf", 0x48E73FC77D75DDC1),
+        (b"\xe7\x0f", 0xB5F6E1FC485DBFF8),
+        (b"\x37\xf4\x95", 0xF0B07C789B8CF7E8),
+        (b"\x15\x3f\xb7\x98\x26", 0xE6C08C6DA2AFA997),
+        (b"\x09\x32\xe6\x24\x6c\x47", 0x6F04BF1A5EA24060),
+        (b"\xab\x42\x7e\xa8\xd1\x0f\xc7", 0xE11847E4F0678C41),
+    ]
+
+    def test_known_vectors(self):
+        for data, want in self.VECTORS:
+            self.assertEqual(reglog.marvin32(data, self.SEED), want, data)
+
+    def test_builder_agrees_with_engine(self):
+        blob = bytes(range(256)) * 3
+        for n in (0, 1, 2, 3, 4, 511, 512):
+            self.assertEqual(build.marvin32(blob[:n]), reglog.marvin32(blob[:n]))
+
+
+class TransactionLog(unittest.TestCase):
+    def setUp(self):
+        self.stale, self.log, self.fresh_bins = build.build_dirty_pair()
+
+    def test_parse_log(self):
+        got = reglog.parse_log(self.log)
+        self.assertEqual(got["findings"], [])
+        self.assertEqual(got["base_sequence"], 10)
+        self.assertEqual(len(got["entries"]), 1)
+        entry = got["entries"][0]
+        self.assertEqual(entry["sequence"], 10)
+        self.assertEqual(entry["hbins_size"], len(self.fresh_bins))
+        self.assertEqual(entry["pages"][0][:2], (0, len(self.fresh_bins)))
+
+    def test_hive_sequences(self):
+        self.assertEqual(reglog.hive_sequences(self.stale),
+                         (11, 10, len(self.fresh_bins)))
+        self.assertIsNone(reglog.hive_sequences(b"regf"))
+
+    def test_replay_applies_log(self):
+        before = registry.open_hive(self.stale)
+        self.assertEqual(
+            {v["name"]: v["value"] for v in
+             before.values(before.open_path("Software\\Strata"))}["Name"],
+            "Strata")
+        new, report = reglog.recover(self.stale, [self.log])
+        self.assertTrue(report["dirty"])
+        self.assertTrue(report["recovered"])
+        self.assertEqual(report["applied"], [10])
+        self.assertEqual(report["pages_written"], 1)
+        self.assertEqual(report["bytes_written"], len(self.fresh_bins))
+        self.assertIn("Recovered", reglog.summarise(report))
+
+        self.assertEqual(new[4096:], self.fresh_bins)
+        self.assertEqual(struct.unpack_from("<II", new, 4), (10, 10))
+        self.assertEqual(struct.unpack_from("<I", new, 508)[0],
+                         reglog.base_checksum(new[:508]))
+        after = registry.open_hive(new)
+        self.assertFalse(after.dirty)
+        self.assertEqual(
+            {v["name"]: v["value"] for v in
+             after.values(after.open_path("Software\\Strata"))}["Name"],
+            "Replay")
+
+    def test_clean_hive_needs_no_replay(self):
+        new, report = reglog.recover(build.build_hive(), [self.log])
+        self.assertIsNone(new)
+        self.assertFalse(report["dirty"])
+        self.assertEqual(reglog.summarise(report),
+                         "Cleanly unmounted; no replay needed.")
+
+    def test_dirty_without_logs(self):
+        new, report = reglog.recover(self.stale, [])
+        self.assertIsNone(new)
+        self.assertFalse(report["recovered"])
+        self.assertTrue(report["findings"])
+        self.assertIn("not recoverable", reglog.summarise(report))
+
+    def test_corrupt_entry_data_is_refused(self):
+        bad = bytearray(self.log)
+        bad[512 + 40 + 8 + 100] ^= 0xFF
+        new, report = reglog.recover(self.stale, [bytes(bad)])
+        self.assertIsNone(new)
+        self.assertTrue(any("data hash" in f for f in report["findings"]))
+
+    def test_corrupt_entry_header_is_refused(self):
+        bad = bytearray(self.log)
+        bad[512 + 8] ^= 0x01                       # flags field
+        got = reglog.parse_log(bytes(bad))
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(any("header hash" in f for f in got["findings"]))
+
+    def test_sequence_gap_is_not_replayed(self):
+        entry = build.log_entry(12, len(self.fresh_bins),
+                                [(0, self.fresh_bins)])
+        new, report = reglog.recover(self.stale, [build.build_log([entry])])
+        self.assertIsNone(new)
+        self.assertEqual(report["log_sequences"], [12])
+        self.assertTrue(any("overwritten" in f for f in report["findings"]))
+
+    def test_entries_beyond_gap_are_reported(self):
+        e10 = build.log_entry(10, len(self.fresh_bins), [(0, self.fresh_bins)])
+        e12 = build.log_entry(12, len(self.fresh_bins), [(0, self.fresh_bins)])
+        new, report = reglog.recover(self.stale, [build.build_log([e10, e12])])
+        self.assertIsNotNone(new)
+        self.assertEqual(report["applied"], [10])
+        self.assertTrue(any("gap" in f for f in report["findings"]))
+
+    def test_implausible_entry_size(self):
+        bad = bytearray(self.log)
+        struct.pack_into("<I", bad, 516, 1000)
+        got = reglog.parse_log(bytes(bad))
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(any("implausible" in f for f in got["findings"]))
+
+    def test_truncated_log(self):
+        got = reglog.parse_log(self.log[:100])
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(got["findings"])
+        got = reglog.parse_log(self.log[:5000])
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(got["findings"])
+
+    def test_not_a_hive(self):
+        new, report = reglog.recover(b"garbage" * 1000, [self.log])
+        self.assertIsNone(new)
+        self.assertTrue(report["findings"])
+
+
+class Robustness(unittest.TestCase):
+    def test_garbage_is_not_a_hive(self):
+        for data in (b"", b"garbage", bytes(8192), b"hbin" * 2048):
+            self.assertIsNone(registry.open_hive(data))
+
+    # Engine bug: engine/registry.py:47-54 unpacks base-block fields without
+    # a length check, so a "regf" file shorter than 48 bytes raises struct.error.
+    @unittest.expectedFailure
+    def test_truncated_base_block(self):
+        for n in (4, 20, 40):
+            try:
+                h = registry.open_hive(build.build_hive()[:n])
+            except struct.error as exc:
+                self.fail("open_hive raised on %d bytes: %s" % (n, exc))
+            if h is not None:
+                self.assertIsNone(h.root())
+
+    def test_base_block_only(self):
+        h = registry.open_hive(build.build_hive()[:4096])
+        self.assertIsNone(h.root())
+        self.assertEqual(h.carve_deleted(), {"keys": [], "values": []})
+
+    TRUNCATIONS = (4096 + 32, 4096 + 702, 4096 + 5000, 28672 - 100)
+
+    def test_truncated_hive_bins_tree_walk(self):
+        data = build.build_hive()
+        for cut in self.TRUNCATIONS:
+            h = registry.open_hive(data[:cut])
+            root = h.root()
+            if root:
+                for k in h.subkeys(root):
+                    h.values(k)
+
+    # Engine bug: engine/registry.py:268-276 carve_deleted clamps a bin to
+    # 4096 bytes but not to the end of the data, so a hive cut short (e.g.
+    # read with the MAX_HIVE cap) raises struct.error reading a cell size.
+    @unittest.expectedFailure
+    def test_truncated_hive_bins_carve(self):
+        data = build.build_hive()
+        for cut in self.TRUNCATIONS:
+            try:
+                registry.open_hive(data[:cut]).carve_deleted()
+            except struct.error as exc:
+                self.fail("carve_deleted raised at cut %d: %s" % (cut, exc))
+
+    def test_self_referencing_ri_list_terminates(self):
+        data = bytearray(build.build_hive())
+        h = registry.open_hive(bytes(data))
+        sysk = h.open_path("System")
+        ri = 4096 + sysk["subkeys"]
+        struct.pack_into("<I", data, ri + 4 + 4, sysk["subkeys"])
+        h = registry.open_hive(bytes(data))
+        names = [k["name"] for k in h.subkeys(h.open_path("System"))]
+        self.assertEqual(names, ["Beta"])
+
+    def test_random_corruption_never_raises(self):
+        data = build.build_hive()
+        rnd = random.Random(20260916)
+        for _ in range(300):
+            m = bytearray(data)
+            for _ in range(rnd.randint(1, 16)):
+                m[rnd.randrange(4096, 4096 + 2048)] = rnd.randrange(256)
+            h = registry.open_hive(bytes(m))
+            stack, seen = [h.root()], 0
+            while stack and seen < 64:
+                k = stack.pop()
+                seen += 1
+                if k:
+                    h.values(k)
+                    stack.extend(h.subkeys(k))
+            h.carve_deleted()
+
+
+if __name__ == "__main__":
+    unittest.main()