From 0f24c9c643a91c9722500335b6cf8eb0f6fe1a67 Mon Sep 17 00:00:00 2001
From: deadp <deadp@users.noreply.github.com>
Date: Wed, 16 Sep 2026 20:41:31 +1200
Subject: [PATCH 1/7] Add unit tests for the HTTP request gate

Locks in the Host, Origin and Sec-Fetch-Site checks that keep other
origins and DNS-rebinding pages from driving the local interface.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 tests/test_gate.py | 314 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 314 insertions(+)
 create mode 100644 tests/test_gate.py

diff --git a/tests/test_gate.py b/tests/test_gate.py
new file mode 100644
index 0000000..5aa629d
--- /dev/null
+++ b/tests/test_gate.py
@@ -0,0 +1,314 @@
+"""Unit tests for the HTTP request gate (engine.server): host_allowed,
+origin_allowed, and the Handler._gate method that combines them with the
+Sec-Fetch-Site check.
+
+These lock in the anti-DNS-rebinding / anti-CSRF behaviour of the local
+HTTP interface: a browser page on another origin must not be able to
+drive the API just because it can reach 127.0.0.1.
+"""
+
+import os
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from engine import server                                         # noqa: E402
+
+
+class _Headers(dict):
+    """Minimal stand-in for http.client.HTTPMessage: case-sensitive here
+    (tests pass canonical casing) but exposes the .get() the gate uses."""
+
+    def get(self, key, default=None):
+        return dict.get(self, key, default)
+
+
+class _FakeHandler:
+    """Just enough of Handler for _gate(): headers + a _send() that
+    records what was sent instead of writing to a socket."""
+
+    def __init__(self, headers):
+        self.headers = _Headers(headers)
+        self.sent = None
+
+    def _send(self, code, body, ctype="application/json"):
+        self.sent = (code, body)
+
+
+class _BoundStateMixin(unittest.TestCase):
+    """Saves/restores the module-level _BOUND dict so tests can point the
+    gate at whatever bind address they're exercising without leaking
+    state into other tests."""
+
+    def setUp(self):
+        self._saved_bound = dict(server._BOUND)
+        self.addCleanup(lambda: server._BOUND.update(self._saved_bound))
+
+
+class HostAllowedLoopbackBind(_BoundStateMixin):
+    """Bound to 127.0.0.1 (the default): only loopback names/addresses,
+    on the bound port, get through."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_matching_ip_and_port_allowed(self):
+        self.assertTrue(server.host_allowed("127.0.0.1:8722"))
+
+    def test_localhost_name_and_port_allowed(self):
+        self.assertTrue(server.host_allowed("localhost:8722"))
+
+    def test_wrong_port_rejected(self):
+        self.assertFalse(server.host_allowed("127.0.0.1:9999"))
+        self.assertFalse(server.host_allowed("localhost:9999"))
+
+    def test_missing_host_rejected(self):
+        self.assertFalse(server.host_allowed(""))
+        self.assertFalse(server.host_allowed(None))
+
+    def test_rebinding_hostname_rejected(self):
+        # The classic DNS-rebinding case: attacker.example resolves to
+        # 127.0.0.1 at request time, but the Host header still names the
+        # attacker's hostname, not localhost/127.0.0.1.
+        self.assertFalse(server.host_allowed("evil.com:8722"))
+        self.assertFalse(server.host_allowed("attacker.example:8722"))
+
+    def test_host_without_a_port_matches_on_name_alone(self):
+        # _split_host treats a missing port as "don't care" rather than
+        # "must equal the bound port" -- a bare "Host: localhost" (no
+        # ":8722") is accepted purely because the name is a loopback
+        # name. Documented here so a future change to this is deliberate.
+        self.assertTrue(server.host_allowed("localhost"))
+        self.assertTrue(server.host_allowed("127.0.0.1"))
+        self.assertFalse(server.host_allowed("evil.com"))
+
+    def test_ipv6_loopback_literal_allowed(self):
+        self.assertTrue(server.host_allowed("[::1]:8722"))
+
+    def test_case_insensitive(self):
+        self.assertTrue(server.host_allowed("LOCALHOST:8722"))
+
+
+class HostAllowedWildcardBind(_BoundStateMixin):
+    """Bound to 0.0.0.0 / :: (listening on every interface): loopback
+    names and any syntactic IP literal are accepted, but not arbitrary
+    hostnames -- the server can't tell in advance which of its own
+    interface addresses a legitimate client will use."""
+
+    def test_ipv4_wildcard_allows_loopback_and_ip_literals(self):
+        server.set_bound_address("0.0.0.0", 8722)
+        self.assertTrue(server.host_allowed("127.0.0.1:8722"))
+        self.assertTrue(server.host_allowed("localhost:8722"))
+        self.assertTrue(server.host_allowed("10.0.0.5:8722"))
+        self.assertTrue(server.host_allowed("[::1]:8722"))
+        self.assertTrue(server.host_allowed("[2001:db8::1]:8722"))
+
+    def test_ipv4_wildcard_rejects_hostnames(self):
+        server.set_bound_address("0.0.0.0", 8722)
+        self.assertFalse(server.host_allowed("attacker.example:8722"))
+        self.assertFalse(server.host_allowed("router.lan:8722"))
+
+    def test_ipv6_wildcard_behaves_the_same(self):
+        server.set_bound_address("::", 8722)
+        self.assertTrue(server.host_allowed("127.0.0.1:8722"))
+        self.assertTrue(server.host_allowed("[::1]:8722"))
+        self.assertFalse(server.host_allowed("attacker.example:8722"))
+
+    def test_wildcard_still_enforces_port(self):
+        server.set_bound_address("0.0.0.0", 8722)
+        self.assertFalse(server.host_allowed("127.0.0.1:9999"))
+
+
+class HostAllowedSpecificLanBind(_BoundStateMixin):
+    """Bound to one specific LAN address: only that host (any port
+    variant of it) is allowed -- notably, loopback stops working."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("192.168.1.50", 8722)
+
+    def test_bound_address_allowed(self):
+        self.assertTrue(server.host_allowed("192.168.1.50:8722"))
+
+    def test_loopback_rejected_when_bound_elsewhere(self):
+        self.assertFalse(server.host_allowed("127.0.0.1:8722"))
+        self.assertFalse(server.host_allowed("localhost:8722"))
+
+    def test_other_ip_rejected(self):
+        self.assertFalse(server.host_allowed("192.168.1.51:8722"))
+        self.assertFalse(server.host_allowed("10.0.0.5:8722"))
+
+    def test_wrong_port_rejected(self):
+        self.assertFalse(server.host_allowed("192.168.1.50:9999"))
+
+
+class OriginAllowed(_BoundStateMixin):
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_no_origin_header_allowed(self):
+        # Not every legitimate request carries Origin (plain navigations,
+        # same-origin requests in older browsers, non-browser tooling).
+        self.assertTrue(server.origin_allowed("", "127.0.0.1:8722"))
+        self.assertTrue(server.origin_allowed(None, "127.0.0.1:8722"))
+
+    def test_null_origin_rejected(self):
+        # Sandboxed iframes / some redirects send the literal string
+        # "null" as Origin.
+        self.assertFalse(server.origin_allowed("null", "127.0.0.1:8722"))
+
+    def test_file_scheme_rejected(self):
+        self.assertFalse(server.origin_allowed("file://", "127.0.0.1:8722"))
+
+    def test_extension_scheme_rejected(self):
+        self.assertFalse(server.origin_allowed(
+            "chrome-extension://abcdefghijklmnop", "127.0.0.1:8722"))
+
+    def test_matching_origin_allowed(self):
+        self.assertTrue(server.origin_allowed(
+            "http://127.0.0.1:8722", "127.0.0.1:8722"))
+
+    def test_matching_origin_by_name_allowed(self):
+        self.assertTrue(server.origin_allowed(
+            "http://localhost:8722", "localhost:8722"))
+
+    def test_cross_site_origin_rejected(self):
+        self.assertFalse(server.origin_allowed(
+            "http://evil.com:8722", "127.0.0.1:8722"))
+
+    def test_origin_host_mismatch_against_host_header_rejected(self):
+        # Origin says localhost but the request claims to be addressed
+        # to 127.0.0.1 -- inconsistent, refuse it.
+        self.assertFalse(server.origin_allowed(
+            "http://localhost:8722", "127.0.0.1:8722"))
+
+    def test_wrong_port_in_origin_rejected(self):
+        self.assertFalse(server.origin_allowed(
+            "http://127.0.0.1:9999", "127.0.0.1:8722"))
+
+    def test_https_scheme_also_accepted(self):
+        self.assertTrue(server.origin_allowed(
+            "https://127.0.0.1:8722", "127.0.0.1:8722"))
+
+    def test_garbage_origin_rejected(self):
+        self.assertFalse(server.origin_allowed("not-a-url", "127.0.0.1:8722"))
+
+
+class GateHostCheck(_BoundStateMixin):
+    """Handler._gate(): the Host header gate, checked first (421)."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_bad_host_returns_421(self):
+        fh = _FakeHandler({"Host": "evil.com:8722"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 421)
+
+    def test_missing_host_returns_421(self):
+        fh = _FakeHandler({})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 421)
+
+    def test_good_host_no_other_headers_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722"})
+        self.assertTrue(server.Handler._gate(fh))
+        self.assertIsNone(fh.sent)
+
+
+class GateSecFetchSiteCheck(_BoundStateMixin):
+    """Handler._gate(): Sec-Fetch-Site is checked before Origin, and a
+    cross-site value is refused outright regardless of Origin."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_cross_site_rejected_with_403(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "cross-site"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+    def test_cross_site_rejected_even_with_matching_origin(self):
+        # Belt and braces: even if Origin somehow matched, a browser
+        # that says cross-site is telling the truth about the request's
+        # provenance and must not be second-guessed.
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "cross-site",
+                           "Origin": "http://127.0.0.1:8722"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+    def test_same_origin_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "same-origin"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_same_site_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "same-site"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_none_value_allowed(self):
+        # "none" means the browser itself typed the URL / used a
+        # bookmark -- not driven by another page.
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Sec-Fetch-Site": "none"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_absent_header_falls_through_to_origin_check(self):
+        # Older browsers and non-browser clients don't send
+        # Sec-Fetch-Site at all; the gate must not require it.
+        fh = _FakeHandler({"Host": "127.0.0.1:8722"})
+        self.assertTrue(server.Handler._gate(fh))
+
+
+class GateOriginCheck(_BoundStateMixin):
+    """Handler._gate(): Origin is checked last, after Host and
+    Sec-Fetch-Site both pass."""
+
+    def setUp(self):
+        super().setUp()
+        server.set_bound_address("127.0.0.1", 8722)
+
+    def test_cross_origin_rejected_with_403(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Origin": "http://evil.com:8722"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+    def test_matching_origin_allowed(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722",
+                           "Origin": "http://127.0.0.1:8722"})
+        self.assertTrue(server.Handler._gate(fh))
+
+    def test_null_origin_rejected(self):
+        fh = _FakeHandler({"Host": "127.0.0.1:8722", "Origin": "null"})
+        self.assertFalse(server.Handler._gate(fh))
+        self.assertEqual(fh.sent[0], 403)
+
+
+class HostAllowedLooseIpLiteralCheck(_BoundStateMixin):
+    """_is_ip_literal() is a syntactic check only (used to decide whether
+    a Host string "looks like" an address rather than a hostname when
+    bound to a wildcard address); it does not validate octet ranges. Not
+    exploitable on its own -- a Host header still has to reach the
+    process over a socket bound to that literal interface, or be one of
+    the fixed loopback names -- but locked in here so a tightening or
+    loosening of the check is a deliberate change, not a surprise."""
+
+    def test_out_of_range_octets_still_treated_as_ip_shaped(self):
+        self.assertTrue(server._is_ip_literal("999.999.999.999"))
+
+    def test_real_hostname_not_ip_shaped(self):
+        self.assertFalse(server._is_ip_literal("attacker.example"))
+
+
+if __name__ == "__main__":
+    unittest.main()

From 1dab6b9696333b42d60738d9673e796755d2bb33 Mon Sep 17 00:00:00 2001
From: deadp <deadp@users.noreply.github.com>
Date: Wed, 16 Sep 2026 20:41:31 +1200
Subject: [PATCH 2/7] Add CodeQL scanning and Dependabot for GitHub Actions

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml       | 16 +++++++++++
 .github/workflows/codeql.yml | 56 ++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ab3c419
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  # No pip ecosystem entry by design: Strata is standard-library-only in
+  # the engine and in the tests (see CONTRIBUTING.md), so there is no
+  # requirements.txt / pyproject.toml to keep current. Only the CI
+  # tooling itself -- the GitHub Actions used in the workflows -- has
+  # versions worth Dependabot's attention.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..7e1902b
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,56 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly as well as on push: CodeQL's query packs are updated
+    # independently of this repo, so new checks reach unchanged code.
+    - cron: '17 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        # engine/ parses untrusted forensic input (images, filesystems,
+        # registry hives, archives, ...) byte by byte, and web/ is the
+        # local HTTP UI that talks to it -- both are exactly the kind of
+        # code CodeQL is worth running against. No compiled languages
+        # here, so build-mode is always "none".
+        include:
+          - { language: python, build-mode: none }
+          - { language: javascript-typescript, build-mode: none }
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+          paths-ignore: |
+            docs/**
+            **/*.md
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'

From c311136a3d5dbd6a89e148435b0ced53f75fb238 Mon Sep 17 00:00:00 2001
From: deadp <deadp@users.noreply.github.com>
Date: Wed, 16 Sep 2026 20:51:14 +1200
Subject: [PATCH 3/7] Add parser tests for ext4, the registry and EWF

Synthetic images are built in code (tests/imagebuild_*.py) so no evidence
or binary fixture is committed. Ten engine bugs found along the way are
recorded as expected failures, each naming the fault: inline data and
inline directories, sparse extents, extent-tree blow-up, the deleted-file
path without a journal, short and truncated hives, over-broad EWF segment
discovery, truncated zlib chunks, and split raw sets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 tests/imagebuild_ewf.py      | 189 +++++++++++++++
 tests/imagebuild_ext4.py     | 455 +++++++++++++++++++++++++++++++++++
 tests/imagebuild_registry.py | 255 ++++++++++++++++++++
 tests/test_ewf.py            | 352 +++++++++++++++++++++++++++
 tests/test_fs_ext4.py        | 333 +++++++++++++++++++++++++
 tests/test_registry.py       | 369 ++++++++++++++++++++++++++++
 6 files changed, 1953 insertions(+)
 create mode 100644 tests/imagebuild_ewf.py
 create mode 100644 tests/imagebuild_ext4.py
 create mode 100644 tests/imagebuild_registry.py
 create mode 100644 tests/test_ewf.py
 create mode 100644 tests/test_fs_ext4.py
 create mode 100644 tests/test_registry.py

diff --git a/tests/imagebuild_ewf.py b/tests/imagebuild_ewf.py
new file mode 100644
index 0000000..0ffebba
--- /dev/null
+++ b/tests/imagebuild_ewf.py
@@ -0,0 +1,189 @@
+"""Build synthetic EWF v1 (E01) segment files and split raw sets in memory.
+
+Follows the libewf "Expert Witness Compression Format" specification.
+
+Segment file:
+
+    0     file header (13 bytes): "EVF\\x09\\x0d\\x0a\\xff\\x00", 0x01,
+          segment number (u16), 0x0000
+    13    sections, each starting with a 76-byte descriptor:
+            type (16, NUL padded), next section offset (u64, absolute in
+            this file), section size (u64, descriptor included),
+            40 bytes padding, Adler-32 of the preceding 72 bytes (u32)
+
+Sections written, in order:
+
+    E01:  header, volume, sectors, table, table2, then "hash" + "done" for a
+          single segment or "next" when another segment follows
+    E02+: data (copy of volume), sectors, table, table2, then next/hash+done
+
+    header   zlib-compressed text: "1", "main", tab-separated keys, values
+    volume   1052 bytes: media type @0, chunk count @4, sectors per chunk
+             @8, bytes per sector @12, sector count (u64) @16, media flags
+             @36, compression level @52, ... Adler-32 @1048
+    sectors  chunk data.  Uncompressed chunk = data + Adler-32 (u32 LE);
+             compressed chunk = zlib stream
+    table    entry count (u32), padding (4), base offset (u64), padding (4),
+             Adler-32 of those 20 bytes; entries (u32: offset relative to the
+             base offset, MSB set = compressed); Adler-32 of the entries
+    hash     MD5 (16), unknown (16), Adler-32 (4)
+
+Chunks are CHUNK_SIZE bytes (SECTORS_PER_CHUNK x 512).  build_e01() stores
+even-numbered chunks zlib-compressed and odd ones uncompressed; the media's
+last chunk is short when the sector count is not a whole number of chunks.
+"""
+
+import hashlib
+import struct
+import zlib
+
+EVF_SIG = b"EVF\x09\x0d\x0a\xff\x00"
+SECTOR = 512
+SECTORS_PER_CHUNK = 4
+CHUNK_SIZE = SECTOR * SECTORS_PER_CHUNK
+DESC = 76
+
+HEADER_FIELDS = [("c", "CASE-1"), ("n", "EV-7"), ("a", "synthetic disk"),
+                 ("e", "Examiner"), ("t", "unit test"), ("av", "7.0"),
+                 ("ov", "Linux"), ("m", "2026 9 16 10 0 0"),
+                 ("u", "2026 9 16 10 0 0"), ("p", "0")]
+
+
+def adler(data):
+    return zlib.adler32(data) & 0xFFFFFFFF
+
+
+def media(sectors=14):
+    """Deterministic media content: `sectors` sectors, each distinct."""
+    out = bytearray()
+    for s in range(sectors):
+        line = ("sector %04d " % s).encode("ascii")
+        out += (line * (SECTOR // len(line) + 1))[:SECTOR]
+    return bytes(out)
+
+
+def descriptor(type_, offset, size, next_offset=None):
+    raw = type_.encode("ascii").ljust(16, b"\x00")
+    raw += struct.pack("<QQ", offset + size if next_offset is None
+                       else next_offset, size)
+    raw += bytes(40)
+    return raw + struct.pack("<I", adler(raw))
+
+
+def header_body(fields=HEADER_FIELDS):
+    text = "1\nmain\n%s\n%s\n\n" % ("\t".join(k for k, _ in fields),
+                                     "\t".join(v for _, v in fields))
+    return zlib.compress(text.encode("ascii"))
+
+
+def volume_body(chunk_count, sector_count, compression=1):
+    body = bytearray(1052)
+    body[0] = 0x01                                   # fixed disk
+    struct.pack_into("<IIIQ", body, 4, chunk_count, SECTORS_PER_CHUNK,
+                     SECTOR, sector_count)
+    body[36] = 0x01                                  # image file
+    body[52] = compression
+    struct.pack_into("<I", body, 1048, adler(bytes(body[:1048])))
+    return bytes(body)
+
+
+def chunk_bytes(data, compress):
+    if compress:
+        return zlib.compress(data)
+    return data + struct.pack("<I", adler(data))
+
+
+def table_body(offsets, base, compressed_flags):
+    head = struct.pack("<IIQI", len(offsets), 0, base, 0)
+    head += struct.pack("<I", adler(head))
+    entries = b"".join(struct.pack("<I", (o - base) | (0x80000000 if c else 0))
+                       for o, c in zip(offsets, compressed_flags))
+    return head + entries + struct.pack("<I", adler(entries))
+
+
+def hash_body(md5):
+    body = md5 + bytes(16)
+    return body + struct.pack("<I", adler(body))
+
+
+def segment(number, chunks, last, total_chunks, sector_count, md5,
+            chunk_mutator=None):
+    """One segment file.  `chunks` is a list of (data, compress)."""
+    out = bytearray(EVF_SIG + struct.pack("<BHH", 1, number, 0))
+
+    def section(type_, body, next_offset=None):
+        start = len(out)
+        out.extend(descriptor(type_, start, DESC + len(body), next_offset))
+        out.extend(body)
+
+    if number == 1:
+        section("header", header_body())
+        section("volume", volume_body(total_chunks, sector_count))
+    else:
+        section("data", volume_body(total_chunks, sector_count))
+
+    sectors_start = len(out)
+    stored = []
+    for i, (data, compress) in enumerate(chunks):
+        raw = chunk_bytes(data, compress)
+        if chunk_mutator:
+            raw = chunk_mutator(i, raw)
+        stored.append(raw)
+    offsets, pos = [], sectors_start + DESC
+    for raw in stored:
+        offsets.append(pos)
+        pos += len(raw)
+    section("sectors", b"".join(stored))
+
+    flags = [c for _d, c in chunks]
+    body = table_body(offsets, sectors_start, flags)
+    section("table", body)
+    section("table2", body)
+    if last:
+        section("hash", hash_body(md5))
+        start = len(out)
+        out.extend(descriptor("done", start, DESC, next_offset=start))
+    else:
+        start = len(out)
+        out.extend(descriptor("next", start, DESC, next_offset=start))
+    return bytes(out)
+
+
+def build_e01(data=None, per_segment=None, compress=None, chunk_mutator=None):
+    """Return a list of segment file bytes (E01, E02, ...) holding `data`.
+
+    per_segment: chunks per segment file (default: all in one).
+    compress:    function(chunk index) -> bool (default: even chunks).
+    chunk_mutator: function(global chunk index, stored bytes) -> bytes, to
+                   corrupt a chunk after its checksum was computed.
+    """
+    data = media() if data is None else data
+    if len(data) % SECTOR:
+        raise ValueError("media must be a whole number of sectors")
+    compress = compress or (lambda i: i % 2 == 0)
+    chunks = [(data[i:i + CHUNK_SIZE], compress(i // CHUNK_SIZE))
+              for i in range(0, len(data), CHUNK_SIZE)]
+    per_segment = per_segment or len(chunks)
+    md5 = hashlib.md5(data).digest()
+    segments = []
+    groups = [chunks[i:i + per_segment]
+              for i in range(0, len(chunks), per_segment)]
+    base = 0
+    for n, group in enumerate(groups):
+        mut = None
+        if chunk_mutator:
+            mut = (lambda b: lambda i, raw: chunk_mutator(b + i, raw))(base)
+        segments.append(segment(n + 1, group, n == len(groups) - 1,
+                                len(chunks), len(data) // SECTOR, md5, mut))
+        base += len(group)
+    return segments
+
+
+def segment_names(stem, count):
+    """x.E01, x.E02, ... as written by EnCase for the first 99 segments."""
+    return ["%s.E%02d" % (stem, i + 1) for i in range(count)]
+
+
+def split_raw(data, piece):
+    """Split raw media into .001/.002/... sized `piece` bytes."""
+    return [data[i:i + piece] for i in range(0, len(data), piece)]
diff --git a/tests/imagebuild_ext4.py b/tests/imagebuild_ext4.py
new file mode 100644
index 0000000..88fa363
--- /dev/null
+++ b/tests/imagebuild_ext4.py
@@ -0,0 +1,455 @@
+"""Build small synthetic ext2/3/4 filesystem images in memory.
+
+Nothing here is a fixture file: every image is assembled byte by byte so the
+tests stay reviewable and the builders can be reused as fuzzing seeds.
+
+Layout of the image returned by build_ext4() (block size 1024, one group):
+
+    block 0        boot block (zero)
+    block 1        superblock (byte offset 1024)
+    block 2        group descriptor table (32-byte descriptors)
+    block 3        block bitmap
+    block 4        inode bitmap
+    blocks 5-12    inode table: 32 inodes x 256 bytes
+    blocks 13+     data blocks, handed out in allocation order
+
+Superblock features: incompat FILETYPE | EXTENTS | INLINE_DATA, compat
+HAS_JOURNAL, rev 1, first_ino 11, journal inode 8.  Inodes (see the INO_*
+constants for the numbers and CONTENT for expected file bytes):
+
+    2   /                  directory, extent-mapped (depth 0)
+    8   journal            jbd2 journal, 16 blocks, extent-mapped
+    12  extent.txt         2 blocks in one depth-0 extent
+    13  deep.bin           depth-1 extent tree: index -> leaf block -> 2 extents
+    14  legacy.txt         block map: 12 direct pointers + 1 single-indirect block
+    15  inline.txt         inline data, fits within i_block (<= 60 bytes)
+    16  inline_long.txt    inline data, first 60 bytes in i_block, rest in the
+                           in-inode "system.data" extended attribute
+    17  link               fast symlink -> "extent.txt"
+    18  sub/               directory; holds nested.txt (inode 19)
+    19  sub/nested.txt     1-block extent file
+    20  sparse.bin         extents at logical 0 and 2 with a hole at logical 1
+    21  deleted.txt        unlinked (links 0, dtime set, size 0, empty extent
+                           header); an earlier copy of its inode table block
+                           survives in journal transaction 5
+    22  inlinedir/         inline-data directory holding "again.txt" -> 12
+
+Journal (inode 8, journal-relative block numbers):
+
+    0   jbd2 superblock v2, blocksize 1024, maxlen 16, first 1, sequence 5
+    1   descriptor block, sequence 5, one tag for the inode-table block that
+        holds inode 21 (tag flags LAST_TAG, UUID follows the tag)
+    2   the superseded copy of that inode-table block (inode 21 live: links 1,
+        size len(CONTENT["deleted.txt"]), extent -> its old data block)
+    3   commit block, sequence 5
+"""
+
+import struct
+
+BLOCK_SIZE = 1024
+INODE_SIZE = 256
+INODES_PER_GROUP = 32
+BLOCKS_COUNT = 160
+INODE_TABLE = 5
+INODE_TABLE_BLOCKS = INODES_PER_GROUP * INODE_SIZE // BLOCK_SIZE
+FIRST_DATA = INODE_TABLE + INODE_TABLE_BLOCKS
+
+S_IFDIR = 0x4000
+S_IFREG = 0x8000
+S_IFLNK = 0xA000
+FL_EXTENTS = 0x00080000
+FL_INLINE_DATA = 0x10000000
+
+INCOMPAT_FILETYPE = 0x0002
+INCOMPAT_EXTENTS = 0x0040
+INCOMPAT_INLINE_DATA = 0x8000
+COMPAT_HAS_JOURNAL = 0x0004
+
+JBD2_MAGIC = 0xC03B3998
+
+MTIME = 1700000000
+DTIME = 1700000500
+UUID = bytes(range(16))
+LABEL = b"strata-test"
+
+INO_ROOT = 2
+INO_JOURNAL = 8
+INO_EXTENT = 12
+INO_DEEP = 13
+INO_LEGACY = 14
+INO_INLINE = 15
+INO_INLINE_LONG = 16
+INO_LINK = 17
+INO_SUB = 18
+INO_NESTED = 19
+INO_SPARSE = 20
+INO_DELETED = 21
+INO_INLINEDIR = 22
+
+JOURNAL_BLOCKS = 16
+JOURNAL_SEQUENCE = 5
+
+
+def _pattern(tag, length):
+    """Distinct, position-dependent filler so misplaced bytes are visible."""
+    out = bytearray()
+    n = 0
+    while len(out) < length:
+        out += ("%s:%05d|" % (tag, n)).encode("ascii")
+        n += 1
+    return bytes(out[:length])
+
+
+CONTENT = {
+    "extent.txt": _pattern("extent", 1500),
+    "deep.bin": _pattern("deep", 3000),
+    "legacy.txt": _pattern("legacy", 13 * BLOCK_SIZE + 100),
+    "inline.txt": b"small file stored inside its own inode\n",
+    "inline_long.txt": _pattern("inl", 100),
+    "sub/nested.txt": b"nested file content\n",
+    "sparse.bin": (_pattern("sp0", BLOCK_SIZE) + bytes(BLOCK_SIZE)
+                   + _pattern("sp2", BLOCK_SIZE)),
+    "deleted.txt": b"this content was deleted but the journal remembers\n",
+}
+LINK_TARGET = b"extent.txt"
+
+
+def extent_header(entries, max_entries, depth):
+    """ext4_extent_header: magic 0xF30A, entries, max, depth, generation."""
+    return struct.pack("<HHHHI", 0xF30A, entries, max_entries, depth, 0)
+
+
+def extent(logical, length, physical):
+    """ext4_extent: ee_block, ee_len, ee_start_hi, ee_start_lo."""
+    return struct.pack("<IHHI", logical, length, physical >> 32,
+                       physical & 0xFFFFFFFF)
+
+
+def extent_index(logical, leaf):
+    """ext4_extent_idx: ei_block, ei_leaf_lo, ei_leaf_hi, unused."""
+    return struct.pack("<IIHH", logical, leaf & 0xFFFFFFFF, leaf >> 32, 0)
+
+
+def extent_area(extents, depth=0):
+    """A 60-byte i_block holding an extent (or index) node of up to 4."""
+    body = extent_header(len(extents), 4, depth) + b"".join(extents)
+    return body.ljust(60, b"\x00")
+
+
+def dirent(inode, name, ftype, rec_len=None):
+    """ext4_dir_entry_2: inode, rec_len, name_len, file_type, name (pad 4)."""
+    name = name.encode("utf-8") if isinstance(name, str) else name
+    need = (8 + len(name) + 3) // 4 * 4
+    rec_len = rec_len or need
+    return struct.pack("<IHBB", inode, rec_len, len(name), ftype) + \
+        name + bytes(rec_len - 8 - len(name))
+
+
+def dir_block(entries, size=BLOCK_SIZE):
+    """Pack (inode, name, ftype) dirents; the last one pads to `size`."""
+    out = bytearray()
+    for i, (ino, name, ftype) in enumerate(entries):
+        if i == len(entries) - 1:
+            raw = dirent(ino, name, ftype)
+            out += dirent(ino, name, ftype, size - len(out)) \
+                if size - len(out) >= len(raw) else raw
+        else:
+            out += dirent(ino, name, ftype)
+    return bytes(out)
+
+
+def inode_bytes(mode, size, i_block=b"", flags=0, links=1, dtime=0,
+                xattr=b""):
+    """One 256-byte inode (ext4_inode) with i_extra_isize = 32.
+
+    `xattr` is placed at byte 160 (128 + extra_isize), i.e. the in-inode
+    extended attribute area, and must include its 0xEA020000 magic.
+    """
+    raw = bytearray(INODE_SIZE)
+    struct.pack_into("<HHIIIIIHH", raw, 0, mode, 1000, size & 0xFFFFFFFF,
+                     MTIME, MTIME, MTIME, dtime, 1000, links)
+    struct.pack_into("<I", raw, 32, flags)
+    raw[40:100] = i_block.ljust(60, b"\x00")[:60]
+    struct.pack_into("<I", raw, 108, size >> 32)
+    struct.pack_into("<H", raw, 128, 32)            # i_extra_isize
+    struct.pack_into("<I", raw, 144, MTIME)         # i_crtime
+    raw[160:160 + len(xattr)] = xattr
+    return bytes(raw)
+
+
+def inline_data_xattr(value):
+    """In-inode xattr area carrying one "system.data" entry.
+
+    ext4_xattr_ibody_header (magic) then ext4_xattr_entry: name_len 4,
+    name_index 7 (system), value_offs (relative to the first entry),
+    value_inum 0, value_size, hash 0, name "data"; a 4-byte zero terminator;
+    the value itself sits right after, padded to 4.
+    """
+    entry_len = 16 + 4
+    value_offs = entry_len + 4
+    entry = struct.pack("<BBHIII", 4, 7, value_offs, 0, len(value), 0) + b"data"
+    pad = bytes((4 - len(value) % 4) % 4)
+    return struct.pack("<I", 0xEA020000) + entry + bytes(4) + value + pad
+
+
+class Ext4Image(object):
+    """Mutable single-group image; call to_bytes() when done."""
+
+    def __init__(self, blocks=BLOCKS_COUNT):
+        self.blocks = blocks
+        self.data = bytearray(blocks * BLOCK_SIZE)
+        self.next_block = FIRST_DATA
+
+    def alloc(self, count=1):
+        first = self.next_block
+        self.next_block += count
+        if self.next_block > self.blocks:
+            raise ValueError("builder ran out of blocks")
+        return first
+
+    def write_block(self, block, payload):
+        if len(payload) > BLOCK_SIZE:
+            raise ValueError("payload larger than a block")
+        off = block * BLOCK_SIZE
+        self.data[off:off + BLOCK_SIZE] = payload.ljust(BLOCK_SIZE, b"\x00")
+
+    def write_blocks(self, first, payload):
+        for i in range(0, len(payload), BLOCK_SIZE):
+            self.write_block(first + i // BLOCK_SIZE, payload[i:i + BLOCK_SIZE])
+
+    @staticmethod
+    def inode_offset(num):
+        return INODE_TABLE * BLOCK_SIZE + (num - 1) * INODE_SIZE
+
+    def set_inode(self, num, raw):
+        off = self.inode_offset(num)
+        self.data[off:off + INODE_SIZE] = raw
+
+    def superblock(self, incompat, compat, journal_inum=INO_JOURNAL):
+        sb = bytearray(1024)
+        struct.pack_into("<IIIII", sb, 0, INODES_PER_GROUP, self.blocks, 0,
+                         0, INODES_PER_GROUP)
+        struct.pack_into("<I", sb, 20, 1)                   # first_data_block
+        struct.pack_into("<I", sb, 24, 0)                   # log_block_size
+        struct.pack_into("<I", sb, 32, 8192)                # blocks_per_group
+        struct.pack_into("<I", sb, 40, INODES_PER_GROUP)    # inodes_per_group
+        struct.pack_into("<II", sb, 44, MTIME, MTIME)       # mtime, wtime
+        sb[56:58] = b"\x53\xEF"
+        struct.pack_into("<H", sb, 58, 1)                   # state: clean
+        struct.pack_into("<I", sb, 76, 1)                   # rev_level
+        struct.pack_into("<I", sb, 84, 11)                  # first_ino
+        struct.pack_into("<H", sb, 88, INODE_SIZE)
+        struct.pack_into("<III", sb, 92, compat, incompat, 0)
+        sb[104:120] = UUID
+        sb[120:120 + len(LABEL)] = LABEL
+        sb[136:141] = b"/mnt\x00"
+        struct.pack_into("<I", sb, 224, journal_inum)
+        self.data[1024:2048] = sb
+        gd = struct.pack("<III", 3, 4, INODE_TABLE)
+        self.write_block(2, gd)
+
+    def to_bytes(self):
+        return bytes(self.data)
+
+
+def journal_superblock(maxlen=JOURNAL_BLOCKS, first=1, sequence=JOURNAL_SEQUENCE):
+    """journal_superblock_t v2 (big-endian)."""
+    sb = bytearray(BLOCK_SIZE)
+    struct.pack_into(">III", sb, 0, JBD2_MAGIC, 4, 0)
+    struct.pack_into(">IIIII", sb, 12, BLOCK_SIZE, maxlen, first, sequence,
+                     first)
+    sb[48:64] = UUID
+    struct.pack_into(">I", sb, 64, 1)
+    return bytes(sb)
+
+
+def journal_descriptor(sequence, fs_blocks):
+    """Descriptor block with classic 8-byte tags (no 64bit, no csum).
+
+    Tag: t_blocknr (be32), t_checksum (be16), t_flags (be16).  The first tag
+    carries the 16-byte UUID after it; later tags set SAME_UUID (0x2); the
+    last sets LAST_TAG (0x8).
+    """
+    blk = bytearray(struct.pack(">III", JBD2_MAGIC, 1, sequence))
+    for i, b in enumerate(fs_blocks):
+        flags = 0x2 if i else 0
+        if i == len(fs_blocks) - 1:
+            flags |= 0x8
+        blk += struct.pack(">IHH", b, 0, flags)
+        if i == 0:
+            blk += UUID
+    return bytes(blk)
+
+
+def journal_commit(sequence):
+    return struct.pack(">III", JBD2_MAGIC, 2, sequence)
+
+
+def build_ext4():
+    """The full test filesystem described in the module docstring."""
+    img = Ext4Image()
+    img.superblock(INCOMPAT_FILETYPE | INCOMPAT_EXTENTS | INCOMPAT_INLINE_DATA,
+                   COMPAT_HAS_JOURNAL)
+
+    def reg_extents(num, data):
+        n = (len(data) + BLOCK_SIZE - 1) // BLOCK_SIZE
+        first = img.alloc(n)
+        img.write_blocks(first, data)
+        img.set_inode(num, inode_bytes(S_IFREG | 0o644, len(data),
+                                       extent_area([extent(0, n, first)]),
+                                       FL_EXTENTS))
+        return first
+
+    reg_extents(INO_EXTENT, CONTENT["extent.txt"])
+
+    # deep.bin: depth-1 tree. Leaf block holds two extents whose physical
+    # blocks are deliberately not adjacent.
+    deep = CONTENT["deep.bin"]
+    leaf = img.alloc()
+    a = img.alloc(2)
+    img.alloc()                                   # gap on disk
+    b = img.alloc()
+    img.write_blocks(a, deep[:2 * BLOCK_SIZE])
+    img.write_blocks(b, deep[2 * BLOCK_SIZE:])
+    leaf_node = extent_header(2, (BLOCK_SIZE - 12) // 12, 0) + \
+        extent(0, 2, a) + extent(2, 1, b)
+    img.write_block(leaf, leaf_node)
+    img.set_inode(INO_DEEP, inode_bytes(
+        S_IFREG | 0o644, len(deep),
+        extent_area([extent_index(0, leaf)], depth=1), FL_EXTENTS))
+
+    # legacy.txt: 14 data blocks -> 12 direct + 2 via the indirect block.
+    legacy = CONTENT["legacy.txt"]
+    n = (len(legacy) + BLOCK_SIZE - 1) // BLOCK_SIZE
+    first = img.alloc(n)
+    img.write_blocks(first, legacy)
+    ind = img.alloc()
+    img.write_block(ind, struct.pack("<%dI" % (n - 12),
+                                     *range(first + 12, first + n)))
+    ptrs = list(range(first, first + 12)) + [ind, 0, 0]
+    img.set_inode(INO_LEGACY, inode_bytes(S_IFREG | 0o644, len(legacy),
+                                          struct.pack("<15I", *ptrs)))
+
+    small = CONTENT["inline.txt"]
+    img.set_inode(INO_INLINE, inode_bytes(S_IFREG | 0o644, len(small), small,
+                                          FL_INLINE_DATA))
+    long_ = CONTENT["inline_long.txt"]
+    img.set_inode(INO_INLINE_LONG, inode_bytes(
+        S_IFREG | 0o644, len(long_), long_[:60], FL_INLINE_DATA,
+        xattr=inline_data_xattr(long_[60:])))
+
+    img.set_inode(INO_LINK, inode_bytes(S_IFLNK | 0o777, len(LINK_TARGET),
+                                        LINK_TARGET))
+
+    reg_extents(INO_NESTED, CONTENT["sub/nested.txt"])
+    sub = img.alloc()
+    img.write_block(sub, dir_block([(INO_SUB, ".", 2), (INO_ROOT, "..", 2),
+                                    (INO_NESTED, "nested.txt", 1)]))
+    img.set_inode(INO_SUB, inode_bytes(S_IFDIR | 0o755, BLOCK_SIZE,
+                                       extent_area([extent(0, 1, sub)]),
+                                       FL_EXTENTS, links=2))
+
+    sparse = CONTENT["sparse.bin"]
+    s0 = img.alloc()
+    s2 = img.alloc()
+    img.write_block(s0, sparse[:BLOCK_SIZE])
+    img.write_block(s2, sparse[2 * BLOCK_SIZE:])
+    img.set_inode(INO_SPARSE, inode_bytes(
+        S_IFREG | 0o644, len(sparse),
+        extent_area([extent(0, 1, s0), extent(2, 1, s2)]), FL_EXTENTS))
+
+    # Inline directory: 4-byte parent inode, then dirents filling i_block.
+    inline_dir = struct.pack("<I", INO_ROOT) + dir_block(
+        [(INO_EXTENT, "again.txt", 1)], size=56)
+    img.set_inode(INO_INLINEDIR, inode_bytes(S_IFDIR | 0o755, 60, inline_dir,
+                                             FL_INLINE_DATA, links=2))
+
+    # deleted.txt: the live inode is cleared; journal holds the old one.
+    old = CONTENT["deleted.txt"]
+    old_block = img.alloc()
+    img.write_block(old_block, old)
+    img.set_inode(INO_DELETED, inode_bytes(
+        S_IFREG | 0o644, len(old), extent_area([extent(0, 1, old_block)]),
+        FL_EXTENTS))
+    itable_block = INODE_TABLE + (INO_DELETED - 1) * INODE_SIZE // BLOCK_SIZE
+    off = itable_block * BLOCK_SIZE
+    superseded = bytes(img.data[off:off + BLOCK_SIZE])
+    img.set_inode(INO_DELETED, inode_bytes(
+        S_IFREG | 0o644, 0, extent_header(0, 4, 0), FL_EXTENTS, links=0,
+        dtime=DTIME))
+
+    root = img.alloc()
+    img.write_block(root, dir_block([
+        (INO_ROOT, ".", 2), (INO_ROOT, "..", 2),
+        (INO_EXTENT, "extent.txt", 1), (INO_DEEP, "deep.bin", 1),
+        (INO_LEGACY, "legacy.txt", 1), (INO_INLINE, "inline.txt", 1),
+        (INO_INLINE_LONG, "inline_long.txt", 1), (INO_LINK, "link", 7),
+        (INO_SUB, "sub", 2), (INO_SPARSE, "sparse.bin", 1),
+        (INO_DELETED, "deleted.txt", 1), (INO_INLINEDIR, "inlinedir", 2),
+    ]))
+    img.set_inode(INO_ROOT, inode_bytes(S_IFDIR | 0o755, BLOCK_SIZE,
+                                        extent_area([extent(0, 1, root)]),
+                                        FL_EXTENTS, links=4))
+    # The journal is allocated last so it ends the used area of the image.
+    jfirst = img.alloc(JOURNAL_BLOCKS)
+    img.write_block(jfirst, journal_superblock())
+    img.write_block(jfirst + 1, journal_descriptor(JOURNAL_SEQUENCE,
+                                                   [itable_block]))
+    img.write_block(jfirst + 2, superseded)
+    img.write_block(jfirst + 3, journal_commit(JOURNAL_SEQUENCE))
+    img.set_inode(INO_JOURNAL, inode_bytes(
+        S_IFREG | 0o600, JOURNAL_BLOCKS * BLOCK_SIZE,
+        extent_area([extent(0, JOURNAL_BLOCKS, jfirst)]), FL_EXTENTS))
+
+    return img.to_bytes()
+
+
+def build_ext4_truncated_journal():
+    """build_ext4() with journal block 1 turned into a revoke block and the
+    image cut 14 bytes into that block (an interrupted acquisition).  Every
+    structure outside the journal is still intact."""
+    data = bytearray(build_ext4())
+    jfirst = journal_first_block(data)
+    at = (jfirst + 1) * BLOCK_SIZE
+    data[at:at + 16] = struct.pack(">IIII", JBD2_MAGIC, 5, JOURNAL_SEQUENCE, 20)
+    return bytes(data[:at + 14])
+
+
+def journal_first_block(image):
+    """Physical block of journal block 0 (reads inode 8's single extent)."""
+    off = Ext4Image.inode_offset(INO_JOURNAL) + 40 + 12
+    return struct.unpack_from("<I", image, off + 8)[0]
+
+
+def build_ext2_legacy():
+    """An ext2 image (no extents, no journal): root dir and one file, both
+    mapped by direct block pointers.  File is inode 12, "hello.txt"."""
+    img = Ext4Image(blocks=64)
+    img.superblock(INCOMPAT_FILETYPE, 0, journal_inum=0)
+    data = b"hello from ext2\n"
+    blk = img.alloc()
+    img.write_block(blk, data)
+    img.set_inode(12, inode_bytes(S_IFREG | 0o644, len(data),
+                                  struct.pack("<15I", blk, *([0] * 14))))
+    root = img.alloc()
+    img.write_block(root, dir_block([(2, ".", 2), (2, "..", 2),
+                                     (12, "hello.txt", 1)]))
+    img.set_inode(2, inode_bytes(S_IFDIR | 0o755, BLOCK_SIZE,
+                                 struct.pack("<15I", root, *([0] * 14)),
+                                 links=2))
+    return img.to_bytes()
+
+
+def build_ext4_extent_loop():
+    """Hostile image: inode 12 is a depth-1 extent tree whose index points at
+    an index block that points (84 times) back at itself with depth 1."""
+    img = Ext4Image(blocks=64)
+    img.superblock(INCOMPAT_FILETYPE | INCOMPAT_EXTENTS, 0, journal_inum=0)
+    loop = img.alloc()
+    fan = (BLOCK_SIZE - 12) // 12
+    img.write_block(loop, extent_header(fan, fan, 1)
+                    + extent_index(0, loop) * fan)
+    img.set_inode(12, inode_bytes(S_IFREG | 0o644, 4096,
+                                  extent_area([extent_index(0, loop)], 1),
+                                  FL_EXTENTS))
+    return img.to_bytes()
diff --git a/tests/imagebuild_registry.py b/tests/imagebuild_registry.py
new file mode 100644
index 0000000..b6f4f6a
--- /dev/null
+++ b/tests/imagebuild_registry.py
@@ -0,0 +1,255 @@
+"""Build synthetic Windows registry hives (regf) and transaction logs.
+
+Formats follow Maxim Suhanov's "Windows registry file format specification".
+
+Hive file:
+
+    0x0000  base block (4096 bytes): "regf", primary seq (4), secondary seq
+            (4), last written FILETIME (8), major 1, minor 5, type 0,
+            format 1, root cell offset (4, @36), hive bins data size (4, @40),
+            clustering factor 1, file name (UTF-16LE, @48, 64 bytes),
+            checksum (@508) = XOR of the 127 dwords before it (0 -> 1,
+            0xFFFFFFFF -> 0xFFFFFFFE)
+    0x1000  hive bins data: one "hbin" whose size is a multiple of 4096.
+            32-byte header ("hbin", offset, size, reserved, timestamp, spare),
+            then cells: int32 size (negative = allocated, positive = free),
+            aligned to 8 bytes.  Cell offsets are relative to 0x1000.
+
+build_hive() produces this key tree (root name "ROOT"):
+
+    ROOT                       subkeys via an lh list
+      Software                 subkeys via an lf list
+        Strata                 values: see VALUES
+      System                   subkeys via an ri list -> [li, lf]
+        Alpha
+        Beta
+      Ünïcode                  name stored as UTF-16LE (no COMP_NAME flag)
+
+plus a free (positive-size) nk cell "Removed" and a free vk cell
+"OldValue" = REG_SZ "gone", as left behind by a deletion.
+
+Transaction log (new format, .LOG1/.LOG2):
+
+    0x000   512-byte log base block ("regf" + sequence numbers)
+    0x200   log entries: "HvLE", size (multiple of 512), flags, sequence,
+            hive bins data size, dirty page count, hash-1 (Marvin32 of the
+            entry bytes from 40 to size), hash-2 (Marvin32 of the first 32
+            entry bytes, hash-1 included); then (offset, size) page
+            references and the page bytes.
+"""
+
+import struct
+
+BASE_BLOCK = 4096
+MARVIN_SEED = 0x82EF4D887A4E55C5
+MASK = 0xFFFFFFFF
+FILETIME = 133000000000000000          # 2022-06-18T04:26:40Z
+BIG_DATA_SEGMENT = 16344
+
+KEY_HIVE_ENTRY = 0x0004
+KEY_NO_DELETE = 0x0008
+KEY_COMP_NAME = 0x0020
+VALUE_COMP_NAME = 0x0001
+
+REG_SZ, REG_BINARY, REG_DWORD, REG_MULTI_SZ = 1, 3, 4, 7
+
+BIG_BLOB = bytes((i * 7 + 3) & 0xFF for i in range(20000))
+
+# name -> (type, raw data)
+VALUES = [
+    ("", REG_SZ, "default value\x00".encode("utf-16-le")),
+    ("Name", REG_SZ, "Strata\x00".encode("utf-16-le")),
+    ("Count", REG_DWORD, struct.pack("<I", 42)),
+    ("Blob", REG_BINARY, bytes(range(16))),
+    ("Tiny", REG_BINARY, b"\x01\x02\x03"),
+    ("Paths", REG_MULTI_SZ, "C:\\a\x00D:\\b\x00\x00".encode("utf-16-le")),
+    ("Big", REG_BINARY, BIG_BLOB),
+]
+
+
+def base_checksum(block):
+    acc = 0
+    for i in range(0, 508, 4):
+        acc ^= struct.unpack_from("<I", block, i)[0]
+    if acc == 0:
+        return 1
+    if acc == MASK:
+        return MASK - 1
+    return acc
+
+
+def _rotl(v, n):
+    return ((v << n) | (v >> (32 - n))) & MASK
+
+
+def marvin32(data, seed=MARVIN_SEED):
+    """Marvin32 (as used by Windows for registry log entry hashes)."""
+    lo, hi = seed & MASK, (seed >> 32) & MASK
+
+    def mix(lo, hi, v):
+        lo = (lo + v) & MASK
+        hi ^= lo
+        lo = (_rotl(lo, 20) + hi) & MASK
+        hi = _rotl(hi, 9) ^ lo
+        lo = (_rotl(lo, 27) + hi) & MASK
+        hi = _rotl(hi, 19)
+        return lo, hi
+
+    n = len(data) // 4 * 4
+    for i in range(0, n, 4):
+        lo, hi = mix(lo, hi, struct.unpack_from("<I", data, i)[0])
+    tail = data[n:] + b"\x80"
+    lo, hi = mix(lo, hi, struct.unpack("<I", tail.ljust(4, b"\x00"))[0])
+    lo, hi = mix(lo, hi, 0)
+    return (hi << 32) | lo
+
+
+class HiveBuilder(object):
+    """Appends cells into a single hbin; offsets returned are cell offsets."""
+
+    def __init__(self):
+        self.cells = bytearray(32)          # hbin header filled in at the end
+
+    def cell(self, body, free=False):
+        off = len(self.cells)
+        size = (4 + len(body) + 7) // 8 * 8
+        self.cells += struct.pack("<i", size if free else -size)
+        self.cells += body + bytes(size - 4 - len(body))
+        return off
+
+    def nk(self, name, parent, subkeys=0, subkey_list=0xFFFFFFFF, values=0,
+           value_list=0xFFFFFFFF, flags=0, free=False):
+        try:
+            raw = name.encode("ascii")
+            flags |= KEY_COMP_NAME
+        except UnicodeEncodeError:
+            raw = name.encode("utf-16-le")
+        body = struct.pack("<2sHQIIIIIIIIIIIIIIIHH", b"nk", flags, FILETIME,
+                           0, parent, subkeys, 0, subkey_list, 0xFFFFFFFF,
+                           values, value_list, 0xFFFFFFFF, 0xFFFFFFFF,
+                           0, 0, 0, 0, 0, len(raw), 0)
+        return self.cell(body + raw, free=free)
+
+    def vk(self, name, vtype, data, free=False):
+        raw = name.encode("ascii")
+        if len(data) <= 4:
+            size = len(data) | 0x80000000
+            off = struct.unpack("<I", data.ljust(4, b"\x00"))[0]
+        elif len(data) > BIG_DATA_SEGMENT:
+            size, off = len(data), self.big_data(data)
+        else:
+            size, off = len(data), self.cell(data)
+        body = struct.pack("<2sHIIIHH", b"vk", len(raw), size, off, vtype,
+                           VALUE_COMP_NAME if raw else 0, 0)
+        return self.cell(body + raw, free=free)
+
+    def big_data(self, data):
+        segs = [self.cell(data[i:i + BIG_DATA_SEGMENT])
+                for i in range(0, len(data), BIG_DATA_SEGMENT)]
+        seglist = self.cell(struct.pack("<%dI" % len(segs), *segs))
+        return self.cell(struct.pack("<2sHI", b"db", len(segs), seglist))
+
+    def hashed_list(self, sig, offsets):
+        body = struct.pack("<2sH", sig, len(offsets))
+        for o in offsets:
+            body += struct.pack("<I4s", o, b"\x00\x00\x00\x00")
+        return self.cell(body)
+
+    def index_list(self, sig, offsets):
+        return self.cell(struct.pack("<2sH%dI" % len(offsets), sig,
+                                     len(offsets), *offsets))
+
+    def hbins(self):
+        size = (len(self.cells) + 16 + BASE_BLOCK - 1) // BASE_BLOCK * BASE_BLOCK
+        out = bytearray(self.cells)
+        remaining = size - len(out)
+        out += struct.pack("<i", remaining) + bytes(remaining - 4)
+        struct.pack_into("<4sIIIQI", out, 0, b"hbin", 0, size, 0, FILETIME, 0)
+        return bytes(out)
+
+
+def base_block(root_offset, hbins_size, seq1=1, seq2=1, name="ROOT"):
+    blk = bytearray(BASE_BLOCK)
+    struct.pack_into("<4sIIQIIIIIII", blk, 0, b"regf", seq1, seq2, FILETIME,
+                     1, 5, 0, 1, root_offset, hbins_size, 1)
+    fname = ("\\??\\C:\\" + name).encode("utf-16-le")[:64]
+    blk[48:48 + len(fname)] = fname
+    struct.pack_into("<I", blk, 508, base_checksum(blk))
+    return blk
+
+
+def build_hive(name_value="Strata", seq1=1, seq2=1):
+    """The hive described in the module docstring.  `name_value` replaces
+    the Software\\Strata "Name" string (keep its length to keep offsets)."""
+    b = HiveBuilder()
+    # Children are written before their parents, so parent offsets (and the
+    # root's subkey list) are patched in once every offset is known.
+    root = b.nk("ROOT", 0, flags=KEY_HIVE_ENTRY | KEY_NO_DELETE)
+
+    vals = []
+    for vname, vtype, data in VALUES:
+        if vname == "Name":
+            data = (name_value + "\x00").encode("utf-16-le")
+        vals.append(b.vk(vname, vtype, data))
+    vlist = b.cell(struct.pack("<%dI" % len(vals), *vals))
+
+    strata = b.nk("Strata", 0, values=len(vals), value_list=vlist)
+    software = b.nk("Software", root, subkeys=1,
+                    subkey_list=b.hashed_list(b"lf", [strata]))
+    alpha = b.nk("Alpha", 0)
+    beta = b.nk("Beta", 0)
+    ri = b.index_list(b"ri", [b.index_list(b"li", [alpha]),
+                              b.hashed_list(b"lf", [beta])])
+    system = b.nk("System", root, subkeys=2, subkey_list=ri)
+    uni = b.nk(u"\u00dcn\u00efcode", root)
+    root_list = b.hashed_list(b"lh", [software, system, uni])
+
+    # Deleted leftovers: free cells that still hold records.
+    b.nk("Removed", software, free=True)
+    b.vk("OldValue", REG_SZ, "gone\x00".encode("utf-16-le"), free=True)
+
+    # Patch parents and the root's subkey list now offsets are known.
+    def patch_u32(cell_off, field_off, value):
+        struct.pack_into("<I", b.cells, cell_off + 4 + field_off, value)
+
+    for child, parent in ((strata, software), (alpha, system),
+                          (beta, system)):
+        patch_u32(child, 16, parent)
+    patch_u32(root, 20, 3)
+    patch_u32(root, 28, root_list)
+
+    hbins = b.hbins()
+    return bytes(base_block(root, len(hbins), seq1, seq2)) + hbins
+
+
+def log_entry(sequence, hbins_size, pages):
+    """One HvLE entry. `pages` is a list of (offset, bytes)."""
+    refs = b"".join(struct.pack("<II", off, len(data)) for off, data in pages)
+    body = refs + b"".join(data for _off, data in pages)
+    size = (40 + len(body) + 511) // 512 * 512
+    body = body + bytes(size - 40 - len(body))
+    head = struct.pack("<4sIIIII", b"HvLE", size, 0, sequence, hbins_size,
+                       len(pages))
+    head += struct.pack("<Q", marvin32(body))
+    return head + struct.pack("<Q", marvin32(head)) + body
+
+
+def build_log(entries, sequence=1):
+    """A transaction log: 512-byte base block then the given entries."""
+    blk = bytearray(512)
+    struct.pack_into("<4sII", blk, 0, b"regf", sequence, sequence)
+    return bytes(blk) + b"".join(entries)
+
+
+def build_dirty_pair():
+    """(dirty hive, log, expected replayed hive bins).
+
+    The on-disk hive is at primary 11 / secondary 10 and still says
+    Name = "Strata"; the log holds entry 10 rewriting the whole hive bins
+    area so that Name = "Replay".
+    """
+    stale = build_hive("Strata", seq1=11, seq2=10)
+    fresh = build_hive("Replay")
+    fresh_bins = fresh[BASE_BLOCK:]
+    log = build_log([log_entry(10, len(fresh_bins), [(0, fresh_bins)])], 10)
+    return stale, log, fresh_bins
diff --git a/tests/test_ewf.py b/tests/test_ewf.py
new file mode 100644
index 0000000..470ad7b
--- /dev/null
+++ b/tests/test_ewf.py
@@ -0,0 +1,352 @@
+"""Unit tests for image containers (engine.ewf): EWF v1 segment sets, raw
+images, split raw sets and OffsetReader, fed files from imagebuild_ewf."""
+
+import hashlib
+import io
+import os
+import struct
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import imagebuild_ewf as build                                    # noqa: E402
+from engine import ewf                                            # noqa: E402
+
+MEDIA = build.media()                  # 14 sectors: 3 full chunks + 1 short
+
+
+class TempDir(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="strata-ewf-test-")
+        self.addCleanup(self._tmp.cleanup)
+        self.dir = self._tmp.name
+
+    def write(self, name, data):
+        path = os.path.join(self.dir, name)
+        with open(path, "wb") as fh:
+            fh.write(data)
+        return path
+
+    def write_segments(self, segments, stem="x"):
+        paths = [self.write(os.path.basename(n), s) for n, s in
+                 zip(build.segment_names(stem, len(segments)), segments)]
+        return paths[0]
+
+    def open(self, path):
+        img = ewf.open_image(path)
+        self.addCleanup(img.close)
+        return img
+
+
+class SingleSegment(TempDir):
+    def setUp(self):
+        super(SingleSegment, self).setUp()
+        self.img = self.open(self.write_segments(build.build_e01()))
+
+    def test_opens_as_ewf(self):
+        self.assertIsInstance(self.img, ewf.EwfImage)
+
+    def test_volume_geometry(self):
+        info = self.img.info()
+        self.assertEqual(info["format"], "EWF v1 (E01)")
+        self.assertEqual(info["segments"], ["x.E01"])
+        self.assertEqual(info["size"], len(MEDIA))
+        self.assertEqual(info["sector_count"], 14)
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_chunk"], build.SECTORS_PER_CHUNK)
+        self.assertEqual(info["chunk_size"], build.CHUNK_SIZE)
+        self.assertEqual(info["chunk_count"], 4)
+        self.assertEqual(info["compressed_chunks"], 2)
+        self.assertEqual(info["media_type"], 1)
+        self.assertEqual(info["compression_level"], 1)
+        self.assertEqual(info["findings"], [])
+
+    def test_header_section(self):
+        acq = self.img.info()["acquisition"]
+        self.assertEqual(acq["case_number"], "CASE-1")
+        self.assertEqual(acq["evidence_number"], "EV-7")
+        self.assertEqual(acq["examiner"], "Examiner")
+        self.assertEqual(acq["acquisition_date"], "2026 9 16 10 0 0")
+
+    def test_read_back_mixed_chunks(self):
+        self.assertEqual(self.img.read_at(0, len(MEDIA)), MEDIA)
+        self.assertEqual(self.img.findings, [])
+
+    def test_read_across_chunk_boundaries(self):
+        for off, n in ((2000, 100), (4095, 2), (6000, 5000), (0, 1)):
+            self.assertEqual(self.img.read_at(off, n), MEDIA[off:off + n])
+
+    def test_read_past_end(self):
+        self.assertEqual(self.img.read_at(len(MEDIA), 10), b"")
+        with self.assertRaises(ValueError):
+            self.img.read_at(-1, 10)
+
+    def test_file_like_read_and_seek(self):
+        self.img.seek(100)
+        self.assertEqual(self.img.read(10), MEDIA[100:110])
+        self.assertEqual(self.img.seek(5, io.SEEK_CUR), 115)
+        self.img.seek(-12, io.SEEK_END)
+        self.assertEqual(self.img.read(), MEDIA[-12:])
+
+    def test_stored_md5_and_verify(self):
+        md5 = hashlib.md5(MEDIA).hexdigest()
+        self.assertEqual(self.img.stored_md5, md5)
+        got = self.img.verify()
+        self.assertEqual(got["computed_md5"], md5)
+        self.assertEqual(got["computed_sha1"], hashlib.sha1(MEDIA).hexdigest())
+        self.assertTrue(got["md5_match"])
+        self.assertIsNone(got["stored_sha1"])
+
+    def test_all_uncompressed_and_all_compressed(self):
+        for name, fn in (("u", lambda i: False), ("c", lambda i: True)):
+            path = self.write_segments(build.build_e01(compress=fn), name)
+            img = self.open(path)
+            self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+            self.assertEqual(img.findings, [])
+
+
+class SplitSegments(TempDir):
+    def test_e01_e02_read_back(self):
+        segs = build.build_e01(per_segment=2)
+        self.assertEqual(len(segs), 2)
+        img = self.open(self.write_segments(segs))
+        self.assertEqual(img.info()["segments"], ["x.E01", "x.E02"])
+        self.assertEqual(len(img.chunks), 4)
+        self.assertEqual([c.seg for c in img.chunks], [0, 0, 1, 1])
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+        self.assertTrue(img.verify()["md5_match"])
+        self.assertEqual(img.findings, [])
+
+    def test_three_segments_opened_from_the_middle(self):
+        self.write_segments(build.build_e01(per_segment=1), "m")
+        img = self.open(os.path.join(self.dir, "m.E02"))
+        self.assertEqual(len(img.segment_paths), 4)
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_discover_segments_orders_numerically(self):
+        for ext in ("E10", "E02", "E01", "E09"):
+            self.write("s." + ext, b"")
+        self.write("other.E03", b"")
+        got = [os.path.basename(p) for p in
+               ewf.discover_segments(os.path.join(self.dir, "s.E01"))]
+        self.assertEqual(got, ["s.E01", "s.E02", "s.E09", "s.E10"])
+
+    # Engine bug: engine/ewf.py:58-61 the [A-Z]{3} alternative (IGNORECASE)
+    # makes any 3-letter sibling such as x.txt part of the segment set.
+    @unittest.expectedFailure
+    def test_unrelated_sidecar_file_is_not_a_segment(self):
+        path = self.write_segments(build.build_e01())
+        self.write("x.txt", b"acquisition notes\n")
+        img = self.open(path)
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+
+class Integrity(TempDir):
+    def corrupt(self, index, fn):
+        def mutate(i, raw):
+            return fn(raw) if i == index else raw
+        img = self.open(self.write_segments(
+            build.build_e01(chunk_mutator=mutate)))
+        return img, img.read_at(0, len(MEDIA))
+
+    @staticmethod
+    def flip(pos):
+        def fn(raw):
+            b = bytearray(raw)
+            b[pos] ^= 0x01
+            return bytes(b)
+        return fn
+
+    def test_uncompressed_chunk_checksum_mismatch_is_reported(self):
+        img, data = self.corrupt(1, self.flip(5))
+        self.assertNotEqual(data, MEDIA)
+        self.assertTrue(any("Chunk 1" in f and "Adler-32" in f
+                            for f in img.findings), img.findings)
+
+    def test_corrupt_compressed_chunk_is_reported(self):
+        img, data = self.corrupt(0, self.flip(20))
+        self.assertEqual(len(data), len(MEDIA))
+        self.assertEqual(data[:build.CHUNK_SIZE], bytes(build.CHUNK_SIZE))
+        self.assertTrue(any("Chunk 0" in f for f in img.findings))
+
+    def test_verify_detects_mismatch(self):
+        img, _data = self.corrupt(1, self.flip(5))
+        self.assertFalse(img.verify()["md5_match"])
+
+    # Engine bug: engine/ewf.py:307-318 (with engine/inflate.py) accepts a
+    # zlib stream that ends early: the short chunk is returned, no finding.
+    @unittest.expectedFailure
+    def test_truncated_compressed_chunk_is_reported(self):
+        img, data = self.corrupt(0, lambda raw: raw[:len(raw) // 2])
+        self.assertTrue(any("Chunk 0" in f for f in img.findings),
+                        "short read (%d of %d bytes) with no finding"
+                        % (len(data), len(MEDIA)))
+
+    def test_section_descriptor_checksum_mismatch_is_reported(self):
+        seg = bytearray(build.build_e01()[0])
+        seg[13 + 60] ^= 0xFF                 # padding of the header section
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(any("descriptor checksum" in f for f in img.findings))
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_table_header_checksum_mismatch_is_reported(self):
+        seg = bytearray(build.build_e01()[0])
+        table = self.find_section(seg, "table")
+        seg[table + build.DESC + 4] ^= 0xFF    # padding inside table header
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(any("Table header checksum" in f
+                            for f in img.findings))
+
+    @staticmethod
+    def find_section(seg, type_):
+        off = 13
+        while True:
+            name = bytes(seg[off:off + 16]).split(b"\x00")[0].decode()
+            if name == type_:
+                return off
+            off = struct.unpack_from("<Q", seg, off + 16)[0]
+
+
+class Robustness(TempDir):
+    def test_garbage_after_signature(self):
+        path = self.write("g.E01", build.EVF_SIG + bytes(500))
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(path)
+
+    def test_signature_only(self):
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(self.write("s.E01", build.EVF_SIG))
+
+    def test_not_ewf_at_all(self):
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(self.write("n.E01", b"hello world" * 100))
+
+    def test_ewf2_is_refused(self):
+        with self.assertRaises(ewf.EwfError):
+            ewf.open_image(self.write("v2.Ex01", ewf.EVF2_SIG + bytes(100)))
+
+    def test_known_unsupported_container(self):
+        with self.assertRaises(ewf.UnsupportedContainer) as cm:
+            ewf.open_image(self.write("q.qcow2", b"QFI\xfb" + bytes(100)))
+        self.assertIn("QCOW", cm.exception.format)
+
+    def test_truncated_at_every_section_boundary(self):
+        seg = build.build_e01()[0]
+        cuts = [13 + 38, len(seg) // 3, len(seg) // 2, len(seg) - 200,
+                len(seg) - build.DESC - 10]
+        for cut in cuts:
+            path = self.write("t%d.E01" % cut, seg[:cut])
+            try:
+                img = ewf.EwfImage(path)
+            except ewf.EwfError:
+                continue
+            try:
+                img.read_at(0, len(MEDIA))
+                img.info()
+            finally:
+                img.close()
+
+    def test_truncated_before_hash_still_reads(self):
+        seg = build.build_e01()[0]
+        hash_at = Integrity.find_section(seg, "hash")
+        img = self.open(self.write_segments([seg[:hash_at]]))
+        self.assertIsNone(img.stored_md5)
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+        self.assertFalse(img.verify()["md5_match"])
+
+    def test_non_advancing_section_chain(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table2")
+        struct.pack_into("<Q", seg, at + 16, at)
+        struct.pack_into("<I", seg, at + 72, build.adler(bytes(seg[at:at + 72])))
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(any("non-advancing" in f for f in img.findings))
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_backwards_section_pointer(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table2")
+        struct.pack_into("<Q", seg, at + 16, 13)
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertTrue(img.findings)
+
+    def test_implausible_table_entry_count(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table")
+        struct.pack_into("<I", seg, at + build.DESC, 0xFFFFFFFF)
+        at2 = Integrity.find_section(seg, "table2")
+        struct.pack_into("<I", seg, at2 + build.DESC, 0)
+        with self.assertRaises(ewf.EwfError):
+            ewf.EwfImage(self.write_segments([bytes(seg)]))
+
+    def test_section_size_beyond_file(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table")
+        struct.pack_into("<Q", seg, at + 16, 1 << 40)
+        img = self.open(self.write_segments([bytes(seg)]))
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+
+class Raw(TempDir):
+    def test_raw_image(self):
+        path = self.write("disk.dd", MEDIA)
+        img = self.open(path)
+        self.assertIsInstance(img, ewf.RawImage)
+        self.assertEqual(img.size, len(MEDIA))
+        self.assertEqual(img.read_at(1000, 50), MEDIA[1000:1050])
+        self.assertEqual(img.read_at(len(MEDIA) - 5, 50), MEDIA[-5:])
+        self.assertEqual(img.read_at(len(MEDIA), 1), b"")
+        img.seek(-3, io.SEEK_END)
+        self.assertEqual(img.read(), MEDIA[-3:])
+        got = img.verify()
+        self.assertEqual(got["computed_md5"], hashlib.md5(MEDIA).hexdigest())
+        self.assertIsNone(got["md5_match"])
+        self.assertEqual(img.info()["format"], "Raw / dd")
+
+    def test_empty_raw_image(self):
+        img = self.open(self.write("empty.img", b""))
+        self.assertEqual(img.size, 0)
+        self.assertEqual(img.read_at(0, 10), b"")
+
+    # Engine bug: engine/ewf.py:538 open_image hands .001 to RawImage, which
+    # opens that one file only; README promises split raw sets.
+    @unittest.expectedFailure
+    def test_split_raw_set(self):
+        for i, piece in enumerate(build.split_raw(MEDIA, 3000)):
+            self.write("split.%03d" % (i + 1), piece)
+        img = self.open(os.path.join(self.dir, "split.001"))
+        self.assertEqual(img.size, len(MEDIA))
+        self.assertEqual(img.read_at(2990, 20), MEDIA[2990:3010])
+
+
+class OffsetReaderTests(unittest.TestCase):
+    class Mem(object):
+        bytes_per_sector = 4096
+
+        def read_at(self, off, n):
+            return MEDIA[off:off + n] if off >= 0 else b""
+
+    def setUp(self):
+        self.r = ewf.OffsetReader(self.Mem(), 1000, 2000, "p1")
+
+    def test_window(self):
+        self.assertEqual(self.r.bytes_per_sector, 4096)
+        self.assertEqual(self.r.read_at(0, 10), MEDIA[1000:1010])
+        self.assertEqual(self.r.read_at(1990, 100), MEDIA[2990:3000])
+        self.assertEqual(self.r.read_at(2000, 1), b"")
+
+    def test_negative_and_empty(self):
+        self.assertEqual(self.r.read_at(-10, 20), b"")
+        self.assertEqual(self.r.read_at(10, 0), b"")
+
+    def test_read_and_seek(self):
+        self.r.seek(-4, io.SEEK_END)
+        self.assertEqual(self.r.read(), MEDIA[2996:3000])
+        self.r.seek(0)
+        self.assertEqual(len(self.r.read()), 2000)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_fs_ext4.py b/tests/test_fs_ext4.py
new file mode 100644
index 0000000..c3871dd
--- /dev/null
+++ b/tests/test_fs_ext4.py
@@ -0,0 +1,333 @@
+"""Unit tests for the ext2/3/4 reader (engine.fs.ext4) and jbd2 journal
+(engine.fs.jbd2), fed synthetic images from imagebuild_ext4."""
+
+import os
+import shutil
+import sys
+import tempfile
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import imagebuild_ext4 as build                                   # noqa: E402
+from engine.ewf import OffsetReader, open_image, RawImage         # noqa: E402
+from engine.fs import ext4                                        # noqa: E402
+from engine.fs.ntfs import open_fs                                # noqa: E402
+
+
+class MemImage(object):
+    """The read_at/size surface an image object offers, over bytes."""
+
+    bytes_per_sector = 512
+
+    def __init__(self, data, read_budget=None):
+        self.data = data
+        self.size = len(data)
+        self.reads = 0
+        self.read_budget = read_budget
+
+    def read_at(self, offset, length):
+        self.reads += 1
+        if self.read_budget is not None and self.reads > self.read_budget:
+            raise RuntimeError("read budget exhausted (runaway traversal)")
+        if offset < 0 or offset >= self.size:
+            return b""
+        return self.data[offset:offset + length]
+
+
+def mount(data, offset=0, **kw):
+    """Open a filesystem the way the server does: OffsetReader -> open_fs."""
+    img = MemImage(data, **kw)
+    return open_fs(OffsetReader(img, offset, img.size - offset))
+
+
+class Ext4Fixture(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.image = build.build_ext4()
+
+    def setUp(self):
+        self.fs = mount(self.image)
+        self.root = {e["name"]: e for e in self.fs.listdir(2, "/")}
+
+
+class Superblock(Ext4Fixture):
+    def test_open_fs_detects_ext4(self):
+        self.assertIsInstance(self.fs, ext4.Ext4FS)
+        self.assertEqual(self.fs.name, "ext4")
+
+    def test_info_reports_superblock_fields(self):
+        info = self.fs.info()
+        self.assertEqual(info["type"], "ext4")
+        self.assertEqual(info["label"], "strata-test")
+        self.assertEqual(info["uuid"], build.UUID.hex())
+        self.assertEqual(info["block_size"], 1024)
+        self.assertEqual(info["blocks"], build.BLOCKS_COUNT)
+        self.assertEqual(info["inodes"], build.INODES_PER_GROUP)
+        self.assertEqual(info["inode_size"], 256)
+        self.assertEqual(info["groups"], 1)
+        self.assertEqual(info["first_inode"], 11)
+        self.assertEqual(info["last_mounted"], "/mnt")
+        self.assertTrue(info["clean"])
+        self.assertEqual(info["journal_inode"], 8)
+        for feat in ("extents", "inline_data", "filetype", "has_journal"):
+            self.assertIn(feat, info["features"])
+
+    def test_ext2_without_extents_or_journal(self):
+        fs = mount(build.build_ext2_legacy())
+        self.assertEqual(fs.name, "ext2")
+        entries = fs.listdir(2)
+        self.assertEqual([e["name"] for e in entries], ["hello.txt"])
+        self.assertEqual(fs.read_file(entries[0]), b"hello from ext2\n")
+        self.assertFalse(fs.journal_info()["present"])
+
+    def test_through_open_image_on_disk(self):
+        tmp = tempfile.mkdtemp(prefix="strata-ext4-test-")
+        self.addCleanup(lambda: shutil.rmtree(tmp, ignore_errors=True))
+        path = os.path.join(tmp, "disk.dd")
+        pad = bytes(4096)                  # filesystem starts at 4096
+        with open(path, "wb") as fh:
+            fh.write(pad + self.image)
+        img = open_image(path)
+        self.addCleanup(img.close)
+        self.assertIsInstance(img, RawImage)
+        fs = open_fs(OffsetReader(img, len(pad), img.size - len(pad)))
+        entry = {e["name"]: e for e in fs.listdir(2)}["extent.txt"]
+        self.assertEqual(fs.read_file(entry), build.CONTENT["extent.txt"])
+
+
+class Inodes(Ext4Fixture):
+    def test_inode_fields(self):
+        ino = self.fs.inode(build.INO_EXTENT)
+        self.assertEqual(ino.size, 1500)
+        self.assertEqual(ino.uid, 1000)
+        self.assertEqual(ino.links, 1)
+        self.assertTrue(ino.uses_extents)
+        self.assertFalse(ino.deleted)
+        self.assertEqual(ino.mtime, "2023-11-14T22:13:20Z")
+        self.assertEqual(ino.crtime, "2023-11-14T22:13:20Z")
+        self.assertEqual(ino.table_offset, build.Ext4Image.inode_offset(12))
+
+    def test_out_of_range_inode_is_none(self):
+        self.assertIsNone(self.fs.inode(0))
+        self.assertIsNone(self.fs.inode(build.INODES_PER_GROUP + 1))
+
+
+class Directories(Ext4Fixture):
+    def test_root_listing(self):
+        self.assertEqual(
+            sorted(self.root),
+            sorted(["extent.txt", "deep.bin", "legacy.txt", "inline.txt",
+                    "inline_long.txt", "link", "sub", "sparse.bin",
+                    "deleted.txt", "inlinedir"]))
+        self.assertNotIn(".", self.root)
+        self.assertNotIn("..", self.root)
+
+    def test_directories_sort_first(self):
+        names = [e["name"] for e in self.fs.listdir(2)]
+        dirs = [n for n in names if self.root[n]["is_dir"]]
+        self.assertEqual(names[:len(dirs)], sorted(dirs))
+
+    def test_entry_metadata(self):
+        e = self.root["extent.txt"]
+        self.assertEqual(e["path"], "/extent.txt")
+        self.assertEqual(e["inode"], build.INO_EXTENT)
+        self.assertEqual(e["size"], 1500)
+        self.assertEqual(e["mode"], "-rw-r--r--")
+        self.assertEqual(e["type"], "file")
+        self.assertEqual(e["id"], "ext:12")
+        self.assertFalse(e["deleted"])
+        self.assertFalse(e["system"])
+        self.assertTrue(self.root["sub"]["is_dir"])
+        self.assertEqual(self.root["sub"]["mode"], "drwxr-xr-x")
+        self.assertEqual(self.root["link"]["type"], "symlink")
+
+    def test_subdirectory(self):
+        entries = self.fs.listdir(build.INO_SUB, "/sub")
+        self.assertEqual([e["name"] for e in entries], ["nested.txt"])
+        self.assertEqual(entries[0]["path"], "/sub/nested.txt")
+        self.assertEqual(self.fs.read_file(entries[0]),
+                         build.CONTENT["sub/nested.txt"])
+
+    def test_listdir_of_a_file_is_empty(self):
+        self.assertEqual(self.fs.listdir(build.INO_EXTENT), [])
+
+    # Engine bug: engine/fs/ext4.py:311 _dir_entries parses an inline-data
+    # directory as ordinary dirents, ignoring its 4-byte parent-inode prefix.
+    @unittest.expectedFailure
+    def test_inline_directory(self):
+        entries = self.fs.listdir(build.INO_INLINEDIR, "/inlinedir")
+        self.assertEqual([(e["name"], e["inode"]) for e in entries],
+                         [("again.txt", build.INO_EXTENT)])
+
+
+class FileContent(Ext4Fixture):
+    def read(self, name):
+        return self.fs.read_file(self.root[name])
+
+    def test_extent_depth0(self):
+        self.assertEqual(self.read("extent.txt"), build.CONTENT["extent.txt"])
+        self.assertEqual(self.fs.stat(self.root["extent.txt"])["mapping"],
+                         "extent tree")
+
+    def test_extent_depth1(self):
+        self.assertEqual(self.read("deep.bin"), build.CONTENT["deep.bin"])
+        runs = self.fs.runs(self.fs.inode(build.INO_DEEP))
+        self.assertEqual([r["blocks"] for r in runs], [2, 1])
+        self.assertEqual(runs[1]["block"] - runs[0]["block"], 3)
+
+    def test_legacy_block_map_with_indirect_block(self):
+        self.assertEqual(self.read("legacy.txt"), build.CONTENT["legacy.txt"])
+        st = self.fs.stat(self.root["legacy.txt"])
+        self.assertEqual(st["mapping"], "indirect blocks")
+        self.assertEqual(sum(r["blocks"] for r in st["runs"]), 14)
+        self.assertEqual(st["slack"]["length"], 1024 - 100)
+
+    def test_inline_data_small(self):
+        self.assertEqual(self.read("inline.txt"), build.CONTENT["inline.txt"])
+        self.assertTrue(self.root["inline.txt"]["inline"])
+        st = self.fs.stat(self.root["inline.txt"])
+        self.assertEqual(st["mapping"], "inline")
+
+    # Engine bug: engine/fs/ext4.py:296 reads inline data past 60 bytes from
+    # raw[128:] (i_extra_isize...) instead of the "system.data" xattr.
+    @unittest.expectedFailure
+    def test_inline_data_spilling_into_xattr(self):
+        self.assertEqual(self.read("inline_long.txt"),
+                         build.CONTENT["inline_long.txt"])
+
+    def test_fast_symlink(self):
+        self.assertEqual(self.read("link"), build.LINK_TARGET)
+
+    def test_read_range(self):
+        data = build.CONTENT["legacy.txt"]
+        self.assertEqual(
+            self.fs.read_range(self.root["legacy.txt"], 12000, 2000),
+            data[12000:14000])
+        self.assertEqual(
+            self.fs.read_range(self.root["inline.txt"], 6, 4),
+            build.CONTENT["inline.txt"][6:10])
+
+    def test_max_bytes(self):
+        self.assertEqual(self.fs.read_file(self.root["deep.bin"], 10),
+                         build.CONTENT["deep.bin"][:10])
+
+    def test_named_stream_unsupported(self):
+        with self.assertRaises(ValueError):
+            self.fs.read_file(self.root["extent.txt"], stream="ads")
+
+    # Engine bug: engine/fs/ext4.py:261-271 drops ee_block (logical start),
+    # so holes between extents vanish and later extents shift down.
+    @unittest.expectedFailure
+    def test_sparse_extent_hole_reads_as_zeros(self):
+        self.assertEqual(self.read("sparse.bin"), build.CONTENT["sparse.bin"])
+
+
+class Journal(Ext4Fixture):
+    def test_journal_info(self):
+        info = self.fs.journal_info()
+        self.assertTrue(info["present"])
+        self.assertEqual(info["blocks"], build.JOURNAL_BLOCKS)
+        self.assertEqual(info["sequence"], build.JOURNAL_SEQUENCE)
+        self.assertEqual(info["uuid"], build.UUID.hex())
+        self.assertEqual(info["transactions"], 1)
+        self.assertEqual(info["committed"], 1)
+        self.assertEqual(info["blocks_journalled"], 1)
+        self.assertEqual(info["findings"], [])
+
+    def test_deleted_inode_is_flagged(self):
+        e = self.root["deleted.txt"]
+        self.assertTrue(e["deleted"])
+        self.assertEqual(e["deleted_at"], "2023-11-14T22:21:40Z")
+        self.assertEqual(e["size"], 0)
+
+    def test_superseded_inode_version_found(self):
+        versions = self.fs.journal.inode_versions(build.INO_DELETED)
+        self.assertEqual(len(versions), 1)
+        v = versions[0]
+        self.assertEqual(v["sequence"], build.JOURNAL_SEQUENCE)
+        self.assertTrue(v["committed"])
+        self.assertFalse(v["deleted"])
+        self.assertEqual(v["size"], len(build.CONTENT["deleted.txt"]))
+
+    def test_stat_reports_journal_recovery(self):
+        st = self.fs.stat(self.root["deleted.txt"])
+        rec = st["journal_recovery"]
+        self.assertEqual(rec["sequence"], build.JOURNAL_SEQUENCE)
+        self.assertTrue(rec["committed"])
+        self.assertEqual(st["recovered_size"],
+                         len(build.CONTENT["deleted.txt"]))
+        self.assertIn("journal", st["recovery"])
+
+    def test_read_file_returns_recovered_content(self):
+        self.assertEqual(self.fs.read_file(self.root["deleted.txt"]),
+                         build.CONTENT["deleted.txt"])
+
+    def test_no_recovery_for_inode_not_in_journal(self):
+        self.assertIsNone(self.fs.journal.recover(build.INO_EXTENT))
+
+
+class Robustness(unittest.TestCase):
+    def test_garbage_is_rejected(self):
+        with self.assertRaises(ValueError):
+            ext4.Ext4FS(MemImage(bytes(range(256)) * 16))
+
+    def test_empty_source(self):
+        with self.assertRaises(ValueError):
+            ext4.Ext4FS(MemImage(b""))
+
+    def test_zero_group_sizing_is_rejected(self):
+        data = bytearray(build.build_ext4())
+        data[1024 + 32:1024 + 36] = bytes(4)          # blocks_per_group
+        with self.assertRaises(ValueError):
+            ext4.Ext4FS(MemImage(bytes(data)))
+
+    def test_truncated_after_superblock(self):
+        fs = ext4.Ext4FS(MemImage(build.build_ext4()[:2048]))
+        self.assertEqual(fs.listdir(2), [])
+        self.assertIsNone(fs.inode(12))
+        self.assertFalse(fs.journal_info()["present"])
+
+    def test_truncated_inside_inode_table(self):
+        fs = ext4.Ext4FS(MemImage(build.build_ext4()[:7 * 1024]))
+        self.assertEqual(fs.listdir(2), [])
+
+    def test_corrupt_extent_magic_gives_no_runs(self):
+        data = bytearray(build.build_ext4())
+        off = build.Ext4Image.inode_offset(build.INO_EXTENT) + 40
+        data[off:off + 2] = b"\x00\x00"
+        fs = mount(bytes(data))
+        self.assertEqual(fs.runs(fs.inode(build.INO_EXTENT)), [])
+
+    def test_directory_with_zero_rec_len_terminates(self):
+        data = bytearray(build.build_ext4())
+        fs = mount(bytes(data))
+        root_block = fs.runs(fs.inode(2))[0]["block"]
+        data[root_block * 1024 + 4:root_block * 1024 + 6] = b"\x00\x00"
+        self.assertEqual(mount(bytes(data)).listdir(2), [])
+
+    # Engine bug: engine/fs/ext4.py:214-222 bounds extent-tree depth (8) but
+    # not fan-out or revisits; a self-referencing index node costs 84^7 reads.
+    @unittest.expectedFailure
+    def test_self_referencing_extent_index_is_bounded(self):
+        fs = mount(build.build_ext4_extent_loop(), read_budget=20000)
+        fs.runs(fs.inode(12))
+
+    def test_truncated_journal_is_reported_absent(self):
+        fs = mount(build.build_ext4_truncated_journal())
+        info = fs.journal_info()
+        self.assertFalse(info["present"])
+        self.assertTrue(info["findings"])
+        self.assertIn("extent.txt", [e["name"] for e in fs.listdir(2)])
+
+    # Engine bug: engine/fs/ext4.py:140-151 the _Absent journal stand-in has
+    # no read_recovered(), which read_file calls for deleted files (line 368).
+    @unittest.expectedFailure
+    def test_deleted_file_read_with_unreadable_journal(self):
+        fs = mount(build.build_ext4_truncated_journal())
+        entry = {e["name"]: e for e in fs.listdir(2)}["deleted.txt"]
+        self.assertEqual(fs.read_file(entry), b"")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_registry.py b/tests/test_registry.py
new file mode 100644
index 0000000..d865a44
--- /dev/null
+++ b/tests/test_registry.py
@@ -0,0 +1,369 @@
+"""Unit tests for the registry hive parser (engine.registry) and transaction
+log replay (engine.reglog), fed synthetic hives from imagebuild_registry."""
+
+import os
+import random
+import struct
+import sys
+import unittest
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+import imagebuild_registry as build                              # noqa: E402
+from engine import registry, reglog                              # noqa: E402
+
+
+class HiveFixture(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.data = build.build_hive()
+
+    def setUp(self):
+        self.hive = registry.open_hive(self.data, "SOFTWARE")
+        self.assertIsNotNone(self.hive)
+
+    def values(self, path="Software\\Strata"):
+        key = self.hive.open_path(path)
+        return {v["name"]: v for v in self.hive.values(key)}
+
+
+class BaseBlock(HiveFixture):
+    def test_info(self):
+        info = self.hive.info()
+        self.assertEqual(info["type"], "regf")
+        self.assertEqual(info["name"], "SOFTWARE")
+        self.assertEqual(info["embedded_name"], "\\??\\C:\\ROOT")
+        self.assertEqual(info["version"], "1.5")
+        self.assertEqual(info["sequence"], [1, 1])
+        self.assertFalse(info["dirty"])
+        self.assertEqual(info["modified"], "2022-06-18T04:26:40Z")
+        self.assertEqual(info["findings"], [])
+
+    def test_base_block_checksum(self):
+        stored = struct.unpack_from("<I", self.data, 508)[0]
+        self.assertEqual(reglog.base_checksum(self.data[:4096]), stored)
+
+    def test_base_block_checksum_edge_values(self):
+        self.assertEqual(reglog.base_checksum(bytes(512)), 1)
+        blk = bytearray(512)
+        struct.pack_into("<I", blk, 0, 0xFFFFFFFF)
+        self.assertEqual(reglog.base_checksum(bytes(blk)), 0xFFFFFFFE)
+
+    def test_dirty_hive_is_flagged(self):
+        h = registry.open_hive(build.build_hive(seq1=3, seq2=2))
+        self.assertTrue(h.dirty)
+        self.assertTrue(h.findings)
+
+    def test_classify_well_known(self):
+        self.assertEqual(
+            registry.classify("C:/Windows/System32/config/SOFTWARE")["label"],
+            "SOFTWARE")
+        self.assertIsNone(registry.classify("notes.txt"))
+
+
+class Keys(HiveFixture):
+    def test_root(self):
+        root = self.hive.root()
+        self.assertEqual(root["name"], "ROOT")
+        self.assertTrue(root["root"])
+        self.assertEqual(root["modified"], "2022-06-18T04:26:40Z")
+
+    def test_lh_subkey_list(self):
+        names = [k["name"] for k in self.hive.subkeys(self.hive.root())]
+        self.assertEqual(names, ["Software", "System", u"\u00dcn\u00efcode"])
+
+    def test_lf_subkey_list(self):
+        sw = self.hive.open_path("Software")
+        self.assertEqual([k["name"] for k in self.hive.subkeys(sw)],
+                         ["Strata"])
+
+    def test_ri_list_of_li_and_lf(self):
+        sysk = self.hive.open_path("\\System")
+        self.assertEqual([k["name"] for k in self.hive.subkeys(sysk)],
+                         ["Alpha", "Beta"])
+
+    def test_open_path_variants(self):
+        self.assertEqual(self.hive.open_path("software/STRATA")["name"],
+                         "Strata")
+        self.assertEqual(self.hive.open_path("\\")["name"], "ROOT")
+        self.assertIsNone(self.hive.open_path("Software\\Missing"))
+
+    def test_parent_pointer(self):
+        sw = self.hive.open_path("Software")
+        self.assertEqual(self.hive.open_path("Software\\Strata")["parent"],
+                         sw["offset"])
+
+
+class Values(HiveFixture):
+    def test_value_names(self):
+        self.assertEqual(sorted(self.values()),
+                         sorted(["(Default)", "Name", "Count", "Blob", "Tiny",
+                                 "Paths", "Big"]))
+
+    def test_reg_sz(self):
+        v = self.values()["Name"]
+        self.assertEqual(v["type"], "REG_SZ")
+        self.assertEqual(v["value"], "Strata")
+        self.assertFalse(v["resident"])
+        self.assertEqual(self.values()["(Default)"]["value"], "default value")
+
+    def test_reg_dword_resident(self):
+        v = self.values()["Count"]
+        self.assertEqual(v["type"], "REG_DWORD")
+        self.assertEqual(v["value"], 42)
+        self.assertTrue(v["resident"])
+        self.assertIsNone(v["data_offset"])
+
+    def test_reg_binary(self):
+        v = self.values()["Blob"]
+        self.assertEqual(v["type"], "REG_BINARY")
+        self.assertEqual(v["size"], 16)
+        self.assertEqual(self.hive.value_bytes(v["offset"]), bytes(range(16)))
+        self.assertEqual(v["value"].split()[:3], ["00", "01", "02"])
+
+    def test_resident_binary_shorter_than_four_bytes(self):
+        v = self.values()["Tiny"]
+        self.assertTrue(v["resident"])
+        self.assertEqual(self.hive.value_bytes(v["offset"]), b"\x01\x02\x03")
+
+    def test_reg_multi_sz(self):
+        v = self.values()["Paths"]
+        self.assertEqual(v["type"], "REG_MULTI_SZ")
+        self.assertEqual(v["value"], ["C:\\a", "D:\\b"])
+
+    def test_big_data(self):
+        v = self.values()["Big"]
+        self.assertEqual(v["size"], len(build.BIG_BLOB))
+        self.assertTrue(v["truncated"])
+        self.assertIsNone(v["value"])
+        self.assertEqual(self.hive.value_bytes(v["offset"]), build.BIG_BLOB)
+
+    def test_decode_other_types(self):
+        self.assertEqual(registry.Hive.decode(5, b"\x00\x00\x01\x00"), 256)
+        self.assertEqual(registry.Hive.decode(11, struct.pack("<Q", 2 ** 40)),
+                         2 ** 40)
+        self.assertEqual(registry.Hive.decode(2, "%x%\x00".encode("utf-16-le")),
+                         "%x%")
+
+
+class DeletedCells(HiveFixture):
+    def test_carve_recovers_deleted_key_and_value(self):
+        got = self.hive.carve_deleted()
+        self.assertEqual([k["name"] for k in got["keys"]], ["Removed"])
+        self.assertTrue(got["keys"][0]["deleted"])
+        self.assertEqual(got["keys"][0]["parent"],
+                         self.hive.open_path("Software")["offset"])
+        self.assertEqual([(v["name"], v["value"]) for v in got["values"]],
+                         [("OldValue", "gone")])
+        self.assertTrue(got["values"][0]["deleted"])
+
+    def test_deleted_records_not_in_live_tree(self):
+        self.assertIsNone(self.hive.open_path("Software\\Removed"))
+
+
+class Marvin32(unittest.TestCase):
+    # Vectors from the .NET runtime's Marvin tests, seed 0x004FB61A001BDBCC.
+    SEED = 0x004FB61A001BDBCC
+    VECTORS = [
+        (b"\xaf", 0x48E73FC77D75DDC1),
+        (b"\xe7\x0f", 0xB5F6E1FC485DBFF8),
+        (b"\x37\xf4\x95", 0xF0B07C789B8CF7E8),
+        (b"\x15\x3f\xb7\x98\x26", 0xE6C08C6DA2AFA997),
+        (b"\x09\x32\xe6\x24\x6c\x47", 0x6F04BF1A5EA24060),
+        (b"\xab\x42\x7e\xa8\xd1\x0f\xc7", 0xE11847E4F0678C41),
+    ]
+
+    def test_known_vectors(self):
+        for data, want in self.VECTORS:
+            self.assertEqual(reglog.marvin32(data, self.SEED), want, data)
+
+    def test_builder_agrees_with_engine(self):
+        blob = bytes(range(256)) * 3
+        for n in (0, 1, 2, 3, 4, 511, 512):
+            self.assertEqual(build.marvin32(blob[:n]), reglog.marvin32(blob[:n]))
+
+
+class TransactionLog(unittest.TestCase):
+    def setUp(self):
+        self.stale, self.log, self.fresh_bins = build.build_dirty_pair()
+
+    def test_parse_log(self):
+        got = reglog.parse_log(self.log)
+        self.assertEqual(got["findings"], [])
+        self.assertEqual(got["base_sequence"], 10)
+        self.assertEqual(len(got["entries"]), 1)
+        entry = got["entries"][0]
+        self.assertEqual(entry["sequence"], 10)
+        self.assertEqual(entry["hbins_size"], len(self.fresh_bins))
+        self.assertEqual(entry["pages"][0][:2], (0, len(self.fresh_bins)))
+
+    def test_hive_sequences(self):
+        self.assertEqual(reglog.hive_sequences(self.stale),
+                         (11, 10, len(self.fresh_bins)))
+        self.assertIsNone(reglog.hive_sequences(b"regf"))
+
+    def test_replay_applies_log(self):
+        before = registry.open_hive(self.stale)
+        self.assertEqual(
+            {v["name"]: v["value"] for v in
+             before.values(before.open_path("Software\\Strata"))}["Name"],
+            "Strata")
+        new, report = reglog.recover(self.stale, [self.log])
+        self.assertTrue(report["dirty"])
+        self.assertTrue(report["recovered"])
+        self.assertEqual(report["applied"], [10])
+        self.assertEqual(report["pages_written"], 1)
+        self.assertEqual(report["bytes_written"], len(self.fresh_bins))
+        self.assertIn("Recovered", reglog.summarise(report))
+
+        self.assertEqual(new[4096:], self.fresh_bins)
+        self.assertEqual(struct.unpack_from("<II", new, 4), (10, 10))
+        self.assertEqual(struct.unpack_from("<I", new, 508)[0],
+                         reglog.base_checksum(new[:508]))
+        after = registry.open_hive(new)
+        self.assertFalse(after.dirty)
+        self.assertEqual(
+            {v["name"]: v["value"] for v in
+             after.values(after.open_path("Software\\Strata"))}["Name"],
+            "Replay")
+
+    def test_clean_hive_needs_no_replay(self):
+        new, report = reglog.recover(build.build_hive(), [self.log])
+        self.assertIsNone(new)
+        self.assertFalse(report["dirty"])
+        self.assertEqual(reglog.summarise(report),
+                         "Cleanly unmounted; no replay needed.")
+
+    def test_dirty_without_logs(self):
+        new, report = reglog.recover(self.stale, [])
+        self.assertIsNone(new)
+        self.assertFalse(report["recovered"])
+        self.assertTrue(report["findings"])
+        self.assertIn("not recoverable", reglog.summarise(report))
+
+    def test_corrupt_entry_data_is_refused(self):
+        bad = bytearray(self.log)
+        bad[512 + 40 + 8 + 100] ^= 0xFF
+        new, report = reglog.recover(self.stale, [bytes(bad)])
+        self.assertIsNone(new)
+        self.assertTrue(any("data hash" in f for f in report["findings"]))
+
+    def test_corrupt_entry_header_is_refused(self):
+        bad = bytearray(self.log)
+        bad[512 + 8] ^= 0x01                       # flags field
+        got = reglog.parse_log(bytes(bad))
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(any("header hash" in f for f in got["findings"]))
+
+    def test_sequence_gap_is_not_replayed(self):
+        entry = build.log_entry(12, len(self.fresh_bins),
+                                [(0, self.fresh_bins)])
+        new, report = reglog.recover(self.stale, [build.build_log([entry])])
+        self.assertIsNone(new)
+        self.assertEqual(report["log_sequences"], [12])
+        self.assertTrue(any("overwritten" in f for f in report["findings"]))
+
+    def test_entries_beyond_gap_are_reported(self):
+        e10 = build.log_entry(10, len(self.fresh_bins), [(0, self.fresh_bins)])
+        e12 = build.log_entry(12, len(self.fresh_bins), [(0, self.fresh_bins)])
+        new, report = reglog.recover(self.stale, [build.build_log([e10, e12])])
+        self.assertIsNotNone(new)
+        self.assertEqual(report["applied"], [10])
+        self.assertTrue(any("gap" in f for f in report["findings"]))
+
+    def test_implausible_entry_size(self):
+        bad = bytearray(self.log)
+        struct.pack_into("<I", bad, 516, 1000)
+        got = reglog.parse_log(bytes(bad))
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(any("implausible" in f for f in got["findings"]))
+
+    def test_truncated_log(self):
+        got = reglog.parse_log(self.log[:100])
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(got["findings"])
+        got = reglog.parse_log(self.log[:5000])
+        self.assertEqual(got["entries"], [])
+        self.assertTrue(got["findings"])
+
+    def test_not_a_hive(self):
+        new, report = reglog.recover(b"garbage" * 1000, [self.log])
+        self.assertIsNone(new)
+        self.assertTrue(report["findings"])
+
+
+class Robustness(unittest.TestCase):
+    def test_garbage_is_not_a_hive(self):
+        for data in (b"", b"garbage", bytes(8192), b"hbin" * 2048):
+            self.assertIsNone(registry.open_hive(data))
+
+    # Engine bug: engine/registry.py:47-54 unpacks base-block fields without
+    # a length check, so a "regf" file shorter than 48 bytes raises struct.error.
+    @unittest.expectedFailure
+    def test_truncated_base_block(self):
+        for n in (4, 20, 40):
+            try:
+                h = registry.open_hive(build.build_hive()[:n])
+            except struct.error as exc:
+                self.fail("open_hive raised on %d bytes: %s" % (n, exc))
+            if h is not None:
+                self.assertIsNone(h.root())
+
+    def test_base_block_only(self):
+        h = registry.open_hive(build.build_hive()[:4096])
+        self.assertIsNone(h.root())
+        self.assertEqual(h.carve_deleted(), {"keys": [], "values": []})
+
+    TRUNCATIONS = (4096 + 32, 4096 + 702, 4096 + 5000, 28672 - 100)
+
+    def test_truncated_hive_bins_tree_walk(self):
+        data = build.build_hive()
+        for cut in self.TRUNCATIONS:
+            h = registry.open_hive(data[:cut])
+            root = h.root()
+            if root:
+                for k in h.subkeys(root):
+                    h.values(k)
+
+    # Engine bug: engine/registry.py:268-276 carve_deleted clamps a bin to
+    # 4096 bytes but not to the end of the data, so a hive cut short (e.g.
+    # read with the MAX_HIVE cap) raises struct.error reading a cell size.
+    @unittest.expectedFailure
+    def test_truncated_hive_bins_carve(self):
+        data = build.build_hive()
+        for cut in self.TRUNCATIONS:
+            try:
+                registry.open_hive(data[:cut]).carve_deleted()
+            except struct.error as exc:
+                self.fail("carve_deleted raised at cut %d: %s" % (cut, exc))
+
+    def test_self_referencing_ri_list_terminates(self):
+        data = bytearray(build.build_hive())
+        h = registry.open_hive(bytes(data))
+        sysk = h.open_path("System")
+        ri = 4096 + sysk["subkeys"]
+        struct.pack_into("<I", data, ri + 4 + 4, sysk["subkeys"])
+        h = registry.open_hive(bytes(data))
+        names = [k["name"] for k in h.subkeys(h.open_path("System"))]
+        self.assertEqual(names, ["Beta"])
+
+    def test_random_corruption_never_raises(self):
+        data = build.build_hive()
+        rnd = random.Random(20260916)
+        for _ in range(300):
+            m = bytearray(data)
+            for _ in range(rnd.randint(1, 16)):
+                m[rnd.randrange(4096, 4096 + 2048)] = rnd.randrange(256)
+            h = registry.open_hive(bytes(m))
+            stack, seen = [h.root()], 0
+            while stack and seen < 64:
+                k = stack.pop()
+                seen += 1
+                if k:
+                    h.values(k)
+                    stack.extend(h.subkeys(k))
+            h.carve_deleted()
+
+
+if __name__ == "__main__":
+    unittest.main()

From b54261963064271eac49043cd028b20dd10b61dd Mon Sep 17 00:00:00 2001
From: deadp <deadp@users.noreply.github.com>
Date: Wed, 16 Sep 2026 21:51:53 +1200
Subject: [PATCH 4/7] Add parser tests for FAT, exFAT and NTFS

Volumes are built in code (FAT32 sparsely, as it needs ~34 MB) and opened
the way the server opens them. Seven engine bugs are recorded as expected
failures: scrambled deleted long names and wrong slack for deleted files
on FAT; an unbounded contiguous run list, truncated contiguous directories
and unconverted UTC offsets on exFAT; invalid MFT records served from the
cache, and a record count that ignores volume size when $MFT is unreadable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/imagebuild_fat.py  | 687 +++++++++++++++++++++++++++++++++++++++
 tests/imagebuild_ntfs.py | 545 +++++++++++++++++++++++++++++++
 tests/test_fs_exfat.py   | 322 ++++++++++++++++++
 tests/test_fs_fat.py     | 411 +++++++++++++++++++++++
 tests/test_fs_ntfs.py    | 413 +++++++++++++++++++++++
 5 files changed, 2378 insertions(+)
 create mode 100644 tests/imagebuild_fat.py
 create mode 100644 tests/imagebuild_ntfs.py
 create mode 100644 tests/test_fs_exfat.py
 create mode 100644 tests/test_fs_fat.py
 create mode 100644 tests/test_fs_ntfs.py

diff --git a/tests/imagebuild_fat.py b/tests/imagebuild_fat.py
new file mode 100644
index 0000000..40bf212
--- /dev/null
+++ b/tests/imagebuild_fat.py
@@ -0,0 +1,687 @@
+"""Synthetic FAT12/16/32 and exFAT volume builders for the parser tests.
+
+Everything here returns ``bytes``: a complete, minimal but valid volume (or a
+disk wrapping one) built in code, because the repository carries no binary
+fixtures. The layouts are fixed and described below so a test can assert
+exact offsets, and so the same images can later seed a fuzzer.
+
+Nothing in this module imports the engine; it only encodes the on-disk
+formats (Microsoft FAT specification 1.03 and the exFAT file system
+specification) so a builder mistake cannot be masked by an engine mistake.
+"""
+
+import datetime
+import struct
+
+SECTOR = 512
+
+# --------------------------------------------------------------------------
+# Shared helpers
+# --------------------------------------------------------------------------
+
+
+def pattern(length, seed):
+    """Deterministic, non-repeating-looking filler so misplaced reads show."""
+    return bytes(((i * 31 + seed * 7 + (i >> 8)) & 0xFF) for i in range(length))
+
+
+def fill(length, text):
+    """Repeat ``text`` to exactly ``length`` bytes (used to paint slack)."""
+    reps = length // len(text) + 1
+    return (text * reps)[:length]
+
+
+def wrap_mbr(volume, start_sector=63, ptype=0x06, bootable=False):
+    """A disk: classic MBR at sector 0, one primary partition holding ``volume``.
+
+    Layout: sector 0 = MBR (partition entry 1 at 0x1BE, signature 55AA);
+    sectors 1..start_sector-1 zero; ``volume`` from ``start_sector``; the
+    disk is padded to a whole number of sectors.
+    """
+    count = (len(volume) + SECTOR - 1) // SECTOR
+    mbr = bytearray(SECTOR)
+    entry = struct.pack("<B3sB3sII", 0x80 if bootable else 0x00,
+                        b"\xFE\xFF\xFF", ptype, b"\xFE\xFF\xFF",
+                        start_sector, count)
+    mbr[446:462] = entry
+    mbr[510:512] = b"\x55\xAA"
+    disk = bytearray(start_sector * SECTOR + count * SECTOR)
+    disk[0:SECTOR] = mbr
+    disk[start_sector * SECTOR:start_sector * SECTOR + len(volume)] = volume
+    return bytes(disk)
+
+
+# --------------------------------------------------------------------------
+# FAT12 / FAT16 / FAT32
+# --------------------------------------------------------------------------
+
+FAT_CLUSTER = 512            # every FAT geometry below uses 1 sector/cluster
+
+# bits -> (total_sectors, reserved, num_fats, fat_size_sectors, root_entries)
+# Cluster counts land squarely inside each width's range (spec section 3.5):
+#   FAT12: 2847 (< 4085)   FAT16: 8095 (< 65525)   FAT32: 66000 (>= 65525)
+FAT_GEOMETRY = {
+    12: (2880, 1, 2, 9, 224),
+    16: (8192, 1, 2, 32, 512),
+    32: (67064, 32, 2, 516, 0),
+}
+
+HELLO_TEXT = b"Hello, FAT!\n"
+LONG_NAME = "Long file name.txt"
+LONG_SHORT = b"LONGFI~1TXT"
+LONG_SIZE = 2 * FAT_CLUSTER + 100
+LONG_CLUSTERS = (4, 5, 9)                        # fragmented chain
+NESTED_SIZE = 1000
+DELETED_SIZE = FAT_CLUSTER + 188
+DELETED_LFN_NAME = "Removed document.txt"
+GONE_NAME = "Gone file.txt"                     # exactly 13 chars: one LFN part
+GONE_TEXT = b"deleted, single-part LFN\n\x00\x00\x00\x00\x00"
+SLACK_MARK = b"SLACK!"
+
+# Where each item lives. Cluster numbers are identical across the three
+# widths so the tests can share expectations.
+FAT_LAYOUT = {
+    "root_cluster_fat32": 2,
+    "hello": {"cluster": 3, "size": len(HELLO_TEXT)},
+    "long": {"clusters": LONG_CLUSTERS, "size": LONG_SIZE},
+    "subdir": {"clusters": (6, 25)},             # two-cluster directory chain
+    "nested": {"clusters": (26, 27), "size": NESTED_SIZE},
+    "deleted": {"cluster": 12, "size": DELETED_SIZE},   # FAT entries freed
+    "deleted_lfn": {"cluster": 15, "size": 50},
+    "cycle": {"clusters": (17, 18), "size": 5000},      # 17 -> 18 -> 17
+    "gone": {"cluster": 20, "size": 30},
+    "subdir_fillers": 14,
+}
+
+
+def long_content():
+    return pattern(LONG_SIZE, 1)
+
+
+def nested_content():
+    return pattern(NESTED_SIZE, 2)
+
+
+def deleted_content():
+    return pattern(DELETED_SIZE, 3)
+
+
+def deleted_lfn_content():
+    return pattern(50, 4)
+
+
+def dos_datetime(dt):
+    """(date, time) as packed by FAT: 7-bit year-1980, 4 month, 5 day /
+    5 hour, 6 minute, 5 two-second."""
+    date = ((dt.year - 1980) << 9) | (dt.month << 5) | dt.day
+    time_ = (dt.hour << 11) | (dt.minute << 5) | (dt.second // 2)
+    return date, time_
+
+
+HELLO_CREATED = datetime.datetime(2024, 3, 15, 10, 20, 30)    # + 1.50 s
+HELLO_MODIFIED = datetime.datetime(2024, 3, 15, 13, 45, 30)
+HELLO_ACCESSED = datetime.date(2024, 3, 16)
+
+
+def lfn_checksum(short11):
+    s = 0
+    for c in short11:
+        s = (((s & 1) << 7) + (s >> 1) + c) & 0xFF
+    return s
+
+
+def lfn_entries(name, short11, deleted=False):
+    """VFAT long-name entries in on-disk order (highest sequence first)."""
+    units = name.encode("utf-16-le")
+    chars = [units[i:i + 2] for i in range(0, len(units), 2)]
+    parts = [chars[i:i + 13] for i in range(0, len(chars), 13)]
+    last = parts[-1]
+    if len(last) < 13:
+        last.append(b"\x00\x00")
+        while len(last) < 13:
+            last.append(b"\xFF\xFF")
+    csum = lfn_checksum(short11)
+    out = []
+    for seq, part in enumerate(parts, 1):
+        raw = b"".join(part)
+        e = bytearray(32)
+        e[0] = seq | (0x40 if seq == len(parts) else 0)
+        e[1:11] = raw[0:10]
+        e[11] = 0x0F
+        e[13] = csum
+        e[14:26] = raw[10:22]
+        e[28:32] = raw[22:26]
+        if deleted:
+            e[0] = 0xE5
+        out.append(bytes(e))
+    return list(reversed(out))
+
+
+def short_entry(name11, attr, cluster, size, created=None, modified=None,
+                accessed=None, tenths=0):
+    e = bytearray(32)
+    e[0:11] = name11
+    e[11] = attr
+    if created is not None:
+        d, t = dos_datetime(created)
+        e[13] = tenths
+        struct.pack_into("<HH", e, 14, t, d)
+    if accessed is not None:
+        struct.pack_into("<H", e, 18, ((accessed.year - 1980) << 9)
+                         | (accessed.month << 5) | accessed.day)
+    struct.pack_into("<H", e, 20, (cluster >> 16) & 0xFFFF)
+    if modified is not None:
+        d, t = dos_datetime(modified)
+        struct.pack_into("<HH", e, 22, t, d)
+    struct.pack_into("<H", e, 26, cluster & 0xFFFF)
+    struct.pack_into("<I", e, 28, size)
+    return bytes(e)
+
+
+def _fat_set(fat, bits, n, value):
+    if bits == 12:
+        i = n + n // 2
+        value &= 0x0FFF
+        if n & 1:
+            fat[i] = (fat[i] & 0x0F) | ((value << 4) & 0xF0)
+            fat[i + 1] = (value >> 4) & 0xFF
+        else:
+            fat[i] = value & 0xFF
+            fat[i + 1] = (fat[i + 1] & 0xF0) | (value >> 8)
+    elif bits == 16:
+        struct.pack_into("<H", fat, n * 2, value & 0xFFFF)
+    else:
+        struct.pack_into("<I", fat, n * 4, value & 0x0FFFFFFF)
+
+
+class SparseImage:
+    """Write-only image of a fixed size that records only what is written,
+    so a FAT32 volume (which needs >= 65525 clusters, ~34 MB) costs about
+    the size of its FATs in memory. ``extents()`` lists (offset, bytes);
+    ``tobytes()`` materialises the whole image."""
+
+    def __init__(self, size):
+        self.size = size
+        self.chunks = []
+
+    def __setitem__(self, key, data):
+        start = key.start or 0
+        assert 0 <= start and start + len(data) <= self.size
+        self.chunks.append((start, bytes(data)))
+
+    def extents(self):
+        return list(self.chunks)
+
+    def tobytes(self):
+        out = bytearray(self.size)
+        for off, data in self.chunks:
+            out[off:off + len(data)] = data
+        return bytes(out)
+
+
+def write_sparse(path, size, extents):
+    """Write ``extents`` to ``path`` as a (filesystem-sparse where supported)
+    file of exactly ``size`` bytes."""
+    with open(path, "wb") as fh:
+        for off, data in extents:
+            fh.seek(off)
+            fh.write(data)
+        fh.truncate(size)
+
+
+def build_fat_extents(bits=16, label=b"STRATATEST "):
+    """``build_fat`` as (size, [(offset, bytes), ...]) without allocating
+    the whole volume. Later extents overwrite earlier ones."""
+    img = _build_fat(bits, label)
+    return img.size, img.extents()
+
+
+def build_fat(bits=16, label=b"STRATATEST "):
+    """The volume from ``_build_fat`` as bytes (FAT32 is ~34 MB; prefer
+    ``build_fat_extents`` for it)."""
+    return _build_fat(bits, label).tobytes()
+
+
+def _build_fat(bits=16, label=b"STRATATEST "):
+    """A FAT12, FAT16 or FAT32 volume (512-byte sectors, 1 sector/cluster).
+
+    Geometry per width is in ``FAT_GEOMETRY``; both FAT copies are written
+    identically. The first data sector holds cluster 2.
+
+    Root directory (fixed region on FAT12/16, cluster 2 on FAT32):
+      * volume label entry ``label`` (attr 0x08)
+      * ``HELLO.TXT``   12 bytes in cluster 3; its slack is painted SLACK!;
+        created 2024-03-15 10:20:31.50 (tenths byte 150), modified
+        2024-03-15 13:45:30, accessed 2024-03-16
+      * ``Long file name.txt`` (2 LFN entries + ``LONGFI~1.TXT``),
+        1124 bytes over the fragmented chain 4 -> 5 -> 9
+      * ``SUBDIR``       directory, chain 6 -> 25. Cluster 6 holds ``.``,
+        ``..`` and 14 empty files ``FILE00.DAT``..``FILE13.DAT``; cluster 25
+        holds ``NESTED.BIN`` (1000 bytes, clusters 26 -> 27)
+      * deleted ``DELETED.TXT`` (0xE5, no LFN), 700 bytes written
+        contiguously to clusters 12-13, FAT entries freed; the 324 bytes
+        after it in cluster 13 are painted SLACK!
+      * deleted ``Removed document.txt`` (2 deleted LFN entries + short
+        entry), 50 bytes in cluster 15, FAT entry freed
+      * ``CYCLE.BIN``   declares 5000 bytes on a corrupt chain 17 -> 18 -> 17
+      * deleted ``Gone file.txt`` (one deleted LFN entry, 13 characters so
+        no terminator) + short ``GONEFI~1.TXT``, 30 bytes in cluster 20
+    """
+    total, reserved, nfats, fat_size, root_entries = FAT_GEOMETRY[bits]
+    img = SparseImage(total * SECTOR)
+
+    # Boot sector / BPB.
+    b = bytearray(SECTOR)
+    b[0:3] = b"\xEB\x3C\x90"
+    b[3:11] = b"MSWIN4.1"
+    struct.pack_into("<HBHBHHBH", b, 11, SECTOR, 1, reserved, nfats,
+                     root_entries, total if (total < 0x10000 and bits != 32)
+                     else 0, 0xF8, fat_size if bits != 32 else 0)
+    struct.pack_into("<HHI", b, 24, 63, 255, 0)
+    struct.pack_into("<I", b, 32, 0 if (total < 0x10000 and bits != 32)
+                     else total)
+    if bits == 32:
+        struct.pack_into("<IHHIHH", b, 36, fat_size, 0, 0,
+                         FAT_LAYOUT["root_cluster_fat32"], 1, 6)
+        b[64] = 0x80
+        b[66] = 0x29
+        struct.pack_into("<I", b, 67, 0x32323232)
+        b[71:82] = label
+        b[82:90] = b"FAT32   "
+    else:
+        b[36] = 0x80
+        b[38] = 0x29
+        struct.pack_into("<I", b, 39, 0x16161616)
+        b[43:54] = label
+        b[54:62] = b"FAT12   " if bits == 12 else b"FAT16   "
+    b[510:512] = b"\x55\xAA"
+    img[0:SECTOR] = b
+    if bits == 32:
+        fsinfo = bytearray(SECTOR)
+        struct.pack_into("<I", fsinfo, 0, 0x41615252)
+        struct.pack_into("<I", fsinfo, 484, 0x61417272)
+        struct.pack_into("<II", fsinfo, 488, 0xFFFFFFFF, 0xFFFFFFFF)
+        fsinfo[510:512] = b"\x55\xAA"
+        img[SECTOR:2 * SECTOR] = fsinfo
+        img[6 * SECTOR:7 * SECTOR] = b
+
+    root_dir_sectors = (root_entries * 32 + SECTOR - 1) // SECTOR
+    root_region = (reserved + nfats * fat_size) * SECTOR
+    first_data = reserved + nfats * fat_size + root_dir_sectors
+
+    def coff(n):
+        return (first_data + (n - 2)) * SECTOR
+
+    def put(n, data):
+        img[coff(n):coff(n) + len(data)] = data
+
+    fat = bytearray(fat_size * SECTOR)
+    eoc = {12: 0xFFF, 16: 0xFFFF, 32: 0x0FFFFFFF}[bits]
+    _fat_set(fat, bits, 0, (eoc & ~0xFF) | 0xF8)
+    _fat_set(fat, bits, 1, eoc)
+
+    def link(chain):
+        for a, nxt in zip(chain, chain[1:]):
+            _fat_set(fat, bits, a, nxt)
+        _fat_set(fat, bits, chain[-1], eoc)
+
+    # HELLO.TXT
+    hello = FAT_LAYOUT["hello"]["cluster"]
+    link([hello])
+    put(hello, HELLO_TEXT + fill(FAT_CLUSTER - len(HELLO_TEXT), SLACK_MARK))
+
+    # Long file name.txt, fragmented
+    link(list(LONG_CLUSTERS))
+    data = long_content()
+    for k, c in enumerate(LONG_CLUSTERS):
+        put(c, data[k * FAT_CLUSTER:(k + 1) * FAT_CLUSTER])
+
+    # SUBDIR and its contents
+    sub1, sub2 = FAT_LAYOUT["subdir"]["clusters"]
+    link([sub1, sub2])
+    dot = short_entry(b".          ", 0x10, sub1, 0)
+    dotdot = short_entry(b"..         ", 0x10, 0, 0)
+    fillers = [short_entry(("FILE%02d  DAT" % k).encode(), 0x20, 0, 0)
+               for k in range(FAT_LAYOUT["subdir_fillers"])]
+    put(sub1, dot + dotdot + b"".join(fillers))
+    n1, n2 = FAT_LAYOUT["nested"]["clusters"]
+    link([n1, n2])
+    put(sub2, short_entry(b"NESTED  BIN", 0x20, n1, NESTED_SIZE))
+    ndata = nested_content()
+    put(n1, ndata[:FAT_CLUSTER])
+    put(n2, ndata[FAT_CLUSTER:])
+
+    # Deleted, no LFN, contiguous 12-13, FAT freed (left zero)
+    dc = FAT_LAYOUT["deleted"]["cluster"]
+    ddata = deleted_content()
+    put(dc, ddata[:FAT_CLUSTER])
+    put(dc + 1, ddata[FAT_CLUSTER:]
+        + fill(2 * FAT_CLUSTER - DELETED_SIZE, SLACK_MARK))
+
+    # Deleted with a two-part LFN
+    lc = FAT_LAYOUT["deleted_lfn"]["cluster"]
+    put(lc, deleted_lfn_content())
+
+    # Corrupt cyclic chain
+    c1, c2 = FAT_LAYOUT["cycle"]["clusters"]
+    _fat_set(fat, bits, c1, c2)
+    _fat_set(fat, bits, c2, c1)
+    put(c1, b"A" * FAT_CLUSTER)
+    put(c2, b"B" * FAT_CLUSTER)
+
+    root = bytearray()
+    root += short_entry(label, 0x08, 0, 0)
+    root += short_entry(b"HELLO   TXT", 0x20, hello, len(HELLO_TEXT),
+                        created=HELLO_CREATED, modified=HELLO_MODIFIED,
+                        accessed=HELLO_ACCESSED, tenths=150)
+    for e in lfn_entries(LONG_NAME, LONG_SHORT):
+        root += e
+    root += short_entry(LONG_SHORT, 0x20, LONG_CLUSTERS[0], LONG_SIZE)
+    root += short_entry(b"SUBDIR     ", 0x10, sub1, 0)
+    root += short_entry(b"\xE5ELETED TXT", 0x20, dc, DELETED_SIZE)
+    removed_short = b"REMOVE~1TXT"
+    for e in lfn_entries(DELETED_LFN_NAME, removed_short, deleted=True):
+        root += e
+    root += short_entry(b"\xE5" + removed_short[1:], 0x20, lc, 50)
+    root += short_entry(b"CYCLE   BIN", 0x20, c1, 5000)
+    gc = FAT_LAYOUT["gone"]["cluster"]
+    put(gc, GONE_TEXT)
+    for e in lfn_entries(GONE_NAME, b"GONEFI~1TXT", deleted=True):
+        root += e
+    root += short_entry(b"\xE5ONEFI~1TXT", 0x20, gc, len(GONE_TEXT))
+
+    if bits == 32:
+        rc = FAT_LAYOUT["root_cluster_fat32"]
+        link([rc])
+        assert len(root) <= FAT_CLUSTER
+        put(rc, bytes(root))
+    else:
+        assert len(root) <= root_entries * 32
+        img[root_region:root_region + len(root)] = root
+
+    for k in range(nfats):
+        at = (reserved + k * fat_size) * SECTOR
+        img[at:at + len(fat)] = fat
+    return img
+
+
+# --------------------------------------------------------------------------
+# exFAT
+# --------------------------------------------------------------------------
+
+EXFAT_SECTOR_SHIFT = 9       # 512-byte sectors
+EXFAT_CLUSTER_SHIFT = 1      # 2 sectors per cluster
+EXFAT_CLUSTER = 1 << (EXFAT_SECTOR_SHIFT + EXFAT_CLUSTER_SHIFT)   # 1024
+EXFAT_FAT_OFFSET = 24        # sectors (after main + backup boot regions)
+EXFAT_FAT_LENGTH = 1
+EXFAT_HEAP_OFFSET = 32
+EXFAT_CLUSTERS = 64
+EXFAT_SERIAL = 0x1234ABCD
+EXFAT_LABEL = "Strata"
+
+EXFAT_LAYOUT = {
+    "bitmap": 2, "upcase": 3, "root": (4, 15),
+    "hello": {"cluster": 6, "size": 13},                 # NoFatChain
+    "fragmented": {"clusters": (7, 9, 8), "size": 2500},  # FAT chain
+    "contiguous": {"cluster": 10, "count": 3, "size": 3000},  # NoFatChain
+    "deleted": {"cluster": 13, "size": 100},
+    "timezone": {"cluster": 14, "size": 5},
+    "longname": {"cluster": 16, "size": 10},
+    "subdir": {"cluster": 17, "count": 2},               # NoFatChain dir
+    "inner": {"cluster": 19, "size": 6},
+    "second": {"cluster": 20, "size": 7},
+    "tail": {"cluster": 21, "size": 4},
+}
+
+EXFAT_HELLO = b"Hello, exFAT\n"
+EXFAT_LONG_NAME = "Named with a rather long filename.txt"
+EXFAT_MODIFIED = datetime.datetime(2023, 11, 5, 8, 30, 44)
+EXFAT_TZ_LOCAL = datetime.datetime(2024, 6, 1, 10, 0, 0)
+EXFAT_TZ_OFFSET = 0x80 | 48          # valid, +12:00 (48 quarter hours)
+
+
+def exfat_fragmented_content():
+    return pattern(2500, 11)
+
+
+def exfat_contiguous_content():
+    return pattern(3000, 12)
+
+
+def exfat_timestamp(dt):
+    return (((dt.year - 1980) << 25) | (dt.month << 21) | (dt.day << 16)
+            | (dt.hour << 11) | (dt.minute << 5) | (dt.second // 2))
+
+
+def upcase_table():
+    """A short up-case table: 128 UTF-16 code points, a-z mapped to A-Z.
+    Code points past the end of a table map to themselves (spec 7.2)."""
+    return b"".join(struct.pack("<H", (c - 32) if 0x61 <= c <= 0x7A else c)
+                    for c in range(128))
+
+
+def _upcase_checksum(data):
+    c = 0
+    for byte in data:
+        c = (((c << 31) | (c >> 1)) + byte) & 0xFFFFFFFF
+    return c
+
+
+def _name_hash(name):
+    h = 0
+    for byte in name.upper().encode("utf-16-le"):
+        h = (((h << 15) | (h >> 1)) + byte) & 0xFFFF
+    return h
+
+
+def _set_checksum(entries):
+    blob = b"".join(entries)
+    c = 0
+    for i, byte in enumerate(blob):
+        if i in (2, 3):
+            continue
+        c = (((c << 15) | (c >> 1)) + byte) & 0xFFFF
+    first = bytearray(entries[0])
+    struct.pack_into("<H", first, 2, c)
+    return [bytes(first)] + list(entries[1:])
+
+
+def exfat_file_set(name, first_cluster, size, attrs=0x20, contiguous=False,
+                   deleted=False, modified=EXFAT_MODIFIED, created=None,
+                   created_tz=0, valid=None):
+    """File + Stream Extension + File Name entries for one file (32 bytes
+    each). ``deleted`` clears the InUse bit of every entry in the set."""
+    units = name.encode("utf-16-le")
+    names = [units[i:i + 30] for i in range(0, len(units), 30)]
+    f = bytearray(32)
+    f[0] = 0x85
+    f[1] = 1 + len(names)
+    struct.pack_into("<H", f, 4, attrs)
+    struct.pack_into("<III", f, 8,
+                     exfat_timestamp(created or modified),
+                     exfat_timestamp(modified), exfat_timestamp(modified))
+    f[22] = created_tz
+    s = bytearray(32)
+    s[0] = 0xC0
+    s[1] = 0x01 | (0x02 if contiguous else 0)
+    s[3] = len(name)
+    struct.pack_into("<H", s, 4, _name_hash(name))
+    struct.pack_into("<Q", s, 8, size if valid is None else valid)
+    struct.pack_into("<IQ", s, 20, first_cluster, size)
+    entries = [bytes(f), bytes(s)]
+    for part in names:
+        n = bytearray(32)
+        n[0] = 0xC1
+        n[2:2 + len(part)] = part
+        entries.append(bytes(n))
+    entries = _set_checksum(entries)
+    if deleted:
+        entries = [bytes([e[0] & 0x7F]) + e[1:] for e in entries]
+    return entries
+
+
+def _boot_checksum(sectors):
+    c = 0
+    for i, byte in enumerate(sectors):
+        if i in (106, 107, 112):
+            continue
+        c = (((c << 31) | (c >> 1)) + byte) & 0xFFFFFFFF
+    return c
+
+
+def build_exfat():
+    """An exFAT volume: 512-byte sectors, 1024-byte clusters, 64 clusters.
+
+    Sectors 0-11 main boot region (boot sector, 8 extended boot sectors with
+    AA550000 signatures, OEM, reserved, boot checksum sector); 12-23 backup
+    boot region (a copy); 24 the single FAT; 32 onwards the cluster heap
+    (cluster 2 at sector 32). Cluster placement is in ``EXFAT_LAYOUT``.
+
+    Clusters: 2 allocation bitmap (8 bytes); 3 up-case table (256 bytes,
+    checksummed); 4 -> 15 root directory (a FAT chain). Root entries: volume
+    label "Strata", bitmap, up-case, then
+      * ``Hello.txt``            13 bytes, cluster 6, NoFatChain; slack
+        painted SLACK!
+      * ``Fragmented file.bin``  2500 bytes on the FAT chain 7 -> 9 -> 8
+      * ``Contiguous.dat``       3000 bytes, clusters 10-12, NoFatChain,
+        FAT entries left zero (as a real driver does)
+      * ``Deleted file.txt``     InUse cleared on all entries, 100 bytes in
+        cluster 13 (bitmap bit clear)
+      * ``Timezone.txt``         created 2024-06-01 10:00:00 local with a
+        valid UTC offset of +12:00
+      * ``Empty.txt``            size 0, no cluster
+      * ``Named with a rather long filename.txt``  3 name entries, cluster 16
+      * ``Subdir``               directory, NoFatChain over clusters 17-18
+        (FAT zero). Cluster 17 holds ``Inner.txt`` then unused entries
+        (type 0x40); cluster 18 holds ``Second.txt``.
+      * ``Tail.txt``             its entry set straddles clusters 4 and 15
+    Every entry set carries a correct SetChecksum and NameHash.
+    """
+    L = EXFAT_LAYOUT
+    cs = EXFAT_CLUSTER
+    total_sectors = EXFAT_HEAP_OFFSET + EXFAT_CLUSTERS * (cs // SECTOR)
+    img = bytearray(total_sectors * SECTOR)
+
+    def coff(n):
+        return EXFAT_HEAP_OFFSET * SECTOR + (n - 2) * cs
+
+    def put(n, data):
+        img[coff(n):coff(n) + len(data)] = data
+
+    boot = bytearray(12 * SECTOR)
+    boot[0:3] = b"\xEB\x76\x90"
+    boot[3:11] = b"EXFAT   "
+    struct.pack_into("<QQIIIIIIHH", boot, 64, 0, total_sectors,
+                     EXFAT_FAT_OFFSET, EXFAT_FAT_LENGTH, EXFAT_HEAP_OFFSET,
+                     EXFAT_CLUSTERS, L["root"][0], EXFAT_SERIAL, 0x0100, 0)
+    boot[108] = EXFAT_SECTOR_SHIFT
+    boot[109] = EXFAT_CLUSTER_SHIFT
+    boot[110] = 1
+    boot[111] = 0x80
+    boot[112] = 30
+    boot[510:512] = b"\x55\xAA"
+    for k in range(1, 9):
+        boot[k * SECTOR + 508:k * SECTOR + 512] = b"\x00\x00\x55\xAA"
+    csum = struct.pack("<I", _boot_checksum(bytes(boot[:11 * SECTOR])))
+    boot[11 * SECTOR:12 * SECTOR] = csum * (SECTOR // 4)
+    img[0:12 * SECTOR] = boot
+    img[12 * SECTOR:24 * SECTOR] = boot
+
+    fat = bytearray(EXFAT_FAT_LENGTH * SECTOR)
+    used = set()
+
+    def link(chain):
+        for a, nxt in zip(chain, chain[1:]):
+            struct.pack_into("<I", fat, a * 4, nxt)
+        struct.pack_into("<I", fat, chain[-1] * 4, 0xFFFFFFFF)
+
+    struct.pack_into("<II", fat, 0, 0xFFFFFFF8, 0xFFFFFFFF)
+
+    # Allocation bitmap, up-case table, root chain.
+    link([L["bitmap"]])
+    link([L["upcase"]])
+    link(list(L["root"]))
+    upcase = upcase_table()
+    put(L["upcase"], upcase)
+    used.update([L["bitmap"], L["upcase"]] + list(L["root"]))
+
+    # File data.
+    put(L["hello"]["cluster"], EXFAT_HELLO
+        + fill(cs - len(EXFAT_HELLO), SLACK_MARK))
+    used.add(L["hello"]["cluster"])
+
+    frag = exfat_fragmented_content()
+    link(list(L["fragmented"]["clusters"]))
+    for k, c in enumerate(L["fragmented"]["clusters"]):
+        put(c, frag[k * cs:(k + 1) * cs])
+        used.add(c)
+
+    cont = exfat_contiguous_content()
+    c0 = L["contiguous"]["cluster"]
+    put(c0, cont)
+    used.update(range(c0, c0 + L["contiguous"]["count"]))
+
+    put(L["deleted"]["cluster"], pattern(100, 13))            # not in bitmap
+    put(L["timezone"]["cluster"], b"tz!!\n")
+    put(L["longname"]["cluster"], b"long name\n")
+    put(L["inner"]["cluster"], b"inner\n")
+    put(L["second"]["cluster"], b"second\n")
+    put(L["tail"]["cluster"], b"tail")
+    used.update([L["timezone"]["cluster"], L["longname"]["cluster"],
+                 L["inner"]["cluster"], L["second"]["cluster"],
+                 L["tail"]["cluster"]])
+    for n in (L["timezone"], L["longname"], L["inner"], L["second"],
+              L["tail"]):
+        link([n["cluster"]])
+
+    sub = L["subdir"]["cluster"]
+    used.update(range(sub, sub + L["subdir"]["count"]))
+    sub1 = b"".join(exfat_file_set("Inner.txt", L["inner"]["cluster"], 6))
+    unused = bytes([0x40]) + bytes(31)
+    sub1 += unused * ((cs - len(sub1)) // 32)
+    put(sub, sub1)
+    put(sub + 1, b"".join(exfat_file_set("Second.txt",
+                                         L["second"]["cluster"], 7)))
+
+    # Root directory entries.
+    label = bytearray(32)
+    label[0] = 0x83
+    label[1] = len(EXFAT_LABEL)
+    label[2:2 + 2 * len(EXFAT_LABEL)] = EXFAT_LABEL.encode("utf-16-le")
+    bitmap_e = bytearray(32)
+    bitmap_e[0] = 0x81
+    struct.pack_into("<IQ", bitmap_e, 20, L["bitmap"],
+                     (EXFAT_CLUSTERS + 7) // 8)
+    upcase_e = bytearray(32)
+    upcase_e[0] = 0x82
+    struct.pack_into("<I", upcase_e, 4, _upcase_checksum(upcase))
+    struct.pack_into("<IQ", upcase_e, 20, L["upcase"], len(upcase))
+
+    root = [bytes(label), bytes(bitmap_e), bytes(upcase_e)]
+    root += exfat_file_set("Hello.txt", L["hello"]["cluster"], 13,
+                           contiguous=True)
+    root += exfat_file_set("Fragmented file.bin",
+                           L["fragmented"]["clusters"][0], 2500)
+    root += exfat_file_set("Contiguous.dat", c0, 3000, contiguous=True)
+    root += exfat_file_set("Deleted file.txt", L["deleted"]["cluster"], 100,
+                           contiguous=True, deleted=True)
+    root += exfat_file_set("Timezone.txt", L["timezone"]["cluster"], 5,
+                           created=EXFAT_TZ_LOCAL, created_tz=EXFAT_TZ_OFFSET)
+    root += exfat_file_set("Empty.txt", 0, 0)
+    root += exfat_file_set(EXFAT_LONG_NAME, L["longname"]["cluster"], 10)
+    root += exfat_file_set("Subdir", sub, cs * L["subdir"]["count"],
+                           attrs=0x10, contiguous=True)
+    root += exfat_file_set("Tail.txt", L["tail"]["cluster"], 4)
+    blob = b"".join(root)
+    assert len(blob) - 96 < cs < len(blob) <= 2 * cs, \
+        "Tail.txt must straddle clusters"
+    put(L["root"][0], blob[:cs])
+    put(L["root"][1], blob[cs:])
+
+    bitmap = bytearray((EXFAT_CLUSTERS + 7) // 8)
+    for c in used:
+        bitmap[(c - 2) // 8] |= 1 << ((c - 2) % 8)
+    put(L["bitmap"], bytes(bitmap))
+
+    img[EXFAT_FAT_OFFSET * SECTOR:EXFAT_FAT_OFFSET * SECTOR + len(fat)] = fat
+    return bytes(img)
diff --git a/tests/imagebuild_ntfs.py b/tests/imagebuild_ntfs.py
new file mode 100644
index 0000000..36ef298
--- /dev/null
+++ b/tests/imagebuild_ntfs.py
@@ -0,0 +1,545 @@
+"""Synthetic NTFS volume (and GPT disk) builders for the parser tests.
+
+Returns ``bytes`` built in code — the repository carries no binary fixtures.
+The layout is fixed and described in ``build_ntfs``'s docstring so tests can
+assert exact record numbers, cluster offsets and timestamps, and so the image
+can later seed a fuzzer. This module does not import the engine: it encodes
+the on-disk format directly (MFT FILE records with update sequence arrays,
+resident/non-resident attributes, run lists, $I30 index roots).
+"""
+
+import binascii
+import datetime
+import struct
+import uuid
+
+SECTOR = 512
+SECTORS_PER_CLUSTER = 2
+CLUSTER = SECTOR * SECTORS_PER_CLUSTER          # 1024
+RECORD = 1024
+TOTAL_CLUSTERS = 128
+MFT_LCN = 4
+MFT_RECORDS = 32
+MFTMIRR_LCN = 36
+BITMAP_LCN = 90
+ROOT_INDX_LCN = 100
+INDEX_BLOCK = CLUSTER                            # clusters-per-index 1
+SERIAL = 0x0123456789ABCDEF
+USN = b"\x42\x42"
+VOLUME_LABEL = "STRATA"
+
+# Record numbers of the user-visible content.
+REC = {
+    "hello": 16, "big": 17, "ads": 18, "deleted": 19, "docs": 20,
+    "note": 21, "sparse": 22, "compressed": 23, "twonames": 24,
+    "fixup": 25, "torn": 26, "empty_slot": 27,
+}
+
+HELLO_TEXT = b"Hello, NTFS!\n"
+BIG_SIZE = 3 * CLUSTER - 300                     # slack of 300 in last cluster
+BIG_RUNS = ((40, 2), (60, 1))                    # fragmented, backwards jump
+ADS_MAIN = b"main stream\n"
+ZONE_ID = b"[ZoneTransfer]\r\nZoneId=3\r\n"
+SECRET_LCN = 70
+SECRET_SIZE = 100
+DELETED_TEXT = b"gone but not forgotten\n"
+NOTE_TEXT = b"a note inside Docs\n"
+SPARSE_RUNS = ((50, 1), (None, 2), (51, 1))
+SPARSE_SIZE = 4 * CLUSTER
+COMPRESSED_LCN = 80
+COMPRESSED_TEXT = b"abc" * 400                   # 1200 bytes
+FIXUP_SIZE = 700                                 # resident, spans byte 510
+SLACK_MARK = b"NTFSSLACK"
+
+SI_TIMES = {
+    "created": datetime.datetime(2021, 1, 2, 3, 4, 5),
+    "modified": datetime.datetime(2022, 6, 7, 8, 9, 10),
+    "mft_modified": datetime.datetime(2022, 6, 7, 8, 9, 11),
+    "accessed": datetime.datetime(2023, 1, 1, 0, 0, 0),
+}
+# $FILE_NAME times deliberately differ from $STANDARD_INFORMATION, as they
+# would after a timestamp-tampering tool rewrote only $SI.
+FN_TIMES = {
+    "created": datetime.datetime(2019, 5, 5, 5, 5, 5),
+    "modified": datetime.datetime(2019, 5, 5, 5, 5, 6),
+    "mft_modified": datetime.datetime(2019, 5, 5, 5, 5, 7),
+    "accessed": datetime.datetime(2019, 5, 5, 5, 5, 8),
+}
+
+
+def pattern(length, seed):
+    return bytes(((i * 29 + seed * 13 + (i >> 7)) & 0xFF) for i in range(length))
+
+
+def fill(length, text):
+    return (text * (length // len(text) + 1))[:length]
+
+
+def big_content():
+    return pattern(BIG_SIZE, 1)
+
+
+def secret_content():
+    return pattern(SECRET_SIZE, 2)
+
+
+def sparse_content():
+    """What reading the sparse file must yield: data, zeros, data."""
+    return (pattern(CLUSTER, 3) + bytes(2 * CLUSTER) + pattern(CLUSTER, 4))
+
+
+def fixup_content():
+    return pattern(FIXUP_SIZE, 5)
+
+
+def iso(dt):
+    return dt.isoformat() + "Z"
+
+
+def filetime(dt):
+    delta = dt - datetime.datetime(1601, 1, 1)
+    return (delta.days * 86400 + delta.seconds) * 10 ** 7 \
+        + delta.microseconds * 10
+
+
+def _align8(n):
+    return (n + 7) & ~7
+
+
+def encode_runs(runs):
+    """NTFS mapping pairs. ``runs`` is (lcn or None for sparse, length)."""
+    out = bytearray()
+    prev = 0
+    for lcn, length in runs:
+        lb = (length.bit_length() + 8) // 8
+        lbytes = length.to_bytes(lb, "little")
+        if lcn is None:
+            out.append(lb)
+            out += lbytes
+            continue
+        delta = lcn - prev
+        prev = lcn
+        ob = 1
+        while True:
+            try:
+                obytes = delta.to_bytes(ob, "little", signed=True)
+                break
+            except OverflowError:
+                ob += 1
+        out.append((ob << 4) | lb)
+        out += lbytes + obytes
+    out.append(0)
+    return bytes(out)
+
+
+def resident_attr(type_id, body, name="", attr_id=0, indexed=False):
+    name_u = name.encode("utf-16-le")
+    header_len = 24
+    name_off = header_len
+    content_off = _align8(header_len + len(name_u))
+    length = _align8(content_off + len(body))
+    a = bytearray(length)
+    struct.pack_into("<IIBBHHH", a, 0, type_id, length, 0, len(name),
+                     name_off, 0, attr_id)
+    struct.pack_into("<IHBB", a, 16, len(body), content_off,
+                     1 if indexed else 0, 0)
+    a[name_off:name_off + len(name_u)] = name_u
+    a[content_off:content_off + len(body)] = body
+    return bytes(a)
+
+
+def nonresident_attr(type_id, runs, real_size, name="", attr_id=0, flags=0,
+                     compression_unit=0):
+    name_u = name.encode("utf-16-le")
+    header_len = 72 if compression_unit else 64
+    name_off = header_len
+    run_off = _align8(header_len + len(name_u))
+    mp = encode_runs(runs)
+    length = _align8(run_off + len(mp))
+    clusters = sum(n for _, n in runs)
+    alloc = clusters * CLUSTER
+    a = bytearray(length)
+    struct.pack_into("<IIBBHHH", a, 0, type_id, length, 1, len(name),
+                     name_off, flags, attr_id)
+    struct.pack_into("<QQHH", a, 16, 0, clusters - 1, run_off,
+                     compression_unit)
+    struct.pack_into("<QQQ", a, 40, alloc, real_size, real_size)
+    if compression_unit:
+        struct.pack_into("<Q", a, 64, sum(n for l, n in runs if l is not None)
+                         * CLUSTER)
+    a[name_off:name_off + len(name_u)] = name_u
+    a[run_off:run_off + len(mp)] = mp
+    return bytes(a)
+
+
+def std_info(times=None, flags=0x20):
+    t = times or SI_TIMES
+    body = struct.pack("<QQQQIIII", filetime(t["created"]),
+                       filetime(t["modified"]), filetime(t["mft_modified"]),
+                       filetime(t["accessed"]), flags, 0, 0, 0)
+    return body + bytes(72 - len(body))
+
+
+def file_name_body(name, parent, size=0, times=None, namespace=3,
+                   is_dir=False, parent_seq=None):
+    t = times or FN_TIMES
+    seq = parent if parent_seq is None else parent_seq
+    ref = parent | ((seq & 0xFFFF) << 48)
+    alloc = (size + CLUSTER - 1) // CLUSTER * CLUSTER
+    body = struct.pack("<QQQQQQQII", ref, filetime(t["created"]),
+                       filetime(t["modified"]), filetime(t["mft_modified"]),
+                       filetime(t["accessed"]), alloc, size,
+                       0x10000000 if is_dir else 0x20, 0)
+    body += struct.pack("<BB", len(name), namespace) + name.encode("utf-16-le")
+    return body
+
+
+def _index_entries(entries, subnode_vcn=None):
+    blob = bytearray()
+    for ref, fn in entries:
+        length = _align8(16 + len(fn))
+        e = bytearray(length)
+        struct.pack_into("<QHHI", e, 0, ref | (ref << 48), length, len(fn), 0)
+        e[16:16 + len(fn)] = fn
+        blob += e
+    if subnode_vcn is None:
+        blob += struct.pack("<QHHI", 0, 16, 0, 0x02)          # last entry
+    else:
+        blob += struct.pack("<QHHIQ", 0, 24, 0, 0x03, subnode_vcn)
+    return bytes(blob)
+
+
+def index_root(entries, subnode_vcn=None):
+    """$INDEX_ROOT body for a $I30 index. With ``subnode_vcn`` None the
+    ``entries`` (a sorted list of (mft_ref, file_name_body)) sit in the root
+    node; otherwise the root holds only an end entry pointing at that VCN
+    of $INDEX_ALLOCATION and the "large index" flag is set."""
+    blob = _index_entries(entries if subnode_vcn is None else [],
+                          subnode_vcn)
+    header = struct.pack("<IIIB3x", 16, 16 + len(blob), 16 + len(blob),
+                         0 if subnode_vcn is None else 1)
+    root = struct.pack("<IIIB3x", 0x30, 1, INDEX_BLOCK, 1)
+    return root + header + blob
+
+
+def _apply_usa(body, usa_off):
+    usa_count = len(body) // SECTOR + 1
+    body[usa_off:usa_off + 2] = USN
+    for i in range(1, usa_count):
+        end = i * SECTOR
+        body[usa_off + 2 * i:usa_off + 2 * i + 2] = body[end - 2:end]
+        body[end - 2:end] = USN
+
+
+def indx_block(entries, vcn=0):
+    """One INDX record (INDEX_BLOCK bytes, fixups applied) holding sorted
+    leaf ``entries``."""
+    body = bytearray(INDEX_BLOCK)
+    usa_off = 0x28
+    usa_count = INDEX_BLOCK // SECTOR + 1
+    first = _align8(usa_off + usa_count * 2)
+    blob = _index_entries(entries)
+    assert first + len(blob) <= INDEX_BLOCK, "INDX block overflows"
+    body[0:4] = b"INDX"
+    struct.pack_into("<HHQQ", body, 4, usa_off, usa_count, 0, vcn)
+    struct.pack_into("<IIIB", body, 0x18, first - 0x18,
+                     first - 0x18 + len(blob), INDEX_BLOCK - 0x18, 0)
+    body[first:first + len(blob)] = blob
+    _apply_usa(body, usa_off)
+    return bytes(body)
+
+
+def mft_record(number, attrs, in_use=True, is_dir=False, seq=None,
+               tear=False):
+    """A FILE record: header, update sequence array (USN + one saved pair
+    per 512-byte stride), attributes, 0xFFFFFFFF end marker, then fixups
+    applied. ``tear`` corrupts the second stride's check value so the record
+    fails fixup verification, as a torn write would."""
+    strides = RECORD // SECTOR
+    usa_off = 0x30
+    usa_count = strides + 1
+    first_attr = _align8(usa_off + usa_count * 2)
+    body = bytearray(RECORD)
+    body[0:4] = b"FILE"
+    flags = (0x01 if in_use else 0) | (0x02 if is_dir else 0)
+    pos = first_attr
+    for k, a in enumerate(attrs):
+        a = bytearray(a)
+        struct.pack_into("<H", a, 14, k)
+        body[pos:pos + len(a)] = a
+        pos += len(a)
+    body[pos:pos + 4] = b"\xFF\xFF\xFF\xFF"
+    used = _align8(pos + 8)
+    assert used <= RECORD, "record %d overflows" % number
+    struct.pack_into("<HHQHHHHIIQHHI", body, 4, usa_off, usa_count, 0,
+                     number if seq is None else seq, 1, first_attr, flags,
+                     used, RECORD, 0, len(attrs), 0, number)
+    _apply_usa(body, usa_off)
+    if tear:
+        body[2 * SECTOR - 2:2 * SECTOR] = b"\x00\x00"
+    return bytes(body)
+
+
+def _named_file(number, name, parent, data_attrs, size=0, in_use=True,
+                is_dir=False, extra=()):
+    fn = file_name_body(name, parent, size=size, is_dir=is_dir)
+    attrs = [resident_attr(0x10, std_info()),
+             resident_attr(0x30, fn, indexed=True)]
+    attrs += list(extra) + list(data_attrs)
+    return mft_record(number, attrs, in_use=in_use, is_dir=is_dir), fn
+
+
+def build_ntfs():
+    """An NTFS volume: 512-byte sectors, 2 sectors/cluster (1024-byte
+    clusters), 128 clusters, 1024-byte FILE records.
+
+    Boot sector at 0 (OEM "NTFS    ", MFT at LCN 4, $MFTMirr at LCN 36,
+    clusters-per-record 0xF6 = 2^10 bytes, clusters-per-index 1) and a backup
+    boot sector in the volume's last sector. The MFT is 32 records at
+    LCN 4-35 (its own $DATA run list says so); $MFTMirr holds copies of
+    records 0-3; $Bitmap's data sits at LCN 90. Every record carries a
+    3-entry update sequence array (USN 0x4242) with fixups applied.
+
+    Records 0-11 are the system files ($MFT, $MFTMirr, $LogFile, $Volume with
+    $VOLUME_NAME "STRATA", $AttrDef, the root ".", $Bitmap, $Boot, $BadClus,
+    $Secure, $UpCase, $Extend); the root has a $I30 $INDEX_ROOT listing its
+    children in an INDX block at LCN 100 ($INDEX_ROOT flags it as a large
+    index; $INDEX_ALLOCATION and $BITMAP "$I30" accompany it; the index holds
+    the in-use user files only, Win32 names). Records 12-15 are unused-but-formatted. Then:
+
+      16 hello.txt      resident $DATA "Hello, NTFS!\\n"
+      17 big.bin        non-resident, runs (LCN 40 x2)(LCN 60 x1), 2772 bytes;
+                        the 300 slack bytes in LCN 60 are painted NTFSSLACK
+      18 ads.txt        resident "main stream\\n" + resident ADS
+                        "Zone.Identifier" + non-resident ADS "secret"
+                        (100 bytes at LCN 70)
+      19 deleted.txt    record flags 0 (not in use), resident data
+      20 Docs           directory with $INDEX_ROOT listing note.txt
+      21 note.txt       resident, parent Docs
+      22 sparse.bin     runs (LCN 50 x1)(sparse x2)(LCN 51 x1), 4096 bytes
+      23 compressed.txt LZNT1-compressed $DATA, compression unit 16 clusters:
+                        (LCN 80 x1)(sparse x15); decompresses to "abc" * 400
+      24 two-name file  Win32 name "Long filename document.txt" and DOS name
+                        "LONGFI~1.TXT"
+      25 fixup.txt      700-byte resident $DATA straddling the stride end at
+                        byte 510, so it is only correct once fixups apply
+      26 torn.txt       fixup check value wrong in stride 2 (torn write)
+      27-31             zeroed — never formatted
+
+    Every user file's $STANDARD_INFORMATION times are ``SI_TIMES`` and its
+    $FILE_NAME times ``FN_TIMES``.
+    """
+    img = bytearray(TOTAL_CLUSTERS * CLUSTER)
+
+    def put_lcn(lcn, data):
+        img[lcn * CLUSTER:lcn * CLUSTER + len(data)] = data
+
+    boot = bytearray(SECTOR)
+    boot[0:3] = b"\xEB\x52\x90"
+    boot[3:11] = b"NTFS    "
+    struct.pack_into("<HB", boot, 11, SECTOR, SECTORS_PER_CLUSTER)
+    boot[21] = 0xF8
+    struct.pack_into("<HHI", boot, 24, 63, 255, 0)
+    struct.pack_into("<I", boot, 36, 0x00800080)
+    struct.pack_into("<QQQ", boot, 40, TOTAL_CLUSTERS * SECTORS_PER_CLUSTER
+                     - 1, MFT_LCN, MFTMIRR_LCN)
+    boot[64] = 0xF6
+    boot[68] = 0x01
+    struct.pack_into("<Q", boot, 72, SERIAL)
+    boot[510:512] = b"\x55\xAA"
+    img[0:SECTOR] = boot
+    img[len(img) - SECTOR:] = boot
+
+    records = {}
+    root_children = []
+
+    def sysfile(n, name, data_attrs=(), is_dir=False, extra=()):
+        rec, fn = _named_file(n, name, 5, data_attrs, is_dir=is_dir,
+                              extra=extra)
+        records[n] = rec
+        return fn
+
+    mft_bytes = MFT_RECORDS * RECORD
+    sysfile(0, "$MFT", [nonresident_attr(
+        0x80, [(MFT_LCN, mft_bytes // CLUSTER)], mft_bytes)])
+    sysfile(1, "$MFTMirr", [nonresident_attr(
+        0x80, [(MFTMIRR_LCN, 4)], 4 * RECORD)])
+    sysfile(2, "$LogFile", [resident_attr(0x80, b"")])
+    sysfile(3, "$Volume", [resident_attr(0x80, b"")], extra=[
+        resident_attr(0x60, VOLUME_LABEL.encode("utf-16-le")),
+        resident_attr(0x70, struct.pack("<QBBH", 0, 3, 1, 0))])
+    sysfile(4, "$AttrDef", [resident_attr(0x80, b"")])
+    sysfile(6, "$Bitmap", [nonresident_attr(
+        0x80, [(BITMAP_LCN, 1)], (TOTAL_CLUSTERS + 7) // 8)])
+    sysfile(7, "$Boot", [nonresident_attr(0x80, [(0, 1)], CLUSTER)])
+    sysfile(8, "$BadClus", [resident_attr(0x80, b"")])
+    sysfile(9, "$Secure", [])
+    sysfile(10, "$UpCase", [resident_attr(0x80, b"")])
+    sysfile(11, "$Extend", [], is_dir=True)
+    for n in range(12, 16):
+        records[n] = mft_record(n, [], in_use=False)
+
+    def user(key, name, data_attrs, size, parent=5, in_use=True,
+             is_dir=False, extra=()):
+        n = REC[key]
+        rec, fn = _named_file(n, name, parent, data_attrs, size=size,
+                              in_use=in_use, is_dir=is_dir, extra=extra)
+        records[n] = rec
+        if parent == 5 and in_use:
+            root_children.append((n, fn))
+        return fn
+
+    user("hello", "hello.txt", [resident_attr(0x80, HELLO_TEXT)],
+         len(HELLO_TEXT))
+
+    user("big", "big.bin", [nonresident_attr(0x80, BIG_RUNS, BIG_SIZE)],
+         BIG_SIZE)
+    data = big_content()
+    put_lcn(40, data[:2 * CLUSTER])
+    put_lcn(60, data[2 * CLUSTER:]
+            + fill(3 * CLUSTER - BIG_SIZE, SLACK_MARK))
+
+    user("ads", "ads.txt", [
+        resident_attr(0x80, ADS_MAIN),
+        resident_attr(0x80, ZONE_ID, name="Zone.Identifier"),
+        nonresident_attr(0x80, [(SECRET_LCN, 1)], SECRET_SIZE, name="secret"),
+    ], len(ADS_MAIN))
+    put_lcn(SECRET_LCN, secret_content())
+
+    user("deleted", "deleted.txt", [resident_attr(0x80, DELETED_TEXT)],
+         len(DELETED_TEXT), in_use=False)
+
+    note_fn = file_name_body("note.txt", REC["docs"], size=len(NOTE_TEXT))
+    user("docs", "Docs", [], 0, is_dir=True, extra=[
+        resident_attr(0x90, index_root([(REC["note"], note_fn)]),
+                      name="$I30")])
+    user("note", "note.txt", [resident_attr(0x80, NOTE_TEXT)],
+         len(NOTE_TEXT), parent=REC["docs"])
+
+    user("sparse", "sparse.bin", [nonresident_attr(
+        0x80, SPARSE_RUNS, SPARSE_SIZE, flags=0x8000)], SPARSE_SIZE)
+    sc = sparse_content()
+    put_lcn(50, sc[:CLUSTER])
+    put_lcn(51, sc[3 * CLUSTER:])
+
+    user("compressed", "compressed.txt", [nonresident_attr(
+        0x80, [(COMPRESSED_LCN, 1), (None, 15)], len(COMPRESSED_TEXT),
+        flags=0x0001, compression_unit=4)], len(COMPRESSED_TEXT))
+    # One LZNT1 chunk: literals "abc", then a back-reference (offset 3,
+    # length 1197). Header 0xB005 = compressed | signature 3 | size-1 = 5.
+    put_lcn(COMPRESSED_LCN, bytes([0x05, 0xB0, 0x08, 0x61, 0x62, 0x63])
+            + struct.pack("<H", (2 << 12) | (1197 - 3)) + b"\x00\x00")
+
+    n = REC["twonames"]
+    win32 = file_name_body("Long filename document.txt", 5, size=4,
+                           namespace=1)
+    dos = file_name_body("LONGFI~1.TXT", 5, size=4, namespace=2)
+    records[n] = mft_record(n, [
+        resident_attr(0x10, std_info()), resident_attr(0x30, dos, indexed=True),
+        resident_attr(0x30, win32, indexed=True),
+        resident_attr(0x80, b"two\n")])
+    root_children.append((n, win32))
+
+    user("fixup", "fixup.txt", [resident_attr(0x80, fixup_content())],
+         FIXUP_SIZE)
+    n = REC["torn"]
+    fn = file_name_body("torn.txt", 5, size=5)
+    records[n] = mft_record(n, [
+        resident_attr(0x10, std_info()), resident_attr(0x30, fn, indexed=True),
+        resident_attr(0x80, b"torn\n")], tear=True)
+    root_children.append((n, fn))
+
+    root_children_sorted = sorted(
+        root_children,
+        key=lambda item: item[1][66:].decode("utf-16-le").upper())
+    root_fn = file_name_body(".", 5, is_dir=True)
+    records[5] = mft_record(5, [
+        resident_attr(0x10, std_info()),
+        resident_attr(0x30, root_fn, indexed=True),
+        resident_attr(0x90, index_root([], subnode_vcn=0), name="$I30"),
+        nonresident_attr(0xA0, [(ROOT_INDX_LCN, 1)], INDEX_BLOCK,
+                         name="$I30"),
+        resident_attr(0xB0, b"\x01\x00\x00\x00\x00\x00\x00\x00",
+                      name="$I30"),
+    ], is_dir=True)
+    put_lcn(ROOT_INDX_LCN, indx_block(root_children_sorted))
+
+    for n, rec in records.items():
+        at = MFT_LCN * CLUSTER + n * RECORD
+        img[at:at + RECORD] = rec
+    for n in range(4):
+        at = MFTMIRR_LCN * CLUSTER + n * RECORD
+        img[at:at + RECORD] = records[n]
+
+    used = set(range(0, MFT_LCN + MFT_RECORDS)) | set(range(MFTMIRR_LCN, 40))
+    used |= {40, 41, 60, SECRET_LCN, 50, 51, COMPRESSED_LCN, BITMAP_LCN, ROOT_INDX_LCN,
+             TOTAL_CLUSTERS - 1}
+    bitmap = bytearray((TOTAL_CLUSTERS + 7) // 8)
+    for c in used:
+        bitmap[c // 8] |= 1 << (c % 8)
+    put_lcn(BITMAP_LCN, bytes(bitmap))
+    return bytes(img)
+
+
+# --------------------------------------------------------------------------
+# GPT
+# --------------------------------------------------------------------------
+
+BASIC_DATA = "ebd0a0a2-b9e5-4433-87c0-68b6b72699c7"
+GPT_ENTRIES = 128
+GPT_ENTRY_SIZE = 128
+GPT_ARRAY_SECTORS = 32
+
+
+def _gpt_header(this_lba, alt_lba, entry_lba, first, last, disk_guid,
+                array_crc):
+    h = bytearray(92)
+    h[0:8] = b"EFI PART"
+    struct.pack_into("<IIIIQQQQ16sQIII", h, 8, 0x00010000, 92, 0, 0,
+                     this_lba, alt_lba, first, last, disk_guid, entry_lba,
+                     GPT_ENTRIES, GPT_ENTRY_SIZE, array_crc)
+    struct.pack_into("<I", h, 16, binascii.crc32(bytes(h)) & 0xFFFFFFFF)
+    return bytes(h) + bytes(SECTOR - 92)
+
+
+def wrap_gpt(volume, start_lba=2048, name="Strata data"):
+    """A GPT disk holding ``volume`` as partition 1 (Microsoft Basic Data).
+
+    LBA 0 protective MBR (type 0xEE); LBA 1 primary header; LBA 2-33 the
+    128-entry partition array; ``volume`` from ``start_lba``; the backup
+    array and header occupy the last 33 LBAs. Both CRC32s are valid.
+    """
+    count = (len(volume) + SECTOR - 1) // SECTOR
+    total = start_lba + count + 1 + GPT_ARRAY_SECTORS
+    last_lba = total - 1
+    disk = bytearray(total * SECTOR)
+
+    mbr = bytearray(SECTOR)
+    mbr[446:462] = struct.pack("<B3sB3sII", 0, b"\x00\x02\x00", 0xEE,
+                               b"\xFF\xFF\xFF", 1, min(last_lba, 0xFFFFFFFF))
+    mbr[510:512] = b"\x55\xAA"
+    disk[0:SECTOR] = mbr
+
+    entry = bytearray(GPT_ENTRY_SIZE)
+    entry[0:16] = uuid.UUID(BASIC_DATA).bytes_le
+    entry[16:32] = uuid.UUID("5c1b2a3d-0000-4000-8000-000000000001").bytes_le
+    struct.pack_into("<QQQ", entry, 32, start_lba, start_lba + count - 1, 0)
+    nm = name.encode("utf-16-le")[:72]
+    entry[56:56 + len(nm)] = nm
+    array = bytes(entry) + bytes((GPT_ENTRIES - 1) * GPT_ENTRY_SIZE)
+    crc = binascii.crc32(array) & 0xFFFFFFFF
+    disk_guid = uuid.UUID("5c1b2a3d-0000-4000-8000-0000000000aa").bytes_le
+    first_usable = 2 + GPT_ARRAY_SECTORS
+    last_usable = last_lba - 1 - GPT_ARRAY_SECTORS
+
+    disk[SECTOR:2 * SECTOR] = _gpt_header(1, last_lba, 2, first_usable,
+                                          last_usable, disk_guid, crc)
+    disk[2 * SECTOR:2 * SECTOR + len(array)] = array
+    disk[start_lba * SECTOR:start_lba * SECTOR + len(volume)] = volume
+    backup_array_lba = last_lba - GPT_ARRAY_SECTORS
+    disk[backup_array_lba * SECTOR:backup_array_lba * SECTOR
+         + len(array)] = array
+    disk[last_lba * SECTOR:] = _gpt_header(last_lba, 1, backup_array_lba,
+                                           first_usable, last_usable,
+                                           disk_guid, crc)
+    return bytes(disk)
diff --git a/tests/test_fs_exfat.py b/tests/test_fs_exfat.py
new file mode 100644
index 0000000..b4f54d4
--- /dev/null
+++ b/tests/test_fs_exfat.py
@@ -0,0 +1,322 @@
+"""Unit tests for the exFAT parser (engine.fs.exfat).
+
+The image comes from tests/imagebuild_fat.build_exfat() and is opened the
+way the server opens evidence: ewf.open_image -> volume.scan -> OffsetReader
+-> ntfs.open_fs (the filesystem dispatcher).
+"""
+
+import os
+import random
+import struct
+import sys
+import unittest
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.dirname(HERE))
+sys.path.insert(0, HERE)
+
+import imagebuild_fat as build                                   # noqa: E402
+from test_fs_fat import BytesImage, ImageFiles, by_name, \
+    open_first_volume                                            # noqa: E402
+from engine import volume                                        # noqa: E402
+from engine.ewf import OffsetReader                              # noqa: E402
+from engine.fs import exfat, ntfs                                # noqa: E402
+from engine.fs.streams import UnsupportedStream                  # noqa: E402
+
+C = build.EXFAT_CLUSTER
+L = build.EXFAT_LAYOUT
+
+
+class Exfat(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.data = build.build_exfat()
+        cls.image = cls.files.open(cls.data)
+        cls.layout, cls.part, cls.fs = open_first_volume(cls.image)
+        cls.root = by_name(cls.fs.listdir(0))
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    # -- boot record and volume metadata ---------------------------------
+
+    def test_dispatcher_and_probe(self):
+        self.assertIsInstance(self.fs, exfat.ExfatFS)
+        self.assertEqual(volume.identify_fs(self.image, 0), "exFAT")
+        self.assertEqual(self.part["detected"], "exFAT")
+        self.assertEqual(self.part["label"], build.EXFAT_LABEL)
+
+    def test_boot_record_fields(self):
+        info = self.fs.info()
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_cluster"], 2)
+        self.assertEqual(info["cluster_size"], C)
+        self.assertEqual(info["cluster_count"], build.EXFAT_CLUSTERS)
+        self.assertEqual(info["fat_count"], 1)
+        self.assertEqual(info["first_data_offset"],
+                         build.EXFAT_HEAP_OFFSET * 512)
+        self.assertEqual(info["root_cluster"], L["root"][0])
+        self.assertEqual(info["serial"], "%08X" % build.EXFAT_SERIAL)
+        self.assertEqual(info["revision"], "1.0")
+        self.assertEqual(info["percent_in_use"], 30)
+        self.assertFalse(info["volume_dirty"])
+        self.assertEqual(info["label"], build.EXFAT_LABEL)
+
+    def test_allocation_bitmap(self):
+        self.assertEqual(self.fs._bitmap_start, L["bitmap"])
+        bitmap = self.fs._load_bitmap()
+        self.assertEqual(len(bitmap), (build.EXFAT_CLUSTERS + 7) // 8)
+
+        def allocated(c):
+            return bool(bitmap[(c - 2) // 8] >> ((c - 2) % 8) & 1)
+
+        for c in (L["bitmap"], L["upcase"], L["hello"]["cluster"],
+                  L["contiguous"]["cluster"] + 2, L["subdir"]["cluster"] + 1):
+            self.assertTrue(allocated(c), c)
+        self.assertFalse(allocated(L["deleted"]["cluster"]))
+        self.assertFalse(allocated(40))
+        # The bitmap's own cluster is reported as allocated space.
+        off = self.fs.cluster_offset(L["bitmap"])
+        self.assertIn((off, off + C), self.fs.allocated_extents())
+
+    def test_up_case_table_is_metadata_not_a_file(self):
+        # The up-case entry sits between the bitmap entry and the files;
+        # it must neither appear as a file nor stop the root scan.
+        names = set(self.root)
+        self.assertFalse(any("upcase" in n.lower() for n in names))
+        self.assertIn("Hello.txt", names)
+        table = self.fs.source.read_at(self.fs.cluster_offset(L["upcase"]),
+                                       256)
+        self.assertEqual(table, build.upcase_table())
+
+    # -- directory listing ------------------------------------------------
+
+    def test_root_listing(self):
+        self.assertEqual(set(self.root), {
+            "Hello.txt", "Fragmented file.bin", "Contiguous.dat",
+            "Deleted file.txt", "Timezone.txt", "Empty.txt",
+            build.EXFAT_LONG_NAME, "Subdir", "Tail.txt"})
+        # Directories sort first.
+        self.assertEqual(self.fs.listdir(0)[0]["name"], "Subdir")
+        self.assertTrue(self.root["Subdir"]["is_dir"])
+        self.assertTrue(self.root["Subdir"]["contiguous"])
+
+    def test_root_directory_follows_its_fat_chain(self):
+        self.assertEqual(self.fs.chain(L["root"][0]), list(L["root"]))
+        tail = self.root["Tail.txt"]           # entry set straddles clusters
+        self.assertEqual(self.fs.read_file(tail), b"tail")
+
+    def test_three_part_file_name(self):
+        e = self.root[build.EXFAT_LONG_NAME]
+        self.assertEqual(e["path"], "/" + build.EXFAT_LONG_NAME)
+        self.assertEqual(self.fs.read_file(e), b"long name\n")
+
+    def test_timestamps_and_attributes(self):
+        e = self.root["Hello.txt"]
+        self.assertEqual(e["modified"], "2023-11-05T08:30:44Z")
+        self.assertEqual(e["accessed"], "2023-11-05T08:30:44Z")
+        self.assertEqual(e["attributes"], ["archive"])
+
+    # Bug: exfat.py ignores the UTC-offset bytes (22-24) — _ts() takes a tz
+    # argument but never uses it — yet labels local times "Z". 10:00 at
+    # +12:00 is 22:00 UTC the previous day.
+    @unittest.expectedFailure
+    def test_timestamp_honours_utc_offset(self):
+        self.assertEqual(self.root["Timezone.txt"]["created"],
+                         "2024-05-31T22:00:00Z")
+
+    def test_subdirectory_first_cluster(self):
+        sub = self.root["Subdir"]
+        inner = by_name(self.fs.listdir(sub["start_cluster"], "/Subdir"))
+        self.assertIn("Inner.txt", inner)
+        self.assertEqual(inner["Inner.txt"]["path"], "/Subdir/Inner.txt")
+        self.assertEqual(self.fs.read_file(inner["Inner.txt"]), b"inner\n")
+
+    # Bug: exfat.py listdir() always walks the FAT; a NoFatChain directory's
+    # FAT entries are zero, so only its first cluster is read and entries
+    # in later clusters (here Second.txt in cluster 18) are never listed.
+    @unittest.expectedFailure
+    def test_contiguous_subdirectory_second_cluster_listed(self):
+        sub = self.root["Subdir"]
+        inner = by_name(self.fs.listdir(sub["start_cluster"], "/Subdir"))
+        self.assertIn("Second.txt", inner)
+
+    # -- file content ------------------------------------------------------
+
+    def test_fat_chain_stream(self):
+        e = self.root["Fragmented file.bin"]
+        self.assertFalse(e["contiguous"])
+        want = build.exfat_fragmented_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_file(e, max_bytes=1500), want[:1500])
+        self.assertEqual(self.fs.read_range(e, 1000, 1100), want[1000:2100])
+        runs = self.fs.runs(e)
+        self.assertEqual([(r["cluster"], r["clusters"], r["used"])
+                          for r in runs], [(7, 1, C), (9, 1, C), (8, 1, 452)])
+
+    def test_no_fat_chain_contiguous_stream(self):
+        e = self.root["Contiguous.dat"]
+        self.assertTrue(e["contiguous"])
+        # Nothing in the FAT describes this file; the extent comes from the
+        # stream extension alone.
+        c0 = L["contiguous"]["cluster"]
+        for c in range(c0, c0 + L["contiguous"]["count"]):
+            self.assertEqual(self.fs._fat_entry(c), 0)
+        want = build.exfat_contiguous_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_range(e, 2000, 2000), want[2000:])
+        runs = self.fs.runs(e)
+        self.assertEqual(len(runs), 1)
+        self.assertEqual(runs[0]["offset"], self.fs.cluster_offset(c0))
+        self.assertEqual(runs[0]["length"], 3 * C)
+        self.assertEqual(runs[0]["used"], 3000)
+        self.assertTrue(self.fs.stat(e)["contiguous"])
+
+    def test_empty_file(self):
+        e = self.root["Empty.txt"]
+        self.assertEqual(self.fs.read_file(e), b"")
+        self.assertEqual(self.fs.read_range(e, 0, 10), b"")
+        self.assertIsNone(self.fs.slack(e))
+        self.assertEqual(self.fs.runs(e), [])
+
+    def test_named_streams_are_refused(self):
+        with self.assertRaises(UnsupportedStream):
+            self.fs.read_file(self.root["Hello.txt"], stream="ads")
+
+    def test_deleted_entry(self):
+        e = self.root["Deleted file.txt"]
+        self.assertTrue(e["deleted"])
+        self.assertTrue(e["contiguous"])
+        self.assertEqual(e["size"], 100)
+        self.assertEqual(self.fs.read_file(e), build.pattern(100, 13))
+        self.assertIn("contiguous", self.fs.stat(e)["recovery"])
+        # Deleted files are not allocated space.
+        off = self.fs.cluster_offset(L["deleted"]["cluster"])
+        self.assertNotIn(off, {s for s, _ in self.fs.allocated_extents()})
+
+    def test_slack(self):
+        e = self.root["Hello.txt"]
+        n = len(build.EXFAT_HELLO)
+        slack = self.fs.slack(e)
+        self.assertEqual(slack, {
+            "offset": self.fs.cluster_offset(L["hello"]["cluster"]) + n,
+            "length": C - n})
+        self.assertEqual(self.fs.source.read_at(slack["offset"],
+                                                slack["length"]),
+                         build.fill(C - n, build.SLACK_MARK))
+        self.assertEqual(self.fs.stat(e)["slack"], slack)
+
+        cont = self.fs.slack(self.root["Contiguous.dat"])
+        self.assertEqual(cont, {
+            "offset": self.fs.cluster_offset(L["contiguous"]["cluster"] + 2)
+            + (3000 - 2 * C),
+            "length": 3 * C - 3000})
+        self.assertIsNone(self.fs.slack(self.root["Subdir"]))
+
+
+class ExfatRobustness(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.good = build.build_exfat()
+
+    def open_bytes(self, data):
+        return ntfs.open_fs(OffsetReader(BytesImage(data), 0, len(data)))
+
+    def test_truncated_to_boot_sector(self):
+        files = ImageFiles()
+        self.addCleanup(files.close)
+        image = files.open(self.good[:512])
+        try:
+            fs = ntfs.open_fs(OffsetReader(image, 0, image.size))
+        except ValueError:
+            return
+        self.assertEqual(fs.listdir(0), [])
+
+    def test_truncated_mid_heap(self):
+        fs = self.open_bytes(self.good[:self.good.index(b"Hello, exFAT")])
+        for e in fs.listdir(0):
+            self.assertIsInstance(fs.read_file(e), bytes)
+
+    def test_implausible_shifts_rejected(self):
+        for at, value in ((108, 0), (108, 20), (109, 40)):
+            data = bytearray(self.good)
+            data[at] = value
+            with self.subTest(offset=at, value=value):
+                with self.assertRaises(ValueError):
+                    exfat.ExfatFS(BytesImage(data))
+
+    def test_signature_only_is_not_exfat(self):
+        data = bytearray(self.good)
+        data[3:11] = b"EXFAX   "
+        with self.assertRaises(ValueError):
+            exfat.ExfatFS(BytesImage(data))
+
+    def fat_offset(self, cluster):
+        return build.EXFAT_FAT_OFFSET * 512 + cluster * 4
+
+    def test_root_chain_loop_terminates(self):
+        data = bytearray(self.good)
+        struct.pack_into("<I", data, self.fat_offset(L["root"][1]),
+                         L["root"][0])
+        fs = exfat.ExfatFS(BytesImage(data))
+        self.assertEqual(fs.chain(L["root"][0]), list(L["root"]))
+        self.assertEqual(len(fs.listdir(0)), 9)
+
+    def test_absurd_secondary_count(self):
+        data = bytearray(self.good)
+        # Tail.txt's set straddles root clusters 4 and 15; its File entry is
+        # the last entry of cluster 4.
+        file_entry = (build.EXFAT_HEAP_OFFSET * 512
+                      + (L["root"][0] - 2) * C + C - 32)
+        self.assertEqual(data[file_entry], 0x85)
+        data[file_entry + 1] = 0xFF
+        fs = exfat.ExfatFS(BytesImage(data))
+        self.assertIsInstance(fs.listdir(0), list)
+
+    def test_random_entry_header_damage_does_not_crash(self):
+        # Damage confined to each entry's type, secondary-count, flag and
+        # name-length bytes. Length fields are left alone: a huge
+        # NoFatChain length is the unbounded case tested separately below.
+        root = build.EXFAT_HEAP_OFFSET * 512 + (L["root"][0] - 2) * C
+        rng = random.Random(4321)
+        for trial in range(40):
+            data = bytearray(self.good)
+            for _ in range(12):
+                data[root + rng.randrange(0, C // 32) * 32
+                     + rng.randrange(0, 4)] = rng.getrandbits(8)
+            with self.subTest(trial=trial):
+                fs = exfat.ExfatFS(BytesImage(data))
+                for e in fs.listdir(0):
+                    if not e["is_dir"] and e["size"] <= 1 << 20:
+                        fs.read_file(e, max_bytes=1 << 16)
+                        fs.stat(e)
+
+    # Bug: exfat.py chain() (line 86) expands a NoFatChain stream into one
+    # list element per cluster from the untrusted length, unbounded by the
+    # cluster count, so a corrupt length of 2^50 means a 2^40-element list
+    # (hang / MemoryError) on any read. Kept small here: 64 MiB, 65536 items.
+    @unittest.expectedFailure
+    def test_contiguous_run_bounded_by_cluster_heap(self):
+        data = bytearray(self.good)
+        stream = self.good.index("Contiguous.dat".encode("utf-16-le")) - 34
+        self.assertEqual(data[stream], 0xC0)
+        struct.pack_into("<Q", data, stream + 24, 64 << 20)
+        fs = exfat.ExfatFS(BytesImage(data))
+        e = by_name(fs.listdir(0))["Contiguous.dat"]
+        heap_end = fs.cluster_offset(fs.cluster_count + 2)
+        for r in fs.runs(e):
+            self.assertLessEqual(r["offset"] + r["length"], heap_end)
+
+    def test_random_garbage_is_not_exfat(self):
+        rng = random.Random(5)
+        junk = bytes(rng.getrandbits(8) for _ in range(16384))
+        with self.assertRaises(ValueError):
+            exfat.ExfatFS(BytesImage(junk))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_fs_fat.py b/tests/test_fs_fat.py
new file mode 100644
index 0000000..7978c7a
--- /dev/null
+++ b/tests/test_fs_fat.py
@@ -0,0 +1,411 @@
+"""Unit tests for the FAT12/16/32 parser (engine.fs.fat) and the MBR probe.
+
+Images come from tests/imagebuild_fat.py. They are written to a temporary
+file and opened the way the server opens evidence: ewf.open_image ->
+volume.scan -> OffsetReader over the partition -> ntfs.open_fs (the
+filesystem dispatcher).
+"""
+
+import os
+import random
+import shutil
+import sys
+import tempfile
+import unittest
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.dirname(HERE))
+sys.path.insert(0, HERE)
+
+import imagebuild_fat as build                                   # noqa: E402
+from engine import volume                                        # noqa: E402
+from engine.ewf import OffsetReader, open_image                  # noqa: E402
+from engine.fs import fat, ntfs                                  # noqa: E402
+
+C = build.FAT_CLUSTER
+L = build.FAT_LAYOUT
+
+
+class BytesImage:
+    """In-memory stand-in for ewf.RawImage (read_at + size), used only where
+    a test mutates an image many times and a file per mutation is wasteful."""
+
+    def __init__(self, data):
+        self.data = bytes(data)
+        self.size = len(self.data)
+        self.bytes_per_sector = 512
+
+    def read_at(self, offset, length):
+        if offset < 0 or length <= 0 or offset >= self.size:
+            return b""
+        return self.data[offset:offset + length]
+
+
+class ImageFiles:
+    """Write built images to a temp dir and open them with ewf.open_image."""
+
+    def __init__(self):
+        self.dir = tempfile.mkdtemp(prefix="strata-fs-test-")
+        self.images = []
+
+    def open(self, data, name="image.raw"):
+        path = os.path.join(self.dir, "%d-%s" % (len(self.images), name))
+        with open(path, "wb") as fh:
+            fh.write(data)
+        img = open_image(path)
+        self.images.append(img)
+        return img
+
+    def open_extents(self, size, extents, name="image.raw"):
+        """Like ``open`` for a SparseImage's extents, never holding the
+        whole image in memory."""
+        path = os.path.join(self.dir, "%d-%s" % (len(self.images), name))
+        build.write_sparse(path, size, extents)
+        img = open_image(path)
+        self.images.append(img)
+        return img
+
+    def close(self):
+        for img in self.images:
+            img.close()
+        shutil.rmtree(self.dir, ignore_errors=True)
+
+
+def open_first_volume(image):
+    """What the server does for /api/dir: scan, pick the partition, wrap it
+    in an OffsetReader and hand that to the dispatcher."""
+    layout = volume.scan(image)
+    part = next(p for p in layout["partitions"] if p.get("detected"))
+    src = OffsetReader(image, part["offset"], part["size"], part["slot"])
+    return layout, part, ntfs.open_fs(src)
+
+
+def by_name(entries):
+    return {e["name"]: e for e in entries}
+
+
+class _FatWidth:
+    """Width-sensitive checks, run once per FAT width by the subclasses."""
+
+    bits = None
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.image = cls.files.open_extents(*build.build_fat_extents(cls.bits))
+        cls.layout, cls.part, cls.fs = open_first_volume(cls.image)
+        cls.root = by_name(cls.fs.listdir(0))
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    def test_dispatcher_returns_fat_with_detected_width(self):
+        self.assertIsInstance(self.fs, fat.FatFS)
+        self.assertEqual(self.fs.bits, self.bits)
+        self.assertEqual(self.fs.name, "FAT%d" % self.bits)
+        self.assertEqual(self.fs.info()["type"], "FAT%d" % self.bits)
+
+    def test_volume_probe_names_the_width(self):
+        self.assertEqual(volume.identify_fs(self.image, 0), "FAT%d" % self.bits)
+        self.assertEqual(self.layout["scheme"], "None (unpartitioned)")
+        self.assertEqual(self.part["detected"], "FAT%d" % self.bits)
+        self.assertEqual(self.part["label"], "STRATATEST")
+
+    def test_bpb_fields(self):
+        total, reserved, nfats, fat_size, root_entries = \
+            build.FAT_GEOMETRY[self.bits]
+        root_sectors = (root_entries * 32 + 511) // 512
+        first_data = reserved + nfats * fat_size + root_sectors
+        info = self.fs.info()
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_cluster"], 1)
+        self.assertEqual(info["cluster_size"], C)
+        self.assertEqual(info["fat_count"], nfats)
+        self.assertEqual(info["fat_size_sectors"], fat_size)
+        self.assertEqual(info["first_data_offset"], first_data * 512)
+        self.assertEqual(info["cluster_count"], total - first_data)
+        self.assertEqual(info["root_cluster"],
+                         L["root_cluster_fat32"] if self.bits == 32 else 0)
+        self.assertEqual(info["label"], "STRATATEST")
+        self.assertEqual(self.fs.total_sectors, total)
+        self.assertEqual(self.fs.reserved_sectors, reserved)
+        self.assertEqual(self.fs.root_entries, root_entries)
+
+    def test_root_listing(self):
+        self.assertEqual(set(self.root), {
+            "HELLO.TXT", "Long file name.txt", "SUBDIR", "_ELETED.TXT",
+            self.root_deleted_lfn_name(), "CYCLE.BIN", build.GONE_NAME})
+        # The volume label entry is metadata, not a file.
+        self.assertNotIn("STRATATEST", self.root)
+        self.assertTrue(self.root["SUBDIR"]["is_dir"])
+        self.assertEqual(self.root["HELLO.TXT"]["path"], "/HELLO.TXT")
+
+    def root_deleted_lfn_name(self):
+        # Deliberately taken from the listing: its exact spelling is covered
+        # (as a known bug) in FatDirectoryEntries.
+        return next(e["name"] for e in self.root.values()
+                    if e["short_name"] == "_EMOVE~1.TXT")
+
+    def test_single_cluster_file_content(self):
+        e = self.root["HELLO.TXT"]
+        self.assertEqual(e["start_cluster"], L["hello"]["cluster"])
+        self.assertEqual(self.fs.read_file(e), build.HELLO_TEXT)
+        self.assertEqual(self.fs.read_file(e, max_bytes=5), b"Hello")
+
+    def test_fragmented_chain_content_and_runs(self):
+        e = self.root["Long file name.txt"]
+        self.assertEqual(self.fs.chain(e["start_cluster"]),
+                         list(build.LONG_CLUSTERS))
+        self.assertEqual(self.fs.read_file(e), build.long_content())
+        runs = self.fs.runs(e["start_cluster"], e["size"])
+        self.assertEqual(
+            [(r["offset"], r["length"], r["used"], r["clusters"])
+             for r in runs],
+            [(self.fs.cluster_offset(4), 2 * C, 2 * C, 2),
+             (self.fs.cluster_offset(9), C, 100, 1)])
+
+    def test_read_range_across_fragment_boundary(self):
+        e = self.root["Long file name.txt"]
+        want = build.long_content()
+        self.assertEqual(self.fs.read_range(e, 1000, 100), want[1000:1100])
+        # Reads are clamped to the file size.
+        self.assertEqual(self.fs.read_range(e, 1100, 500), want[1100:])
+        self.assertEqual(self.fs.read_range(e, 5000, 10), b"")
+
+    def test_subdirectory_spanning_two_clusters(self):
+        sub = self.root["SUBDIR"]
+        self.assertEqual(self.fs.chain(sub["start_cluster"]),
+                         list(L["subdir"]["clusters"]))
+        entries = by_name(self.fs.listdir(sub["start_cluster"], "/SUBDIR"))
+        self.assertNotIn(".", entries)
+        self.assertNotIn("..", entries)
+        self.assertEqual(len(entries), L["subdir_fillers"] + 1)
+        nested = entries["NESTED.BIN"]
+        self.assertEqual(nested["path"], "/SUBDIR/NESTED.BIN")
+        self.assertEqual(self.fs.read_file(nested), build.nested_content())
+
+    def test_cyclic_chain_is_cut_not_followed_forever(self):
+        e = self.root["CYCLE.BIN"]
+        self.assertEqual(self.fs.chain(e["start_cluster"]),
+                         list(L["cycle"]["clusters"]))
+        self.assertEqual(self.fs.read_file(e), b"A" * C + b"B" * C)
+
+    def test_allocated_extents_cover_live_files_only(self):
+        extents = self.fs.allocated_extents()
+        starts = {s for s, _ in extents}
+        self.assertIn(self.fs.cluster_offset(L["hello"]["cluster"]), starts)
+        self.assertIn(self.fs.cluster_offset(L["nested"]["clusters"][0]),
+                      starts)
+        self.assertNotIn(self.fs.cluster_offset(L["deleted"]["cluster"]),
+                         starts)
+
+
+class Fat12(_FatWidth, unittest.TestCase):
+    bits = 12
+
+
+class Fat16(_FatWidth, unittest.TestCase):
+    bits = 16
+
+
+class Fat32(_FatWidth, unittest.TestCase):
+    bits = 32
+
+
+class FatDirectoryEntries(unittest.TestCase):
+    """Entry-level behaviour that does not depend on the FAT width (FAT16)."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.image = cls.files.open(build.build_fat(16))
+        _layout, _part, cls.fs = open_first_volume(cls.image)
+        cls.entries = cls.fs.listdir(0)
+        cls.root = by_name(cls.entries)
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    def test_timestamps(self):
+        e = self.root["HELLO.TXT"]
+        # 10:20:30 plus a 10 ms-resolution byte of 150 -> 31 s.
+        self.assertEqual(e["created"], "2024-03-15T10:20:31Z")
+        self.assertEqual(e["modified"], "2024-03-15T13:45:30Z")
+        self.assertEqual(e["accessed"], "2024-03-16T00:00:00Z")
+        self.assertIsNone(self.root["CYCLE.BIN"]["modified"])
+
+    def test_attributes(self):
+        self.assertEqual(self.root["HELLO.TXT"]["attributes"], ["archive"])
+        self.assertEqual(self.root["SUBDIR"]["attributes"], ["directory"])
+
+    def test_long_filename_and_short_alias(self):
+        e = self.root["Long file name.txt"]
+        self.assertEqual(e["short_name"], "LONGFI~1.TXT")
+        self.assertFalse(e["deleted"])
+
+    def test_deleted_entry_without_lfn(self):
+        e = self.root["_ELETED.TXT"]
+        self.assertTrue(e["deleted"])
+        self.assertEqual(e["size"], build.DELETED_SIZE)
+        # The FAT chain is gone; content is read contiguously from the start.
+        self.assertEqual(self.fs.read_file(e), build.deleted_content())
+        self.assertEqual(self.fs.read_range(e, 500, 50),
+                         build.deleted_content()[500:550])
+        self.assertIn("recovery", self.fs.stat(e))
+
+    def test_deleted_entry_first_character_recovered_from_lfn(self):
+        # Deletion overwrites only the first byte of each entry; the long
+        # name keeps the character the short name lost.
+        e = self.root[build.GONE_NAME]
+        self.assertTrue(e["deleted"])
+        self.assertEqual(e["short_name"], "_ONEFI~1.TXT")
+        self.assertEqual(self.fs.read_file(e), build.GONE_TEXT)
+        by_short = {x["short_name"]: x for x in self.entries if x["deleted"]}
+        self.assertEqual(self.fs.read_file(by_short["_EMOVE~1.TXT"]),
+                         build.deleted_lfn_content())
+
+    # Bug: fat.py sorts LFN parts by (seq & 0x3F), but deletion overwrites
+    # every sequence byte with 0xE5, so multi-part deleted names come out in
+    # on-disk (reverse) order: "ent.txtRemoved docum".
+    @unittest.expectedFailure
+    def test_deleted_multi_part_lfn_is_in_order(self):
+        names = {e["name"] for e in self.entries if e["deleted"]}
+        self.assertIn(build.DELETED_LFN_NAME, names)
+
+    def test_file_slack(self):
+        e = self.root["HELLO.TXT"]
+        slack = self.fs.slack(e)
+        off = self.fs.cluster_offset(L["hello"]["cluster"])
+        self.assertEqual(slack, {"offset": off + len(build.HELLO_TEXT),
+                                 "length": C - len(build.HELLO_TEXT)})
+        got = self.fs.source.read_at(slack["offset"], slack["length"])
+        self.assertEqual(got, build.fill(slack["length"], build.SLACK_MARK))
+        self.assertEqual(self.fs.stat(e)["slack"], slack)
+
+    def test_no_slack_for_directories_or_exact_fit(self):
+        self.assertIsNone(self.fs.slack(self.root["SUBDIR"]))
+        exact = dict(self.root["HELLO.TXT"], size=C)
+        self.assertIsNone(self.fs.slack(exact))
+
+    # Bug: fat.py slack() walks the (freed) FAT chain for deleted files, so it
+    # reports slack inside the first cluster (offset of cluster 12 + 188),
+    # i.e. inside the content read_file() just returned, instead of after it.
+    @unittest.expectedFailure
+    def test_deleted_multi_cluster_file_slack_follows_its_content(self):
+        e = self.root["_ELETED.TXT"]
+        tail = build.DELETED_SIZE - C
+        self.assertEqual(self.fs.slack(e), {
+            "offset": self.fs.cluster_offset(L["deleted"]["cluster"] + 1)
+            + tail,
+            "length": C - tail})
+
+
+class FatInMbrPartition(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    def test_partition_found_and_opened(self):
+        image = self.files.open(build.wrap_mbr(build.build_fat(16), 63, 0x06))
+        scheme, parts = volume.parse_mbr(image)
+        self.assertEqual(scheme, "MBR")
+        self.assertEqual(len(parts), 1)
+        self.assertEqual(parts[0]["offset"], 63 * 512)
+        self.assertEqual(parts[0]["type"], "FAT16")
+        layout, part, fs = open_first_volume(image)
+        self.assertEqual(layout["scheme"], "MBR")
+        self.assertEqual(part["detected"], "FAT16")
+        self.assertEqual(part["label"], "STRATATEST")
+        self.assertIn("HELLO.TXT", by_name(fs.listdir(0)))
+        self.assertEqual(fs.read_file(by_name(fs.listdir(0))["HELLO.TXT"]),
+                         build.HELLO_TEXT)
+
+    def test_table_type_disagreeing_with_boot_record_is_noted(self):
+        image = self.files.open(build.wrap_mbr(build.build_fat(12), 63, 0x83))
+        part = next(p for p in volume.scan(image)["partitions"]
+                    if p.get("slot") == "MBR 1")
+        self.assertEqual(part["detected"], "FAT12")
+        self.assertIn("FAT12", part.get("note", ""))
+
+
+class FatRobustness(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.good = build.build_fat(12)
+
+    def open_bytes(self, data):
+        return ntfs.open_fs(OffsetReader(BytesImage(data), 0, len(data)))
+
+    def test_random_garbage_is_not_a_filesystem(self):
+        rng = random.Random(1234)
+        junk = bytes(rng.getrandbits(8) for _ in range(64 * 1024))
+        with self.assertRaises(ValueError):
+            self.open_bytes(junk)
+        with self.assertRaises(ValueError):
+            fat.FatFS(BytesImage(junk))
+
+    def test_garbage_bpb_with_boot_signature_is_rejected(self):
+        rng = random.Random(99)
+        junk = bytearray(rng.getrandbits(8) for _ in range(8192))
+        junk[11:13] = b"\x00\x03"         # 768 bytes per sector: implausible
+        junk[510:512] = b"\x55\xAA"
+        with self.assertRaises(ValueError):
+            fat.FatFS(BytesImage(junk))
+
+    def test_empty_and_tiny_images(self):
+        for data in (b"", b"\x00" * 100, self.good[:511]):
+            with self.assertRaises(ValueError):
+                self.open_bytes(data)
+
+    def test_truncated_volume_is_refused(self):
+        files = ImageFiles()
+        self.addCleanup(files.close)
+        image = files.open(self.good[:4096])
+        with self.assertRaises(ValueError):
+            ntfs.open_fs(OffsetReader(image, 0, image.size))
+
+    def test_listing_a_nonsense_cluster_is_empty(self):
+        fs = fat.FatFS(BytesImage(self.good))
+        self.assertEqual(fs.listdir(0x0FFFFFF0), [])
+        self.assertEqual(fs.chain(1), [])
+
+    def test_mutated_boot_sector_fails_cleanly(self):
+        # Every BPB byte set to 0x00 and 0xFF in turn: the parser either
+        # refuses the volume with ValueError or lists it without crashing.
+        for at in range(11, 62):
+            for value in (0x00, 0xFF):
+                data = bytearray(self.good)
+                data[at] = value
+                try:
+                    fs = fat.FatFS(BytesImage(data))
+                except ValueError:
+                    continue
+                with self.subTest(offset=at, value=value):
+                    self.assertIsInstance(fs.listdir(0), list)
+
+    def test_mutated_root_directory_does_not_crash(self):
+        fs = fat.FatFS(BytesImage(self.good))
+        root = (fs.reserved_sectors + fs.num_fats * fs.fat_size) * 512
+        rng = random.Random(7)
+        for trial in range(40):
+            data = bytearray(self.good)
+            for _ in range(16):
+                data[root + rng.randrange(0, 12 * 32)] = rng.getrandbits(8)
+            fs = fat.FatFS(BytesImage(data))
+            with self.subTest(trial=trial):
+                for e in fs.listdir(0):
+                    if not e["is_dir"]:
+                        fs.read_file(e, max_bytes=1 << 16)
+                        fs.stat(e)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_fs_ntfs.py b/tests/test_fs_ntfs.py
new file mode 100644
index 0000000..664c359
--- /dev/null
+++ b/tests/test_fs_ntfs.py
@@ -0,0 +1,413 @@
+"""Unit tests for the NTFS parser (engine.fs.ntfs), LZNT1 (engine.fs.lznt1)
+and the GPT reader (engine.volume.parse_gpt).
+
+Images come from tests/imagebuild_ntfs.py and are opened the way the server
+opens evidence: ewf.open_image -> volume.scan -> OffsetReader -> ntfs.open_fs.
+"""
+
+import os
+import random
+import struct
+import sys
+import unittest
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.dirname(HERE))
+sys.path.insert(0, HERE)
+
+import imagebuild_ntfs as build                                  # noqa: E402
+from test_fs_fat import BytesImage, ImageFiles, by_name, \
+    open_first_volume                                            # noqa: E402
+from engine import volume                                        # noqa: E402
+from engine.ewf import OffsetReader                              # noqa: E402
+from engine.fs import lznt1, ntfs                                # noqa: E402
+from engine.fs.streams import NoSuchStream                       # noqa: E402
+
+C = build.CLUSTER
+REC = build.REC
+
+
+class NtfsOnGpt(unittest.TestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.files = ImageFiles()
+        cls.volume = build.build_ntfs()
+        cls.image = cls.files.open(build.wrap_gpt(cls.volume))
+        cls.layout, cls.part, cls.fs = open_first_volume(cls.image)
+        cls.root = by_name(cls.fs.listdir(5))
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.files.close()
+
+    # -- partition table and boot sector ------------------------------------
+
+    def test_gpt_partition_detected(self):
+        scheme, parts, findings = volume.parse_gpt(self.image)
+        self.assertEqual(scheme, "GPT")
+        self.assertEqual(findings, [])
+        self.assertEqual(len(parts), 1)
+        p = parts[0]
+        self.assertEqual(p["type"], "Microsoft Basic Data")
+        self.assertEqual(p["name"], "Strata data")
+        self.assertEqual(p["offset"], 2048 * 512)
+        self.assertEqual(p["size"], len(self.volume))
+        self.assertEqual(self.layout["scheme"], "GPT")
+        self.assertEqual(self.part["detected"], "NTFS")
+        self.assertEqual(self.part["label"], build.VOLUME_LABEL)
+
+    def test_damaged_primary_gpt_falls_back_to_backup(self):
+        disk = bytearray(build.wrap_gpt(self.volume))
+        disk[2 * 512 + 60] ^= 0xFF                 # inside the entry name
+        scheme, parts, findings = volume.parse_gpt(BytesImage(disk))
+        self.assertEqual(scheme, "GPT")
+        self.assertEqual(len(parts), 1)
+        self.assertEqual(parts[0]["name"], "Strata data")
+        text = " ".join(findings)
+        self.assertIn("checksum", text)
+        self.assertIn("backup", text)
+
+    def test_mbr_view_is_protective(self):
+        scheme, parts = volume.parse_mbr(self.image)
+        self.assertEqual(scheme, "GPT protective")
+
+    def test_boot_sector_fields(self):
+        self.assertIsInstance(self.fs, ntfs.NtfsFS)
+        info = self.fs.info()
+        self.assertEqual(info["label"], build.VOLUME_LABEL)
+        self.assertEqual(info["bytes_per_sector"], 512)
+        self.assertEqual(info["sectors_per_cluster"], 2)
+        self.assertEqual(info["cluster_size"], C)
+        self.assertEqual(info["mft_offset"], build.MFT_LCN * C)
+        self.assertEqual(info["mft_record_size"], build.RECORD)
+        self.assertEqual(info["mft_records"], build.MFT_RECORDS)
+        self.assertEqual(info["serial"], "%016X" % build.SERIAL)
+        self.assertEqual(self.fs.mftmirr_cluster, build.MFTMIRR_LCN)
+
+    # -- records, fixups, names, timestamps ---------------------------------
+
+    def test_root_listing(self):
+        for name in ("hello.txt", "big.bin", "ads.txt", "deleted.txt", "Docs",
+                     "sparse.bin", "compressed.txt",
+                     "Long filename document.txt", "fixup.txt", "torn.txt",
+                     "$MFT", "$Volume"):
+            self.assertIn(name, self.root)
+        self.assertNotIn("note.txt", self.root)
+        self.assertEqual(self.root["hello.txt"]["path"], "/hello.txt")
+        self.assertTrue(self.root["Docs"]["is_dir"])
+        self.assertTrue(self.root["$MFT"]["system"])
+
+    def test_directory_listing(self):
+        docs = self.root["Docs"]
+        inside = self.fs.listdir(docs["mft"], "/Docs")
+        self.assertEqual([e["name"] for e in inside], ["note.txt"])
+        self.assertEqual(inside[0]["path"], "/Docs/note.txt")
+        self.assertEqual(self.fs.read_file(inside[0]), build.NOTE_TEXT)
+
+    def test_fixups_restore_bytes_at_stride_end(self):
+        e = self.root["fixup.txt"]
+        self.assertTrue(e["fixup_ok"])
+        self.assertEqual(self.fs.read_file(e), build.fixup_content())
+
+    def test_torn_record_flagged(self):
+        e = self.root["torn.txt"]
+        self.assertFalse(e["fixup_ok"])
+        self.assertTrue(self.root["hello.txt"]["fixup_ok"])
+
+    def test_apply_fixups_directly(self):
+        raw = build.mft_record(40, [build.resident_attr(
+            0x80, bytes(range(256)) * 3)])
+        self.assertEqual(raw[510:512], build.USN)
+        fixed, ok = ntfs.apply_fixups(raw, 512)
+        self.assertTrue(ok)
+        self.assertNotEqual(fixed[510:512], build.USN)
+        torn = build.mft_record(40, [], tear=True)
+        self.assertFalse(ntfs.apply_fixups(torn, 512)[1])
+        self.assertEqual(ntfs.apply_fixups(b"FILE", 512), (b"FILE", False))
+
+    def test_si_and_fn_timestamps_are_kept_apart(self):
+        rec = self.fs.record(REC["hello"])
+        si, fn = build.SI_TIMES, build.FN_TIMES
+        self.assertEqual(rec.si["created"], build.iso(si["created"]))
+        self.assertEqual(rec.si["modified"], build.iso(si["modified"]))
+        self.assertEqual(rec.si["mft_modified"], build.iso(si["mft_modified"]))
+        self.assertEqual(rec.si["accessed"], build.iso(si["accessed"]))
+        name = rec.names[0]
+        self.assertEqual(name["fn_created"], build.iso(fn["created"]))
+        self.assertEqual(name["fn_modified"], build.iso(fn["modified"]))
+        self.assertEqual(name["fn_mft_modified"],
+                         build.iso(fn["mft_modified"]))
+        self.assertEqual(name["fn_accessed"], build.iso(fn["accessed"]))
+        node = self.root["hello.txt"]
+        self.assertEqual(node["created"], build.iso(si["created"]))
+        self.assertEqual(node["fn_created"], build.iso(fn["created"]))
+        self.assertEqual(node["fn_modified"], build.iso(fn["modified"]))
+
+    def test_win32_name_preferred_over_dos_name(self):
+        e = self.root["Long filename document.txt"]
+        names = self.fs.stat(e)["names"]
+        self.assertEqual({n["name"]: n["namespace"] for n in names},
+                         {"Long filename document.txt": 1, "LONGFI~1.TXT": 2})
+        self.assertNotIn("LONGFI~1.TXT", self.root)
+
+    def test_deleted_record(self):
+        e = self.root["deleted.txt"]
+        self.assertTrue(e["deleted"])
+        self.assertFalse(self.fs.record(REC["deleted"]).in_use)
+        self.assertEqual(self.fs.read_file(e), build.DELETED_TEXT)
+        self.assertIn("recovery", self.fs.stat(e))
+        live = {s for s, _ in self.fs.allocated_extents()}
+        self.assertIn(40 * C, live)
+
+    # -- $DATA --------------------------------------------------------------
+
+    def test_resident_data(self):
+        e = self.root["hello.txt"]
+        self.assertTrue(e["resident"])
+        self.assertEqual(e["size"], len(build.HELLO_TEXT))
+        self.assertEqual(self.fs.read_file(e), build.HELLO_TEXT)
+        self.assertEqual(self.fs.read_range(e, 7, 4), b"NTFS")
+        data = [a for a in self.fs.stat(e)["attributes"]
+                if a["type"] == "$DATA"]
+        self.assertTrue(data[0]["resident"])
+        self.assertNotIn("slack", self.fs.stat(e))
+
+    def test_non_resident_data_runs_and_slack(self):
+        e = self.root["big.bin"]
+        self.assertIsNone(e["resident"])
+        want = build.big_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_range(e, 2000, 100), want[2000:2100])
+        self.assertEqual(self.fs.read_file(e, max_bytes=10), want[:10])
+        info = self.fs.stat(e)
+        self.assertEqual(
+            [(r["offset"], r["length"], r["used"]) for r in info["runs"]],
+            [(40 * C, 2 * C, 2 * C), (60 * C, C, build.BIG_SIZE - 2 * C)])
+        self.assertEqual(info["slack"], {"offset": 60 * C + C - 300,
+                                         "length": 300})
+        self.assertEqual(self.fs.source.read_at(60 * C + C - 300, 300),
+                         build.fill(300, build.SLACK_MARK))
+
+    def test_sparse_runs_read_as_zeros(self):
+        e = self.root["sparse.bin"]
+        want = build.sparse_content()
+        self.assertEqual(self.fs.read_file(e), want)
+        self.assertEqual(self.fs.read_range(e, 1000, 2200),
+                         want[1000:3200])
+        runs = self.fs.stat(e)["runs"]
+        self.assertEqual([r["sparse"] for r in runs], [False, True, False])
+
+    def test_decode_runlist_vector(self):
+        # (40 x2) (+20 -> 60 x1) (sparse x3) (-50 -> 10 x1)
+        raw = b"\x11\x02\x28\x11\x01\x14\x01\x03\x11\x01\xCE\x00"
+        self.assertEqual(ntfs.decode_runlist(raw),
+                         [(40, 2), (60, 1), (None, 3), (10, 1)])
+        # The builder encodes the same list to the same bytes.
+        self.assertEqual(build.encode_runs(
+            [(40, 2), (60, 1), (None, 3), (10, 1)]), raw)
+
+    def test_decode_runlist_stops_at_impossible_runs(self):
+        findings = []
+        runs = ntfs.decode_runlist(b"\x11\x02\x05\x11\x40\x01\x00", 20,
+                                   findings)
+        self.assertEqual(runs, [(5, 2)])
+        self.assertEqual(findings, [ntfs.RUN_TOO_LONG])
+        findings = []
+        self.assertEqual(ntfs.decode_runlist(b"\x11\x01\xF0\x00", 20,
+                                             findings), [])
+        self.assertEqual(findings, [ntfs.RUN_OUT_OF_VOLUME])
+        self.assertEqual(ntfs.decode_runlist(b"\x44\x01"), [])
+
+    # -- alternate data streams ---------------------------------------------
+
+    def test_alternate_data_streams(self):
+        e = self.root["ads.txt"]
+        self.assertEqual(e["size"], len(build.ADS_MAIN))
+        self.assertEqual(e["streams"], [
+            {"name": "Zone.Identifier", "size": len(build.ZONE_ID)},
+            {"name": "secret", "size": build.SECRET_SIZE}])
+        self.assertEqual(self.fs.read_file(e), build.ADS_MAIN)
+        self.assertEqual(self.fs.read_file(e, stream="Zone.Identifier"),
+                         build.ZONE_ID)
+        self.assertEqual(self.fs.read_file(e, stream="secret"),
+                         build.secret_content())
+        self.assertEqual(self.fs.read_range(e, 10, 5, stream="secret"),
+                         build.secret_content()[10:15])
+        streams = {s["name"]: s for s in self.fs.streams(e)}
+        self.assertTrue(streams[""]["default"])
+        self.assertTrue(streams["Zone.Identifier"]["resident"])
+        self.assertFalse(streams["secret"]["resident"])
+        info = self.fs.stat(e, "secret")
+        self.assertEqual(info["runs"][0]["offset"], build.SECRET_LCN * C)
+        self.assertEqual(info["slack"]["length"], C - build.SECRET_SIZE)
+
+    def test_missing_stream(self):
+        e = self.root["ads.txt"]
+        with self.assertRaises(NoSuchStream) as ctx:
+            self.fs.read_file(e, stream="nope")
+        self.assertEqual(ctx.exception.available,
+                         ["Zone.Identifier", "secret"])
+        self.assertTrue(self.fs.stat(e, "nope")["stream_missing"])
+
+    # -- compression --------------------------------------------------------
+
+    def test_lznt1_compressed_attribute(self):
+        e = self.root["compressed.txt"]
+        self.assertEqual(self.fs.read_file(e), build.COMPRESSED_TEXT)
+        self.assertEqual(self.fs.read_range(e, 600, 30),
+                         build.COMPRESSED_TEXT[600:630])
+        info = self.fs.stat(e)
+        self.assertTrue(info["runs_compressed"])
+        self.assertEqual(self.fs.findings, [])
+
+    # -- known engine bugs --------------------------------------------------
+
+    # Bug: ntfs.py record() caches the parsed record before checking
+    # rec.valid (lines 428-430) and returns the cache hit unchecked (418), so
+    # an unformatted record is None the first time and an invalid MftRecord
+    # (no .sequence; stat() then raises AttributeError) every time after.
+    @unittest.expectedFailure
+    def test_invalid_record_stays_invalid_on_second_lookup(self):
+        fs = ntfs.NtfsFS(BytesImage(self.volume))
+        self.assertIsNone(fs.record(30))
+        self.assertIsNone(fs.record(30))
+
+
+class Lznt1(unittest.TestCase):
+
+    def test_back_reference(self):
+        self.assertEqual(lznt1.decompress(b"\x05\xb0\x08abc\x06\x20"),
+                         b"abcabcabcabc")
+
+    def test_displacement_width_grows_with_position(self):
+        # 17 literals, then token 0x8007 at position 17: 5 displacement bits
+        # and 11 length bits -> offset 17, length 10. A decoder still on the
+        # 4/12 split would read offset 9 instead.
+        body = (b"\x00ABCDEFGH" + b"\x00IJKLMNOP" + b"\x02Q"
+                + struct.pack("<H", 0x8007))
+        chunk = struct.pack("<H", 0xB000 | (len(body) - 1)) + body
+        self.assertEqual(lznt1.decompress(chunk),
+                         b"ABCDEFGHIJKLMNOPQ" + b"ABCDEFGHIJ")
+
+    def test_uncompressed_chunk_and_padding(self):
+        self.assertEqual(lznt1.decompress(b"\x04\x30hello"), b"hello")
+        self.assertEqual(lznt1.decompress(b"\x04\x30hello", 8),
+                         b"hello\x00\x00\x00")
+        self.assertEqual(lznt1.decompress(b"\x00\x00trailing"), b"")
+
+    def test_malformed_input_does_not_raise(self):
+        good = b"\x05\xb0\x08abc\x06\x20"
+        for cut in range(len(good)):
+            self.assertIsInstance(lznt1.decompress(good[:cut]), bytes)
+        # Back-reference before the start of output.
+        self.assertEqual(lznt1.decompress(b"\x02\xb0\x01\x05\x00"), b"")
+        rng = random.Random(3)
+        for _ in range(200):
+            junk = bytes(rng.getrandbits(8) for _ in range(64))
+            self.assertIsInstance(lznt1.decompress(junk, 4096), bytes)
+
+
+class NtfsRobustness(unittest.TestCase):
+    """Nothing here lists a damaged volume: listdir walks every record the
+    MFT claims, and see test_record_count_bounded_by_volume for why that can
+    be millions on a damaged one."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.good = build.build_ntfs()
+
+    def open_bytes(self, data):
+        return ntfs.open_fs(OffsetReader(BytesImage(data), 0, len(data)))
+
+    def test_unpartitioned_probe(self):
+        img = BytesImage(self.good)
+        self.assertEqual(volume.identify_fs(img, 0), "NTFS")
+        part = volume.scan(img)["partitions"][0]
+        self.assertEqual(part["detected"], "NTFS")
+        self.assertEqual(part["label"], build.VOLUME_LABEL)
+
+    def test_random_garbage_is_not_a_filesystem(self):
+        rng = random.Random(11)
+        junk = bytes(rng.getrandbits(8) for _ in range(16384))
+        with self.assertRaises(ValueError):
+            self.open_bytes(junk)
+        with self.assertRaises(ValueError):
+            ntfs.NtfsFS(BytesImage(junk))
+
+    def test_truncated_volume(self):
+        files = ImageFiles()
+        self.addCleanup(files.close)
+        image = files.open(self.good[:8192])
+        fs = ntfs.open_fs(OffsetReader(image, 0, image.size))
+        self.assertIsNone(fs.record(REC["hello"]))
+        self.assertIsInstance(fs.info(), dict)
+
+    def test_mutated_boot_sector(self):
+        for at in range(11, 80):
+            for value in (0x00, 0x80, 0xFF):
+                data = bytearray(self.good)
+                data[at] = value
+                with self.subTest(offset=at, value=value):
+                    try:
+                        fs = self.open_bytes(data)
+                    except ValueError:
+                        continue
+                    rec = fs.record(REC["hello"])
+                    if rec is not None:
+                        self.assertIsInstance(rec.names, list)
+
+    def record_offset(self, n):
+        return build.MFT_LCN * C + n * build.RECORD
+
+    def test_zero_attribute_length(self):
+        data = bytearray(self.good)
+        at = self.record_offset(REC["hello"]) + 56 + 4       # first attr
+        struct.pack_into("<I", data, at, 0)
+        fs = ntfs.NtfsFS(BytesImage(data))
+        rec = fs.record(REC["hello"])
+        self.assertTrue(rec.valid)
+        self.assertEqual(rec.attrs, [])
+        self.assertEqual(fs.read_file({"mft": REC["hello"]}), b"")
+
+    def test_run_longer_than_volume(self):
+        data = bytearray(self.good)
+        base = self.record_offset(REC["big"])
+        at = self.good.index(b"\x11\x02\x28", base, base + build.RECORD)
+        data[at + 1] = 0xF0                           # 240 clusters > 127
+        fs = ntfs.NtfsFS(BytesImage(data))
+        self.assertEqual(fs.read_file({"mft": REC["big"]}), b"")
+        self.assertIn(ntfs.RUN_TOO_LONG, fs.findings)
+
+    def test_random_record_damage(self):
+        base = self.record_offset(REC["big"])
+        rng = random.Random(8)
+        for trial in range(60):
+            data = bytearray(self.good)
+            for _ in range(8):
+                data[base + rng.randrange(0, 510)] = rng.getrandbits(8)
+            with self.subTest(trial=trial):
+                fs = ntfs.NtfsFS(BytesImage(data))
+                rec = fs.record(REC["big"])
+                if rec is None:
+                    continue
+                for a in rec.data_attrs():
+                    fs.read_attr(a, max_bytes=1 << 16)
+                fs.stat({"mft": REC["big"]})
+
+    # Bug: when record 0's $DATA cannot be read, ntfs.py line 401 assumes an
+    # MFT of 1 << 20 clusters, not bounded by cluster_count. A 4 KB image
+    # with 4 KB clusters then claims 4,194,304 records, and build_tree()
+    # (every listdir) reads them all: ~1.8 s here, and it scales with
+    # cluster size — minutes for 64 KB clusters.
+    @unittest.expectedFailure
+    def test_record_count_bounded_by_volume(self):
+        data = bytearray(self.good[:4096])
+        data[13] = 8                                  # 4096-byte clusters
+        fs = ntfs.NtfsFS(BytesImage(data))
+        most = fs.cluster_count * fs.cluster_size // fs.record_size
+        self.assertLessEqual(fs.record_count, most)
+
+
+if __name__ == "__main__":
+    unittest.main()

From d782d14d0eed939a0eb33422dd5f64b398834ee2 Mon Sep 17 00:00:00 2001
From: deadp <deadp@users.noreply.github.com>
Date: Wed, 16 Sep 2026 21:51:54 +1200
Subject: [PATCH 5/7] Add mutation fuzzing for the evidence parsers

tests/fuzz.py mutates the synthetic images and drives the app's own entry
points in a child worker, so hangs and memory blow-ups are caught and
their inputs kept for replay. It runs in its own workflow: briefly and
non-blocking on PRs that touch the engine, and at length weekly or on
demand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/fuzz.yml |  60 +++++
 .gitignore                 |   1 +
 tests/fuzz.py              | 467 +++++++++++++++++++++++++++++++++++++
 3 files changed, 528 insertions(+)
 create mode 100644 .github/workflows/fuzz.yml
 create mode 100644 tests/fuzz.py

diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
new file mode 100644
index 0000000..a58147c
--- /dev/null
+++ b/.github/workflows/fuzz.yml
@@ -0,0 +1,60 @@
+name: Fuzz
+
+# Mutation fuzzing of the evidence parsers (tests/fuzz.py).  Kept out of the
+# main CI workflow on purpose: it runs against a time budget rather than to
+# completion, and a finding is something to triage, not a reason to block an
+# unrelated PR.  Findings are uploaded as an artifact with their inputs, and
+# each can be replayed locally with `python3 tests/fuzz.py --replay <file>`.
+
+on:
+  pull_request:
+    paths:
+      - 'engine/**'
+      - 'tests/fuzz.py'
+      - 'tests/imagebuild_*.py'
+  schedule:
+    - cron: '41 4 * * 2'
+  workflow_dispatch:
+    inputs:
+      minutes:
+        description: 'Time budget in minutes'
+        default: '20'
+      target:
+        description: 'Target (all, fat16, ntfs, ext4, hive, ewf, ...)'
+        default: 'all'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz parsers
+    runs-on: ubuntu-latest
+    # A PR gets a short pass over whatever it touched; the weekly run and a
+    # manual dispatch get long enough to find the less shallow problems.
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - name: Run the fuzzer
+        env:
+          MINUTES: ${{ github.event_name == 'pull_request' && '3' || github.event.inputs.minutes || '45' }}
+          TARGET: ${{ github.event.inputs.target || 'all' }}
+        run: |
+          python tests/fuzz.py --minutes "$MINUTES" --target "$TARGET" \
+            --seed "${{ github.run_id }}" --out fuzz-findings
+      - name: Upload findings
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-findings
+          path: fuzz-findings/
+          if-no-files-found: ignore
+          retention-days: 30
diff --git a/.gitignore b/.gitignore
index 19d485d..7b19843 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@
 /exports/
 /reports/
 *-report.html
+/fuzz-findings/
 
 # Python
 __pycache__/
diff --git a/tests/fuzz.py b/tests/fuzz.py
new file mode 100644
index 0000000..61466bb
--- /dev/null
+++ b/tests/fuzz.py
@@ -0,0 +1,467 @@
+"""Mutation fuzzing for the parsers that read untrusted evidence.
+
+Seeds are the synthetic images from tests/imagebuild_*.py.  Each case takes
+one seed, applies a few random mutations (bit flips, interesting integers,
+truncation, duplicated spans) and drives the same entry points the app uses:
+open the filesystem and walk it, open a hive and walk it, open an E01 and
+read and verify it.
+
+What counts as a finding:
+
+  hang       a single case ran past --case-timeout
+  memory     the worker died or raised MemoryError under --memory-mb
+  exception  anything other than a clean error (ValueError and the engine's
+             own exception classes).  Reported, but only fails the run with
+             --strict, since the server turns these into a 500 rather than
+             losing the session.
+
+Cases run in a child worker so a hang or an out-of-memory kill takes down
+only the worker; the parent records the input and starts a new one.  Every
+finding's input is written to --out with a JSON summary, and can be replayed:
+
+    python3 tests/fuzz.py --minutes 5
+    python3 tests/fuzz.py --target ext4 --cases 2000 --seed 7
+    python3 tests/fuzz.py --replay fuzz-findings/ext4-hang-1a2b3c4d.bin
+
+This is meant for CI (see .github/workflows/fuzz.yml).  The memory cap uses
+RLIMIT_AS and is only enforced on Linux.
+"""
+
+import argparse
+import hashlib
+import json
+import os
+import queue
+import random
+import struct
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import traceback
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ROOT = os.path.dirname(HERE)
+sys.path.insert(0, ROOT)
+sys.path.insert(0, HERE)
+
+# Hard caps inside each case, so a finding is about the parser rather than
+# about the harness asking for too much.
+WALK_BUDGET = 2000
+WALK_DEPTH = 16
+READ_FILES = 40
+READ_BYTES = 1 << 16
+HIVE_KEYS = 2000
+
+
+# --- targets ---------------------------------------------------------------
+
+class BytesImage:
+    """ewf.RawImage stand-in over bytes."""
+
+    bytes_per_sector = 512
+
+    def __init__(self, data):
+        self.data = data
+        self.size = len(data)
+        self.findings = []
+
+    def read_at(self, offset, length):
+        if offset < 0 or length <= 0 or offset >= self.size:
+            return b""
+        return self.data[offset:offset + length]
+
+
+def _root_handle(fs):
+    root = getattr(fs, "root_node", None)
+    if root is None:
+        root = {"NTFS": 5, "ext4": 2, "ext3": 2, "ext2": 2,
+                "APFS": 2}.get(getattr(fs, "name", ""), 0)
+    return root
+
+
+def run_fs(data):
+    from engine import filesearch
+    from engine.ewf import OffsetReader
+    from engine.fs import ntfs
+    src = OffsetReader(BytesImage(data), 0, len(data))
+    fs = ntfs.open_fs(src)
+    if hasattr(fs, "info"):
+        fs.info()
+    entries = filesearch.collect(fs, _root_handle(fs), budget=WALK_BUDGET,
+                                 max_depth=WALK_DEPTH)
+    read = 0
+    for e in entries:
+        if hasattr(fs, "stat"):
+            fs.stat(e)
+        if e.get("is_dir") or read >= READ_FILES:
+            continue
+        fs.read_file(e, READ_BYTES)
+        read += 1
+
+
+def run_volume(data):
+    from engine import volume
+    volume.scan(BytesImage(data))
+
+
+def run_hive(data):
+    from engine import registry
+    hive = registry.open_hive(data, "SOFTWARE")
+    if not hive:
+        return
+    seen = 0
+    stack = [hive.root()]
+    visited = set()
+    while stack and seen < HIVE_KEYS:
+        key = stack.pop()
+        if not key:
+            continue
+        marker = key.get("offset", id(key))
+        if marker in visited:
+            continue
+        visited.add(marker)
+        seen += 1
+        hive.values(key)
+        stack.extend(hive.subkeys(key))
+    hive.carve_deleted(limit=500)
+
+
+def run_reglog(data, _pair=[]):
+    import imagebuild_registry
+    from engine import reglog
+    if not _pair:
+        _pair.extend(imagebuild_registry.build_dirty_pair()[:2])
+    reglog.recover(_pair[0], [data])
+
+
+def run_ewf(data, _dir=[]):
+    from engine import ewf
+    if not _dir:
+        _dir.append(tempfile.mkdtemp(prefix="strata-fuzz-"))
+    path = os.path.join(_dir[0], "case.E01")
+    with open(path, "wb") as fh:
+        fh.write(data)
+    img = ewf.open_image(path)
+    try:
+        step = max(1, min(img.size, 1 << 20) // 64)
+        for off in range(0, min(img.size, 1 << 20), step):
+            img.read_at(off, 4096)
+        img.verify()
+    finally:
+        fh = getattr(img, "_fh", None)
+        if fh:
+            fh.close()
+
+
+def _seeds_fs():
+    import imagebuild_ext4
+    import imagebuild_fat
+    out = {
+        "fat12": lambda: imagebuild_fat.build_fat(12),
+        "fat16": lambda: imagebuild_fat.build_fat(16),
+        # No fat32: its seed is ~34 MB of mostly zeros, so mutations land in
+        # empty space.  fat12 and fat16 drive the same FatFS code paths.
+        "exfat": imagebuild_fat.build_exfat,
+        "ext4": imagebuild_ext4.build_ext4,
+        "ext2": imagebuild_ext4.build_ext2_legacy,
+    }
+    try:
+        import imagebuild_ntfs
+        out["ntfs"] = imagebuild_ntfs.build_ntfs
+    except ImportError:
+        pass
+    return out
+
+
+def targets():
+    """name -> (seed builder, runner)."""
+    import imagebuild_ewf
+    import imagebuild_fat
+    import imagebuild_registry
+    out = {}
+    for name, build in _seeds_fs().items():
+        out[name] = (build, run_fs)
+    out["mbr"] = (lambda: imagebuild_fat.wrap_mbr(imagebuild_fat.build_fat(16)),
+                  run_volume)
+    try:
+        import imagebuild_ntfs
+        out["gpt"] = (lambda: imagebuild_ntfs.wrap_gpt(
+            imagebuild_ntfs.build_ntfs()), run_volume)
+    except ImportError:
+        pass
+    out["hive"] = (imagebuild_registry.build_hive, run_hive)
+    out["reglog"] = (lambda: imagebuild_registry.build_dirty_pair()[1],
+                     run_reglog)
+    out["ewf"] = (lambda: imagebuild_ewf.build_e01()[0], run_ewf)
+    return out
+
+
+# --- mutation --------------------------------------------------------------
+
+INTERESTING = [0, 1, 0x7F, 0x80, 0xFF, 0x100, 0x7FFF, 0x8000, 0xFFFF,
+               0x7FFFFFFF, 0x80000000, 0xFFFFFFFF]
+
+
+def mutate(seed, rng):
+    data = bytearray(seed)
+    for _ in range(rng.randint(1, 8)):
+        if not data:
+            break
+        op = rng.random()
+        pos = rng.randrange(len(data))
+        if op < 0.35:
+            data[pos] ^= 1 << rng.randrange(8)
+        elif op < 0.55:
+            data[pos] = rng.choice((0, 0xFF, 0x7F, 0x80, rng.randrange(256)))
+        elif op < 0.85:
+            width, fmt = rng.choice(((2, "<H"), (4, "<I"), (8, "<Q")))
+            if pos + width <= len(data):
+                v = rng.choice(INTERESTING) & ((1 << (8 * width)) - 1)
+                struct.pack_into(fmt, data, pos, v)
+        elif op < 0.93:
+            size = rng.randint(1, 512)
+            src = rng.randrange(len(data))
+            chunk = data[src:src + size]
+            data[pos:pos + len(chunk)] = chunk
+        else:
+            del data[rng.randint(len(data) // 2, len(data)):]
+    return bytes(data)
+
+
+# --- classification --------------------------------------------------------
+
+def _clean_types():
+    """Exception classes a parser may raise to say "this input is bad"."""
+    from engine import ewf
+    from engine.fs import ntfs
+    types = [ValueError]
+    for mod in (ewf, ntfs):
+        for obj in vars(mod).values():
+            if (isinstance(obj, type) and issubclass(obj, Exception)
+                    and obj.__module__.startswith("engine")):
+                types.append(obj)
+    return tuple(types)
+
+
+def _where(tb):
+    """Innermost engine frame, which is what identifies a bug."""
+    frames = traceback.extract_tb(tb)
+    for fr in reversed(frames):
+        rel = os.path.relpath(fr.filename, ROOT)
+        if rel.startswith("engine"):
+            return "%s:%d" % (rel.replace(os.sep, "/"), fr.lineno)
+    fr = frames[-1] if frames else None
+    return "%s:%d" % (fr.filename, fr.lineno) if fr else "?"
+
+
+# --- worker ----------------------------------------------------------------
+
+def worker(args):
+    if args.memory_mb and sys.platform.startswith("linux"):
+        import resource
+        cap = args.memory_mb * 1024 * 1024
+        resource.setrlimit(resource.RLIMIT_AS, (cap, cap))
+    sys.setrecursionlimit(4000)
+    table = targets()
+    clean = _clean_types()
+    seeds = {}
+    out = sys.stdout
+    for line in sys.stdin:
+        name, case_seed = line.split()
+        build, run = table[name]
+        if name not in seeds:
+            seeds[name] = build()
+        data = mutate(seeds[name], random.Random(int(case_seed)))
+        out.write("start\n")
+        out.flush()
+        result = {"ok": True}
+        try:
+            run(data)
+        except clean:
+            pass
+        except MemoryError:
+            result = {"ok": False, "kind": "memory", "type": "MemoryError",
+                      "where": _where(sys.exc_info()[2])}
+        except RecursionError:
+            result = {"ok": False, "kind": "exception",
+                      "type": "RecursionError",
+                      "where": _where(sys.exc_info()[2])}
+        except Exception as exc:
+            result = {"ok": False, "kind": "exception",
+                      "type": type(exc).__name__, "message": str(exc)[:200],
+                      "where": _where(sys.exc_info()[2])}
+        out.write(json.dumps(result) + "\n")
+        out.flush()
+
+
+class Worker:
+
+    def __init__(self, args):
+        cmd = [sys.executable, os.path.abspath(__file__), "--worker",
+               "--memory-mb", str(args.memory_mb)]
+        self.proc = subprocess.Popen(cmd, stdin=subprocess.PIPE,
+                                     stdout=subprocess.PIPE,
+                                     universal_newlines=True, bufsize=1)
+        self.lines = queue.Queue()
+        t = threading.Thread(target=self._pump, daemon=True)
+        t.start()
+
+    def _pump(self):
+        for line in self.proc.stdout:
+            self.lines.put(line)
+        self.lines.put(None)
+
+    def run(self, name, case_seed, timeout):
+        """Returns a result dict, with kind hang/memory on worker loss."""
+        try:
+            self.proc.stdin.write("%s %d\n" % (name, case_seed))
+            self.proc.stdin.flush()
+        except (BrokenPipeError, OSError):
+            return {"ok": False, "kind": "memory", "type": "worker died"}
+        started = False
+        deadline = time.time() + timeout + 60     # seed build on first use
+        while True:
+            try:
+                line = self.lines.get(timeout=max(0.1, deadline - time.time()))
+            except queue.Empty:
+                if started:
+                    return {"ok": False, "kind": "hang",
+                            "type": "timeout %ss" % timeout}
+                return {"ok": False, "kind": "hang",
+                        "type": "seed build timed out"}
+            if line is None:
+                if not started:
+                    # Died before the case began: an import error or a
+                    # broken seed, not a finding.  Stop rather than respawn.
+                    raise RuntimeError("fuzz worker failed to start %s"
+                                       % name)
+                return {"ok": False, "kind": "memory", "type": "worker died",
+                        "returncode": self.proc.poll()}
+            if line.strip() == "start":
+                started = True
+                deadline = time.time() + timeout
+                continue
+            return json.loads(line)
+
+    def kill(self):
+        try:
+            self.proc.kill()
+            self.proc.wait(5)
+        except Exception:
+            pass
+
+
+# --- driver ----------------------------------------------------------------
+
+def record(args, name, case_seed, result, findings):
+    build, _ = targets()[name]
+    data = mutate(build(), random.Random(case_seed))
+    key = "%s|%s|%s|%s" % (name, result["kind"], result.get("type"),
+                           result.get("where"))
+    if key in findings:
+        findings[key]["count"] += 1
+        return False
+    digest = hashlib.sha256(key.encode()).hexdigest()[:8]
+    stem = "%s-%s-%s" % (name, result["kind"], digest)
+    os.makedirs(args.out, exist_ok=True)
+    with open(os.path.join(args.out, stem + ".bin"), "wb") as fh:
+        fh.write(data)
+    entry = dict(result, target=name, case_seed=case_seed, count=1,
+                 input=stem + ".bin")
+    entry.pop("ok", None)
+    findings[key] = entry
+    return True
+
+
+def fuzz(args):
+    table = targets()
+    names = sorted(table) if args.target == "all" else [args.target]
+    unknown = [n for n in names if n not in table]
+    if unknown:
+        sys.exit("unknown target: %s (have: %s)"
+                 % (", ".join(unknown), ", ".join(sorted(table))))
+    rng = random.Random(args.seed)
+    stop_at = time.time() + args.minutes * 60 if args.minutes else None
+    findings = {}
+    counts = dict((n, 0) for n in names)
+    w = Worker(args)
+    done = 0
+    try:
+        while True:
+            if args.cases and done >= args.cases:
+                break
+            if stop_at and time.time() >= stop_at:
+                break
+            name = names[done % len(names)]
+            case_seed = rng.getrandbits(48)
+            result = w.run(name, case_seed, args.case_timeout)
+            done += 1
+            counts[name] += 1
+            if result.get("ok"):
+                continue
+            if record(args, name, case_seed, result, findings):
+                print("finding: %s %s %s at %s" % (
+                    name, result["kind"], result.get("type"),
+                    result.get("where", "?")))
+                sys.stdout.flush()
+            if result["kind"] in ("hang", "memory"):
+                w.kill()
+                w = Worker(args)
+    finally:
+        w.kill()
+
+    summary = {"cases": done, "per_target": counts,
+               "findings": sorted(findings.values(),
+                                  key=lambda f: (f["kind"], f["target"]))}
+    os.makedirs(args.out, exist_ok=True)
+    with open(os.path.join(args.out, "summary.json"), "w") as fh:
+        json.dump(summary, fh, indent=2)
+    kinds = {}
+    for f in findings.values():
+        kinds[f["kind"]] = kinds.get(f["kind"], 0) + 1
+    print("fuzz: %d cases, %d distinct findings %s"
+          % (done, len(findings), json.dumps(kinds, sort_keys=True)))
+    fatal = kinds.get("hang", 0) + kinds.get("memory", 0)
+    if args.strict:
+        fatal += kinds.get("exception", 0)
+    return 1 if fatal else 0
+
+
+def replay(args):
+    name = os.path.basename(args.replay).split("-")[0]
+    table = targets()
+    if name not in table:
+        sys.exit("cannot tell the target from %s" % args.replay)
+    with open(args.replay, "rb") as fh:
+        data = fh.read()
+    table[name][1](data)
+    print("replay: %s returned without raising" % name)
+    return 0
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("--target", default="all")
+    ap.add_argument("--minutes", type=float, default=0)
+    ap.add_argument("--cases", type=int, default=0)
+    ap.add_argument("--seed", type=int, default=0)
+    ap.add_argument("--case-timeout", type=float, default=10)
+    ap.add_argument("--memory-mb", type=int, default=1024)
+    ap.add_argument("--out", default=os.path.join(ROOT, "fuzz-findings"))
+    ap.add_argument("--strict", action="store_true")
+    ap.add_argument("--replay")
+    ap.add_argument("--worker", action="store_true", help=argparse.SUPPRESS)
+    args = ap.parse_args()
+    if args.worker:
+        return worker(args)
+    if args.replay:
+        return replay(args)
+    if not args.minutes and not args.cases:
+        args.cases = 500
+    return fuzz(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From 38a138c572c81ef9f6ab584867f329ac57080f3a Mon Sep 17 00:00:00 2001
From: deadp <deadp@users.noreply.github.com>
Date: Wed, 16 Sep 2026 21:57:05 +1200
Subject: [PATCH 6/7] Close fuzzed images through their own close()

EwfImage._fh is a method, not a handle, so the harness's cleanup raised
on every EWF case and swamped the real findings.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 tests/fuzz.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tests/fuzz.py b/tests/fuzz.py
index 61466bb..079b8c8 100644
--- a/tests/fuzz.py
+++ b/tests/fuzz.py
@@ -150,9 +150,7 @@ def run_ewf(data, _dir=[]):
             img.read_at(off, 4096)
         img.verify()
     finally:
-        fh = getattr(img, "_fh", None)
-        if fh:
-            fh.close()
+        img.close()
 
 
 def _seeds_fs():

From d5250d4565362e81bfedccde93ae5f69c8759a6b Mon Sep 17 00:00:00 2001
From: deadp <deadp@users.noreply.github.com>
Date: Wed, 16 Sep 2026 22:04:03 +1200
Subject: [PATCH 7/7] Bound every size-driven read when opening EWF images

Section sizes, table base offsets, section pointers and chunk geometry all
come from the segment file, and were used directly as read lengths and seek
offsets. One corrupt descriptor could make Strata try to read gigabytes into
memory, or raise OverflowError/OSError instead of reporting the damage.

Reads now go through _read_bounded, capped by the end of the segment and by
what the format can hold. Metadata sections are capped at 1 MB, headers at
16 MB, table entries at 2^20, and chunks at the declared chunk size plus
zlib's worst-case expansion. Implausible sector or chunk sizes fall back to
the defaults. Each clip is recorded as a finding rather than dropped. A
failed open also closes its segment handles, which would otherwise stay
locked on Windows.

Found by tests/fuzz.py; the new HostileSizes tests fail on the previous
code and every recorded EWF fuzz input now opens or fails cleanly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 engine/ewf.py     | 124 ++++++++++++++++++++++++++++++++++------------
 tests/test_ewf.py |  90 +++++++++++++++++++++++++++++++++
 2 files changed, 183 insertions(+), 31 deletions(-)

diff --git a/engine/ewf.py b/engine/ewf.py
index e7cd761..96f05f5 100644
--- a/engine/ewf.py
+++ b/engine/ewf.py
@@ -20,6 +20,16 @@
 SECTION_DESC = 76
 FILE_HEADER = 13
 
+# Every size below comes from the segment file itself, so each read is bounded
+# by what the format can legitimately hold rather than by what a damaged or
+# hostile descriptor claims.  Real metadata sections are a few KB; EnCase's
+# largest chunk is 32768 sectors.
+MAX_METADATA_SECTION = 1 << 20
+MAX_HEADER_SECTION = 16 << 20
+MAX_CHUNK_SIZE = 64 << 20
+MAX_TABLE_ENTRIES = 1 << 20
+SECTOR_SIZES = (512, 1024, 2048, 4096)
+
 class EwfError(Exception):
     pass
 
@@ -93,7 +103,14 @@ def __init__(self, path, cache_chunks=64):
         self._cache_max = cache_chunks
         self._io_lock = threading.Lock()
         self._pos = 0
-        self._parse()
+        self._seg_sizes = {}
+        try:
+            self._parse()
+        except BaseException:
+            # Otherwise a failed open leaves the evidence files held open,
+            # which on Windows keeps them locked.
+            self.close()
+            raise
 
     def _fh(self, seg):
         h = self._handles.get(seg)
@@ -102,6 +119,24 @@ def _fh(self, seg):
             self._handles[seg] = h
         return h
 
+    def _seg_size(self, seg):
+        size = self._seg_sizes.get(seg)
+        if size is None:
+            size = os.fstat(self._fh(seg).fileno()).st_size
+            self._seg_sizes[seg] = size
+        return size
+
+    def _read_bounded(self, seg, offset, size, cap):
+        """Read `size` bytes at `offset`, but never past the end of the
+        segment and never more than `cap`.  Returns (data, clipped)."""
+        end = self._seg_size(seg)
+        if offset < 0 or offset >= end:
+            return b"", size > 0
+        want = min(size, end - offset, cap)
+        fh = self._fh(seg)
+        fh.seek(offset)
+        return fh.read(want), want < size
+
     def close(self):
         for h in self._handles.values():
             h.close()
@@ -135,7 +170,7 @@ def _parse(self):
                     self.findings.append("Section chain in segment %d exceeded "
                                          "sane length; stopped." % seg_index)
                     break
-                sec = self._read_section(fh, offset)
+                sec = self._read_section(seg_index, offset)
                 if sec is None:
                     break
                 self.sections.append((seg_index, sec))
@@ -143,19 +178,19 @@ def _parse(self):
                 if sec.type == "sectors":
                     sectors_extent = (sec.data_start, sec.start + sec.size)
                 elif sec.type in ("volume", "disk"):
-                    self._parse_volume(fh, sec)
+                    self._parse_volume(seg_index, sec)
                 elif sec.type == "header2":
-                    self._parse_header(fh, sec, utf16=True)
+                    self._parse_header(seg_index, sec, utf16=True)
                 elif sec.type == "header":
                     if not self.header:
-                        self._parse_header(fh, sec, utf16=False)
+                        self._parse_header(seg_index, sec, utf16=False)
                 elif sec.type == "table":
                     pending_table = sec
-                    self._parse_table(fh, sec, seg_index, sectors_extent)
+                    self._parse_table(sec, seg_index, sectors_extent)
                 elif sec.type == "digest":
-                    self._parse_digest(fh, sec)
+                    self._parse_digest(seg_index, sec)
                 elif sec.type == "hash":
-                    self._parse_hash(fh, sec)
+                    self._parse_hash(seg_index, sec)
 
                 if sec.type in ("next", "done"):
                     break
@@ -174,10 +209,13 @@ def _parse(self):
         if self.size == 0:
             self.size = len(self.chunks) * self.chunk_size
 
-    def _read_section(self, fh, offset):
-        fh.seek(offset)
-        raw = fh.read(SECTION_DESC)
+    def _read_section(self, seg, offset):
+        raw, _ = self._read_bounded(seg, offset, SECTION_DESC, SECTION_DESC)
         if len(raw) < SECTION_DESC:
+            if offset >= self._seg_size(seg):
+                self.findings.append(
+                    "Section pointer %d is past the end of segment %d; "
+                    "stopped." % (offset, seg))
             return None
         type_ = raw[0:16].split(b"\x00")[0].decode("ascii", "replace")
         next_offset, size = struct.unpack("<QQ", raw[16:32])
@@ -190,9 +228,17 @@ def _read_section(self, fh, offset):
             return None
         return Section(type_, offset, next_offset, size)
 
-    def _parse_volume(self, fh, sec):
-        fh.seek(sec.data_start)
-        data = fh.read(sec.data_size)
+    def _section_data(self, seg, sec, cap):
+        data, clipped = self._read_bounded(seg, sec.data_start, sec.data_size,
+                                           cap)
+        if clipped:
+            self.findings.append(
+                "Section '%s' at %d declares %d bytes; only %d were read."
+                % (sec.type, sec.start, sec.data_size, len(data)))
+        return data
+
+    def _parse_volume(self, seg, sec):
+        data = self._section_data(seg, sec, MAX_METADATA_SECTION)
         if len(data) < 52:
             self.findings.append("Volume section too short to parse.")
             return
@@ -203,12 +249,21 @@ def _parse_volume(self, fh, sec):
         self.sector_count = struct.unpack("<Q", data[16:24])[0]
         self.media_flags = data[36]
         self.compression_level = data[52] if len(data) > 52 else 0
+        if self.bytes_per_sector not in SECTOR_SIZES:
+            self.findings.append(
+                "Volume section declares %d bytes per sector; using 512."
+                % self.bytes_per_sector)
+            self.bytes_per_sector = 512
+        if self.sectors_per_chunk * self.bytes_per_sector > MAX_CHUNK_SIZE:
+            self.findings.append(
+                "Volume section declares %d sectors per chunk; using 64."
+                % self.sectors_per_chunk)
+            self.sectors_per_chunk = 64
         self.chunk_size = self.sectors_per_chunk * self.bytes_per_sector
         self._declared_chunks = chunk_count
 
-    def _parse_header(self, fh, sec, utf16):
-        fh.seek(sec.data_start)
-        blob = fh.read(sec.data_size)
+    def _parse_header(self, seg, sec, utf16):
+        blob = self._section_data(seg, sec, MAX_HEADER_SECTION)
         text, over = inflate_capped(blob, 1 << 20)
         if over:
             self.findings.append("Header section inflates to more than 1 MB; "
@@ -237,9 +292,8 @@ def _parse_header(self, fh, sec, utf16):
                         self.header[names.get(k, k)] = v
                 break
 
-    def _parse_table(self, fh, sec, seg_index, sectors_extent):
-        fh.seek(sec.data_start)
-        head = fh.read(24)
+    def _parse_table(self, sec, seg_index, sectors_extent):
+        head, _ = self._read_bounded(seg_index, sec.data_start, 24, 24)
         if len(head) < 24:
             self.findings.append("Table section header truncated.")
             return
@@ -248,11 +302,12 @@ def _parse_table(self, fh, sec, seg_index, sectors_extent):
         stored = struct.unpack("<I", head[20:24])[0]
         if zlib.adler32(head[:20]) & 0xFFFFFFFF != stored:
             self.findings.append("Table header checksum mismatch at %d." % sec.start)
-        if entry_count == 0 or entry_count > 0x0FFFFFFF:
+        if entry_count == 0 or entry_count > MAX_TABLE_ENTRIES:
             self.findings.append("Table entry count %d is implausible." % entry_count)
             return
 
-        raw = fh.read(entry_count * 4)
+        raw, _ = self._read_bounded(seg_index, sec.data_start + 24,
+                                    entry_count * 4, entry_count * 4)
         if len(raw) < entry_count * 4:
             self.findings.append("Table entries truncated at %d." % sec.start)
             entry_count = len(raw) // 4
@@ -276,9 +331,8 @@ def _parse_table(self, fh, sec, seg_index, sectors_extent):
                 length = self.chunk_size + 4
             self.chunks.append(Chunk(seg_index, off, length, compressed))
 
-    def _parse_digest(self, fh, sec):
-        fh.seek(sec.data_start)
-        d = fh.read(sec.data_size)
+    def _parse_digest(self, seg, sec):
+        d = self._section_data(seg, sec, MAX_METADATA_SECTION)
         if len(d) >= 36:
             md5, sha1 = d[0:16], d[16:36]
             if any(md5):
@@ -286,9 +340,8 @@ def _parse_digest(self, fh, sec):
             if any(sha1):
                 self.stored_sha1 = sha1.hex()
 
-    def _parse_hash(self, fh, sec):
-        fh.seek(sec.data_start)
-        d = fh.read(sec.data_size)
+    def _parse_hash(self, seg, sec):
+        d = self._section_data(seg, sec, MAX_METADATA_SECTION)
         if len(d) >= 16 and any(d[0:16]) and not self.stored_md5:
             self.stored_md5 = d[0:16].hex()
 
@@ -300,10 +353,19 @@ def _chunk(self, index):
         if index < 0 or index >= len(self.chunks):
             return b""
         c = self.chunks[index]
+        # A stored chunk is at most the chunk plus its checksum; a compressed
+        # one can exceed that only by zlib's small worst-case expansion.
+        cap = self.chunk_size + self.chunk_size // 64 + 64
         with self._io_lock:
-            fh = self._fh(c.seg)
-            fh.seek(c.offset)
-            raw = fh.read(c.length)
+            raw, _ = self._read_bounded(c.seg, c.offset, c.length, cap)
+        # Running into the end of the segment is not itself remarkable (a
+        # final chunk sized from the nominal chunk size does); a length past
+        # what any chunk can be, or an offset outside the file, is.
+        if c.length > cap or c.offset >= self._seg_size(c.seg):
+            self.findings.append(
+                "Chunk %d declares %d bytes at offset %d in segment %d; "
+                "only %d could be read." % (index, c.length, c.offset, c.seg,
+                                            len(raw)))
         if c.compressed:
             data, over = inflate_capped(raw, self.chunk_size)
             if over:
diff --git a/tests/test_ewf.py b/tests/test_ewf.py
index 470ad7b..899d7a2 100644
--- a/tests/test_ewf.py
+++ b/tests/test_ewf.py
@@ -1,6 +1,7 @@
 """Unit tests for image containers (engine.ewf): EWF v1 segment sets, raw
 images, split raw sets and OffsetReader, fed files from imagebuild_ewf."""
 
+import gc
 import hashlib
 import io
 import os
@@ -8,6 +9,7 @@
 import sys
 import tempfile
 import unittest
+import warnings
 
 sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 
@@ -289,6 +291,94 @@ def test_section_size_beyond_file(self):
         self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
 
 
+class HostileSizes(TempDir):
+    """Sizes and offsets in a segment file are untrusted: none of them may
+    decide how much is allocated.  Found by tests/fuzz.py, where each of
+    these raised MemoryError, OverflowError or OSError."""
+
+    HUGE = 1 << 62
+
+    @staticmethod
+    def set_size(seg, type_, size):
+        at = Integrity.find_section(seg, type_)
+        struct.pack_into("<Q", seg, at + 24, size)
+        struct.pack_into("<I", seg, at + 72, build.adler(bytes(seg[at:at + 72])))
+        return at
+
+    def open_mutated(self, seg):
+        return self.open(self.write_segments([bytes(seg)]))
+
+    def assertFinding(self, img, text):
+        self.assertTrue(any(text in f for f in img.findings), img.findings)
+
+    def test_huge_volume_section(self):
+        seg = bytearray(build.build_e01()[0])
+        self.set_size(seg, "volume", self.HUGE)
+        img = self.open_mutated(seg)
+        self.assertFinding(img, "Section 'volume'")
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_huge_header_section(self):
+        seg = bytearray(build.build_e01()[0])
+        self.set_size(seg, "header", self.HUGE)
+        img = self.open_mutated(seg)
+        self.assertFinding(img, "Section 'header'")
+        self.assertEqual(img.info()["acquisition"]["case_number"], "CASE-1")
+
+    def test_huge_hash_section(self):
+        seg = bytearray(build.build_e01()[0])
+        self.set_size(seg, "hash", self.HUGE)
+        img = self.open_mutated(seg)
+        self.assertFinding(img, "Section 'hash'")
+        self.assertEqual(img.stored_md5, hashlib.md5(MEDIA).hexdigest())
+
+    def test_implausible_chunk_geometry(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "volume") + build.DESC
+        struct.pack_into("<II", seg, at + 8, 0xFFFFFFFF, 0xFFFFFFFF)
+        img = self.open_mutated(seg)
+        self.assertFinding(img, "bytes per sector")
+        self.assertFinding(img, "sectors per chunk")
+        self.assertLessEqual(img.chunk_size, ewf.MAX_CHUNK_SIZE)
+        img.read_at(0, len(MEDIA))
+
+    def test_chunk_offset_past_end_of_segment(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table") + build.DESC
+        struct.pack_into("<Q", seg, at + 8, self.HUGE)
+        struct.pack_into("<I", seg, at + 20, build.adler(bytes(seg[at:at + 20])))
+        img = self.open_mutated(seg)
+        img.read_at(0, len(MEDIA))
+        self.assertFinding(img, "Chunk 0 declares")
+
+    def test_huge_final_chunk(self):
+        # The last chunk's length runs to the end of the sectors section.
+        seg = bytearray(build.build_e01()[0])
+        self.set_size(seg, "sectors", self.HUGE)
+        img = self.open_mutated(seg)
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+        self.assertFinding(img, "Chunk 3 declares")
+
+    def test_section_pointer_past_end_of_segment(self):
+        seg = bytearray(build.build_e01()[0])
+        at = Integrity.find_section(seg, "table2")
+        struct.pack_into("<Q", seg, at + 16, (1 << 64) - 1)
+        struct.pack_into("<I", seg, at + 72, build.adler(bytes(seg[at:at + 72])))
+        img = self.open_mutated(seg)
+        self.assertFinding(img, "past the end of segment")
+        self.assertEqual(img.read_at(0, len(MEDIA)), MEDIA)
+
+    def test_failed_open_releases_the_file(self):
+        path = self.write("g.E01", build.EVF_SIG + bytes(500))
+        with warnings.catch_warnings(record=True) as caught:
+            warnings.simplefilter("always", ResourceWarning)
+            with self.assertRaises(ewf.EwfError):
+                ewf.EwfImage(path)
+            gc.collect()
+        self.assertEqual([w for w in caught
+                          if issubclass(w.category, ResourceWarning)], [])
+
+
 class Raw(TempDir):
     def test_raw_image(self):
         path = self.write("disk.dd", MEDIA)