Skip to content

Cross-check Strata against independent readers (synthetic corpus) - #182

Merged
switch-nz merged 3 commits into
mainfrom
claude/crosscheck-harness
Oct 2, 2026
Merged

switch-nz merged 3 commits into
mainfrom
claude/crosscheck-harness

Conversation

@switch-nz

Copy link
Copy Markdown
Owner

Stacked on #181 (its walker fix is what lets the harness descend into HFS+ folders); GitHub will retarget this to main when that merges.

What this is

tests/crosscheck.py reads the same image with Strata and with established readers and lists every difference. It answers the roadmap's open question on independent validation, for synthetic evidence so far.

  • Layers: disk container (EWF, VHD, QCOW2, VMDK; VDI/DMG via qemu-img), GPT, and the filesystem tree (NTFS, FAT, ext, HFS+ incl. alternate data streams and resource forks).
  • References: libewf, libvhdi, libqcow, libvmdk, libvsgpt, libfsntfs, libfsfat, libfsext, libfshfs, qemu-img. Each is optional and reported as missing if absent; Strata still needs only the standard library.
  • Same input on both sides: filesystem readers get Strata's view of the partition, so a container difference can't masquerade as a filesystem one. Containers are compared by per-1 MiB-chunk digests (all, or a seeded sample with --chunks).
  • Baseline: tests/crosscheck_baseline.json holds the understood differences, each with a reason; an unexplained one fails the run (--strict also fails on stale entries). It refuses entries about anything but synthetic cases.
  • Real images: --images withholds file and folder names from everything printed or saved (--names reveals them), and saves only to the git-ignored crosscheck-out/.
  • CI: .github/workflows/crosscheck.yml installs the references and runs it on engine changes. Docs in docs/CROSSCHECK.md.

What the first run found

  • Strata vs references, content: no disagreement on any readable container, GPT table or filesystem listing other than the baselined ones below. NTFS, FAT, ext2 and HFS+ trees (incl. a fragmented catalog and hard links) agree path-for-path and digest-for-digest.
  • Fixture problems, fixed: HFS+ folders had a file mode; NTFS $Secure lacked $SDS; the QCOW2 v2 fixture used a v3-only zero flag, and its compressed cluster inflated to less than a cluster (libqcow then returned uninitialised bytes there).
  • Baselined with reasons: NTFS metadata files (Strata lists them, libfsntfs doesn't); a deliberately looped FAT chain; libfshfs not applying decmpfs; NUL-prefixed HFS+ private folder name; fixtures that stricter readers refuse (VMDK grain size, VDI block size, QCOW2 refcount table, DMG LZFSE, tiny-VHD geometry).
  • Open: libfsext refuses the synthetic ext4 image (in-inode xattr area); not yet known which side is wrong, so ext4 is not compared. Recorded in the baseline and docs.

Verification

Full suite 1395 tests OK (14 skipped), including tests/test_crosscheck.py (20 tests: chunk plan, comparison kinds, baseline validation, redaction, runner end to end incl. a reference that lies and one that refuses). Harness run with all references installed: exit 0 with --strict.

No real evidence was used.

🤖 Generated with Claude Code

https://claude.ai/code/session_017DPjyZZHvaivtvJ3N4hZhz


Generated by Claude Code

claude added 2 commits October 2, 2026 19:52
…earched and tagged

HFS+ names its entries by catalog node ID (cnid); about twenty copies of the
rule looked only for the other readers' keys. Expanding an HFS+ folder listed
the volume root again, and search, hashing, indexing and tagging never went
below the top folder. One helper (engine/nodes.py) replaces the copies in the
engine and web/app.js; a test fails if one is written out again. HfsPlus can
look an entry up by handle, so a tagged file can be exported.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DPjyZZHvaivtvJ3N4hZhz
tests/crosscheck.py reads synthetic images with Strata and with libyal
readers and qemu-img, layer by layer, and reports every difference. Understood
differences live in tests/crosscheck_baseline.json with reasons; new ones fail
the run. Real images are supported with names withheld.

Also: HFS+ fixture folders carry a folder mode, NTFS fixture $Secure has a
$SDS stream.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DPjyZZHvaivtvJ3N4hZhz
Base automatically changed from claude/hfsplus-node-handles to main October 2, 2026 20:12
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DPjyZZHvaivtvJ3N4hZhz
@switch-nz
switch-nz merged commit f20138d into main Oct 2, 2026
@switch-nz
switch-nz deleted the claude/crosscheck-harness branch October 2, 2026 20:12
@switch-nz switch-nz mentioned this pull request Oct 2, 2026
3 of 4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants