{"id":51015061,"url":"https://github.com/securityronin/livedisk-forensic","last_synced_at":"2026-06-21T09:02:39.168Z","repository":{"id":365631145,"uuid":"1272977602","full_name":"SecurityRonin/livedisk-forensic","owner":"SecurityRonin","description":"Cross-platform live block-device enumeration (macOS/Linux/Windows) with partition-layout rendering and acquisition-integrity forensics — fleet *-core/*-forensic split","archived":false,"fork":false,"pushed_at":"2026-06-18T07:32:42.000Z","size":37,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-18T08:15:52.062Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-18T05:24:27.000Z","updated_at":"2026-06-18T07:32:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/livedisk-forensic","commit_stats":null,"previous_names":["securityronin/livedisk-forensic"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/livedisk-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flivedisk-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flivedisk-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flivedisk-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flivedisk-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/livedisk-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flivedisk-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34603643,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-21T09:02:35.165Z","updated_at":"2026-06-21T09:02:39.166Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"# livedisk\n\n[![Crates.io](https://img.shields.io/crates/v/livedisk-core.svg)](https://crates.io/crates/livedisk-core)\n[![Docs.rs](https://docs.rs/livedisk-core/badge.svg)](https://docs.rs/livedisk-core)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)\n[![CI](https://github.com/SecurityRonin/livedisk-forensic/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/livedisk-forensic/actions/workflows/ci.yml)\n[![Sponsor](https://img.shields.io/badge/Sponsor-%E2%9D%A4-db61a2)](https://github.com/sponsors/h4x0r)\n\n**List every physical disk and partition on the running machine — macOS, Linux, and Windows — through one unified Rust API.**\n\n`diskutil list`, `lsblk`, and `diskpart` each speak a different dialect. `livedisk` gives you their answer as one set of structs, on every platform, with no daemon and no shelling out — plus a partition-manager-style visual and acquisition-integrity triage.\n\n```rust\nfor disk in livedisk::enumerate()? {\n    println!(\"{}  {}\", disk.name, livedisk::human_size(disk.size_bytes));\n    for part in \u0026disk.partitions {\n        println!(\"  {}  {}\", part.name, livedisk::human_size(part.size_bytes));\n    }\n}\n# Ok::\u003c(), livedisk::Error\u003e(())\n```\n\n```console\n$ cargo add livedisk-core      # the reader (imported as `livedisk`)\n```\n\n## At a glance\n\n`render_overview` draws a horizontal bar chart scaled to the largest physical disk; `render_disk_bar` draws each disk's partition layout proportionally (ANSI colour on a TTY, ASCII when piped):\n\n```text\nAll storage (3 physical disks, 14.1 TB total):\n disk0  [############################                            ]   4.0 TB  28.5%\n disk4  [==============                                          ]   2.0 TB  14.6%\n disk5  [++++++++++++++++++++++++++++++++++++++++++++++++++++++++]   8.0 TB  56.9%\n```\n\n## Unified model\n\nEvery backend — IOKit `IOMedia` on macOS, `/sys/block` on Linux, `DeviceIoControl` on Windows — fills the same struct:\n\n```rust\npub struct PhysicalDisk {\n    pub device_path: String,        // /dev/disk0, /dev/sda, \\\\.\\PhysicalDrive0\n    pub name: String,\n    pub size_bytes: u64,\n    pub logical_sector_size: u32,\n    pub physical_sector_size: u32,  // 4Kn/512e aware\n    pub model: Option\u003cString\u003e,\n    pub serial: Option\u003cString\u003e,\n    pub removable: bool,\n    pub read_only: bool,\n    pub synthesized: bool,          // APFS container / device-mapper overlay\n    pub partitions: Vec\u003cPartition\u003e,\n}\n```\n\nListing works **unprivileged** (it reads the kernel's device registry, not raw sectors). [`open_device`] hands you a sized `Read + Seek` so a partition or filesystem analyzer can run on a live disk exactly as it would on an image file.\n\n## Acquisition-integrity triage\n\n`livedisk-forensic` turns a live disk into graded [`forensicnomicon`](https://crates.io/crates/forensicnomicon) findings — never a verdict, always an observation:\n\n| Code | Meaning |\n|---|---|\n| `LIVE-MOUNTED` | a volume is mounted during acquisition (live writes may alter the image) |\n| `LIVE-WRITABLE` | the device is writable; no hardware write-blocker detected |\n| `LIVE-REMOVABLE` | removable media |\n| `LIVE-SECTOR-4KN` | logical/physical sector sizes differ (512e/4Kn) |\n| `LIVE-SYNTHESIZED` | a synthesized container overlay, not a backing physical store |\n\n```rust\nfor finding in livedisk_forensic::analyse(\u0026disk) {\n    println!(\"{}: {}\", finding.code, finding.note);\n}\n```\n\n## Platform support\n\n| OS | Backend | Notes |\n|---|---|---|\n| macOS | IOKit `IOMedia` registry | physical + APFS-synthesized disks |\n| Linux | `/sys/block` sysfs + `/proc/mounts` | zero C dependencies |\n| Windows | `DeviceIoControl` (`IOCTL_DISK_GET_DRIVE_LAYOUT_EX`) | layout query needs Administrator |\n\nTwo crates, mirroring the forensic-fleet split: **`livedisk-core`** (the reader, imported as `livedisk`) and **`livedisk-forensic`** (the analyzer).\n\n---\n\n[Privacy Policy](https://securityronin.github.io/livedisk-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/livedisk-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Flivedisk-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Flivedisk-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Flivedisk-forensic/lists"}