English · 简体中文
Heuristic disk recovery with a three-layer engine.
- Layer 1 (v0.1) — recover deleted NTFS files from a partition image via sequential MFT scan.
- Layer 2 (v0.2) — recover files after a quick format by carving MFT remnants across the image, rebuilding paths with confidence scores, and falling back to flat output when the directory tree cannot be reconstructed.
- Layer 3 (v0.3) — magic-number carving when metadata is destroyed; optional LLM pipeline (naming, repair, reassembly, extraction report).
- Rust 1.75+
- Linux/WSL to regenerate Layer 2 fixtures (
ntfs-3g,mkfs.ntfs) - Windows (Administrator) to regenerate Layer 1 fixtures
- LLM features: copy
.env.exampleto.envand setOPENAI_API_KEY
cargo build --releaseRunning baize with no subcommand starts a localhost Web server (default http://127.0.0.1:3847) and opens your browser. Build the static UI first:
# Windows
.\scripts\build-web.ps1
# Linux / macOS
./scripts/build-web.shDevelopment (API + Next.js dev server):
# Terminal 1 — API
cargo run -p baize-cli -- web --no-open
# Terminal 2 — UI with /api proxy
cd web && npm run devSubcommands:
| Command | Description |
|---|---|
baize / baize web |
Local Web agent UI (127.0.0.1 only) |
baize agent |
Interactive TUI wizard |
baize scan / baize recover / baize search |
CLI scan, recover & feature-guided search |
baize dump |
Dump live Windows volume to raw image for faster offline scan |
Port: 3847 or env BAIZE_WEB_PORT. Static files served from web/out when present.
# Layer 1: list deleted, recoverable files
cargo run -p baize-cli -- scan --image fixtures/ntfs-deleted-v1.img
# Layer 2: quick-format carve mode
cargo run -p baize-cli -- scan --image fixtures/ntfs-quickformat-v1.img --layer 2
# AI-guided wizard (split TUI, needs OPENAI_API_KEY in .env)
cargo run -p baize-cli -- agent
# Feature search by clues (contract, phone number, etc.) — see USAGE.md
cargo run -p baize-cli -- search --clues "合同 13811223344" --image fixtures/ntfs-deleted-v1.img
# Auto: try Layer 1 → Layer 2 → Layer 3
cargo run -p baize-cli -- scan --image fixtures/ntfs-carve-v1.img --auto
# Windows: scan a mounted NTFS USB drive directly (admin PowerShell)
cargo run -p baize-cli -- scan --device H: --auto --triage
# Windows: dump slow USB to NVMe image, then scan faster
cargo run -p baize-cli -- dump --device H: --output D:\fast\usb.img
cargo run -p baize-cli -- scan --image D:\fast\usb.img --auto --carve-threads 4
# Layer 3: magic-number carve
cargo run -p baize-cli -- scan --image fixtures/ntfs-carve-v1.img --layer 3
# Layer 3 recover + LLM post-processing
cargo run -p baize-cli -- recover --image fixtures/ntfs-carve-v1.img --layer 3 --output ./out/ --llm
# JSON output
cargo run -p baize-cli -- scan --image fixtures/ntfs-deleted-v1.img --json
# Recover all files (Layer 1 default)
cargo run -p baize-cli -- recover --image fixtures/ntfs-deleted-v1.img --output ./recovered/
# Recover after quick format
cargo run -p baize-cli -- recover --image fixtures/ntfs-quickformat-v1.img --layer 2 --output ./recovered/
# Recover specific MFT entry
cargo run -p baize-cli -- recover --image fixtures/ntfs-deleted-v1.img --output ./recovered/ --id 42--layer 1|2|3 and --auto are mutually exclusive. Use either --image or --device (Windows live volume). Default is --layer 1. See USAGE.md for detailed usage (Chinese).
See fixtures/README.md.
- Layer 1:
fixtures/scripts/create-fixture.ps1(Windows) - Layer 2:
fixtures/scripts/create-layer2-fixture.sh(WSL/Linux) - Layer 3:
fixtures/scripts/create-layer3-fixture.ps1(Windows) or.sh(WSL)
See DOCUMENTS/architecture.md, DOCUMENTS/layer1-design.md, DOCUMENTS/layer2-design.md, and DOCUMENTS/layer3-design.md.
Use only on volumes you own or are authorized to recover. Read-only access to source images and live volumes; no writes to the source.
MIT