MemoryLane 0.1.0

First release. A forensic imager in the spirit of FTK Imager, with the same
output — now a single Rust implementation.

What it does

• acquire — bit-for-bit image of a drive or file into EWF/E01 or raw
  (dd). Parallel read/hash/deflate/write pipeline; 646 MB/s compressed on a
  12-core laptop against incompressible data.
• collect — targeted logical acquisition: chosen paths into one ZIP
  container with a per-file manifest (MD5, SHA1, nanosecond timestamps, mode,
  ownership, symlink targets). 40,000 files collect and verify in 2.6 s.
• verify — re-reads evidence from disk and checks it against the digests
  stored inside it. For a collection: every member against the manifest, plus
  what is missing from it and what is present but unlisted.
• export — image back out as raw, checked against the digest stored in
  the image.
• info, devices, and --machine JSON-lines output for front ends.

Both containers are implemented from the format up — no libewf, no zip crate —
and cross-checked against libewf, unzip and Python's zipfile on every CI
run. ewfverify reports SUCCESS across every compression level and split size;
ewfexport reproduces the source byte for byte.

Evidence handling

Read-only always. A drive with volumes still mounted for writing is refused
(APFS-on-synthesized-container and LVM are traced to the physical drive, so an
indirect mount does not fool the check). Writing into /dev, onto a device
node, or onto the drive being imaged is refused. Bad sectors are retried, then
zero-filled, counted, and recorded in the E01's own error2 section. Ctrl-C
leaves the set explicitly incomplete and --resume continues it. MD5 and SHA-1
always; --hash sha256 or sha512 when the point is integrity rather than
continuity with an older record.

Exit codes: 0 verified, 1 verification failed or damage found, 2
usage/IO error, 130 interrupted with partial evidence left in place.

Install

.deb packages for amd64 and arm64 are attached below. Otherwise
cargo install --path . — six dependencies, Rust 1.74+.

Known limits

• Not field-proven. For evidence going to court, Guymager's and FTK's years
  of casework outweigh any benchmark here.
• Windows physical-device acquisition is unproven — CI has no disks, so
  \\.\PhysicalDrive reads have never run against real hardware. File and
  image sources are fully exercised on all three platforms.
• The mounted-source and destination-on-source guards are no-ops on
  Windows, because the volume-to-disk mapping is only implemented for macOS
  and Linux. They will not stop you there.
• On Linux the page-cache bypass is posix_fadvise(DONTNEED) per block, not
  O_DIRECT — weaker than Guymager's guarantee.
• L01 is not written, on purpose; see the README for why.

133 tests, green on macOS, Linux and Windows.