Senior-management briefing · 18–21 July 2026
Recent work converted a broad engineering audit into shipped reliability improvements, clearer ownership, and a prioritized remaining plan.
Decision requested: continue funding targeted compatibility/testing work so downstream tools receive a dependable, documented extraction component.
What changed
Former internal dependencies are vendored with provenance and built as a defined internal component. This removes recurring submodule/worktree failure modes.
Bounds, ownership, short-read, image-name, packet, and PCAP failures were corrected and given focused tests.
CI/release workflows were consolidated; sanitizer and coverage paths are clearer and less duplicative.
Impact for users such as BitCurator: a simpler-to-build component with fewer known ways for malformed input or an operational error to produce unsafe or inconsistent behavior.
Delivery record
| Outcome | Examples completed | Status |
|---|---|---|
| Memory/input safety | sbuf bounds/ownership; E01 selection and short reads; packet/PCAP checks | Closed |
| Operational reliability | Notification shutdown on write failure; JPEG disable; explicit scanner selection; banners | Closed |
| Output integrity | Feature-recorder contract and low-memory histogram behavior | Closed |
| Build/configuration | Exiv2-disabled build; scanner API documentation; CI warning/debt cleanup | Closed |
Full links to all 19 PRs and every closed issue are in RECENT_WORK_REPORT.md.
Evidence, not just activity
Tests assert zero, end, and one-past-end buffer behavior and file-mapping ownership.
Fallback PCAP tests reject oversized, inconsistent, and truncated packets; E01 short-read paths are exercised.
Tests cover shutdown, scanner selection, JPEG disable, plug-in loading, banner propagation, and histogram allocation failure.
This is stronger than a “program started” check: each test asserts the condition that previously failed.
Test-data limits
Small, curated emails, Office/Outlook, archives, JPEG/EXIF, PDFs, Windows artifacts, network captures, E01 segments, and raw fragments.
Expected feature/offset presence, repeatable output comparison, and coverage of selected normal paths.
Correct extraction everywhere; adversarial decoder safety; all scanners/platforms/options; Windows, Lightgrep, no-libpcap, fuzz, or large case-media behavior.
Legacy `regress.py --datacheck` checks expected features are present; it does not validate extracted content correctness.
Remaining work
| Priority | Why it matters to users |
|---|---|
| Choose supported plug-in scope | Finish a versioned/tested ABI or remove unsupported behavior and claims. |
| Resolve Lightgrep scope | Port and continuously test it, or retire a broken optional configuration. |
| Expand hostile-input assurance | Add malformed corpus, fuzzing, no-libpcap, and Windows gates for the riskiest parsers. |
| Finish operational/documentation work | Real disk-write failure test, scanner-specific boundaries, current manuals, and support-tool policy. |
The core debt tracker remains open so these items are visible, owned, and not reintroduced as untracked risk.
Recommendation
The recent investment has reduced integration and correctness risk. The next increment should make that improvement durable across the configurations and hostile-input cases that downstream forensic workflows depend on.
Keep the repaired core behavior covered by substantive tests.
Set explicit product scope for plug-ins and Lightgrep.
Fund malformed-input, platform, and release-quality validation.
Detailed engineering evidence and links: doc/RECENT_WORK_REPORT.md.