Cross-platform
Reperio
Recovers deleted files from FAT, NTFS, APFS and ext4. Verifies every recovered file. Status: Complete · Damaged · Overwritten.
Platform
Cross-platform
Language
Rust
Stack
Rust Forensics NTFS APFS FAT ext4 Recovery
Status
Phase 1 complete
─────────────────────────────────────────────────────────────────────────
Overview

Reperio recovers deleted files by reading raw filesystem structures directly — no guessing, no relying on the OS. On NTFS the MFT record survives deletion. On APFS the inode lingers. On ext4 the block pointers sit untouched until overwritten. Reperio reads all of them, reconstructs the original path, and verifies every recovered byte. Recovery status is binary: Complete, Damaged, or Overwritten. No silent corruption.

Architecture
>
reperio-core
Filesystem parsers for FAT12/16/32, NTFS, APFS, ext4. Raw block device access, inode and MFT record reconstruction.
>
reperio-verify
Per-file integrity check. Hash verification against filesystem metadata where available. Status: Complete / Damaged / Overwritten.
>
reperio-plugins
Redteam forensic plugin suite. Registry hive analysis, NTFS $MFT/$LogFile/$UsnJrnl metadata, memory forensics via raw dump parsing.
>
reperio-cli
Command-line interface. Scan, recover, verify, report. JSON and human-readable output modes.
reperio-operator
$ reperio scan /dev/sda1 --fs ntfs ✓ MFT parsed — 142,381 records deleted entries: 8,241 $ reperio recover --out ./recovered/ ✓ 7,819 Complete 312 Damaged 110 Overwritten ✓ done — no silent failures