Taphonomy: FAT32 file recovery that refuses to guess

Fahad Bilal Saleem — Fri, 25 Sep 2026 16:32:32 +0000

I built Taphonomy, a deleted-file recovery tool for FAT32 disk images written in Rust: https://github.com/bilalmughal1/taphonomy

It recovers deleted files and files orphaned by a quick format. Evidence is opened read-only and every byte is SHA-256-hashed before anything is reported.

The design rule: most recovery tools silently return plausible-looking bytes. Taphonomy treats "plausible but wrong" as a failure, not a partial success. Every recovery carries a caveat stating exactly what is and isn't established, and it refuses recoveries it can't support instead of guessing. It also reports its own coverage — every partition, directory, or listing it did not analyse is counted and named.

Validation: I ran it against three of NIST's CFReDS deleted-file-recovery images, checking each recovery against the sectors NIST documents, and compared side-by-side with The Sleuth Kit 4.12.1. On dfr-01 and dfr-11, every recovery matched NIST's sectors. On dfr-02 — a file fragmented around a live file — Taphonomy refused, because the implied run crosses a cluster still in use. TSK recovered it correctly; its heuristic happened to land on the right one. 4 of 15 deleted files reached; 10 sit on FAT12/16 partitions not yet supported.

How it's built: every capability starts as an Architecture Decision Record (17 so far); experiments record the hypothesis before the measurement, including wrong predictions; all test fixtures are generated from standard tools, byte-identical on every build, digests committed.

Limitations: FAT32 only, disk images (not devices), MBR/512-byte sectors, 8.3 filenames. GPL-3.0.

Where would you draw the line between a defensible recovery and a guess?

DEV Community: Fahad Bilal Saleem

Taphonomy: FAT32 file recovery that refuses to guess