Lazarum Drive Viewer

Recovery should not require the appliance

Lazarum is deliberately separate from the privileged recovery bench. Connecting a Lazarus storage disk to a normal workstation should be enough to inspect jobs, read reports, browse supported volumes, and extract customer files.

The portable viewer core does not depend on GTK. A GTK4 application provides the current desktop interface, while command-line access remains available for inventory and report extraction.

Read-only by construction

Storage drives are mounted read-only with journal replay disabled where applicable
Finalized image envelopes and complete chunk maps are validated before exposure
A read-only NBD bridge reconstructs only chunks requested by the mounted filesystem
Every requested stored and logical chunk is hash-verified
NTFS, FAT, exFAT, and ext volumes mount with nosuid, nodev, and noexec
Symbolic links and special files cannot be exported
Destination files are never overwritten

No full reconstruction tax

Lazarum does not need free space equal to the complete logical image. The Linux provider exposes the chunk stream as a read-only network block device, verifies and decompresses requested chunks on demand, and keeps only a bounded recent-chunk cache in memory.

This makes multi-terabyte compressed images browsable without first producing a second multi-terabyte raw file.

Extraction remains explicit

ArcoBASIC communicates whether a requested image entry is eligible for export before the confined copy begins. The rules are intentionally unsurprising.

ArcoBASICArcoBASIC communication example: refuse unsafe extraction targets

' Decide whether an image entry may be copied out safely.
FUNCTION ApproveExtraction(entry, destinationExists)
    ' Lazarum does not follow links outside the selected volume.
    IF entry.Kind == "SYMLINK" THEN RETURN "REFUSE SYMBOLIC LINK"
    IF entry.Kind == "DEVICE" THEN RETURN "REFUSE SPECIAL FILE"

    ' Recovery must not destroy an existing destination file.
    IF destinationExists THEN RETURN "REFUSE OVERWRITE"

    IF entry.InsideVolume == FALSE THEN RETURN "REFUSE PATH ESCAPE"
    RETURN "APPROVED READ-ONLY EXTRACTION"
END FUNCTION

entry = {
    "Kind": "FILE",
    "InsideVolume": TRUE
}

PRINT ApproveExtraction(entry, FALSE)

Platform direction

Linux storage and image-data providers are implemented. Windows and macOS retain explicit provider boundaries and fail closed until suitable signed read-only ext4 and filesystem adapters exist.

A placeholder must never report successful recovery. Each provider is required to prove that the destination copy completed before presenting the file as extracted.

Building the smaller tool on purpose

NBD bridges and read-only ext4 mounts are specific to browsing recovery images. Choosing to build Lazarum as a second, deliberately smaller tool instead of adding a browse mode to the privileged bench is the decision worth studying regardless of what is being built.

This is the same reasoning behind a read-only reporting replica instead of querying a production database directly, a preview pane that renders untrusted content in a sandbox instead of the main app, or a command-line dry-run mode. Building the smaller, safer tool for the smaller, safer task is what keeps the powerful tool powerful.

Give a lower-stakes task a lower-privilege tool instead of reusing the powerful one. Lazarum does not depend on GTK the way the bench does, and it never needs raw-device authority at all; inspecting a report should not require the same trust level as capturing a disk.
Avoid paying full cost for partial need. The NBD bridge reconstructs only the chunks a mounted filesystem actually requests, so browsing a multi-terabyte compressed image never requires first producing a second multi-terabyte raw file.
Constrain what a convenience feature is allowed to do. ApproveExtraction refuses symlinks, special files, path escapes, and overwrites by name, treating letting the user grab a file as a function with real limits, not an open door.
Fail closed for capabilities not yet proven. Windows and macOS providers stay explicitly unimplemented and blocked rather than approximated, because the page is clear that a placeholder must never report a successful recovery.

LEARNING LAYER

Key terms, in plain language

You do not need a systems background to follow the work. These are the specialized terms used on this page.

NBDNetwork Block Device: A Linux interface that presents a block-device-shaped data source. Lazarum uses a read-only NBD provider to expose requested chunks from a compressed image.
Chunk hash: A compact fingerprint calculated from one region of data. Lazarus uses SHA-256 hashes to detect whether stored and reconstructed chunks changed.
Cold reopen: Closing an image and opening it again through the normal reader before verification, rather than trusting state left in memory by the writer.