Rusty Backup

Cross-platform GUI tool for backing up, restoring, and inspecting vintage computer disk images. The name is a play on words — both referencing the Rust programming language and the rusty vintage machines we're preserving.

Primary users are retro computing enthusiasts archiving CF/SD cards, IDE/SCSI drives, and floppy images from DOS, Windows 9x, early Linux, classic Mac OS, and Apple II / IIgs systems.

Licensed under AGPL-3.0. See PROJECT-SPEC.md for the full design specification and docs/ for deep-dive topics.

Installation

Rusty Backup ships as a single self-contained binary per platform.

1. Grab the latest build for your OS from the GitHub Releases page.
2. Drop the binary where you want it:
   • Windows — run Setup.exe for the installed experience (Start-Menu shortcut, "Add/Remove Programs" entry, optional file-association registration, rb-cli on PATH), or extract the portable ZIP and run rusty-backup.exe directly. Either install can self-update in place from within the About / Update UI; existing portable-ZIP users can run Setup.exe once to gain the Start-Menu / ARP integration without re-downloading later updates.
   • macOS — open the DMG and drag Rusty Backup.app into /Applications.
   • Linux — chmod +x rusty-backup-*.AppImage and launch it.
3. Raw physical disks require elevated privileges (admin on Windows, root on Linux, an authorisation prompt on macOS). Working with image files on disk does not.

To build from source: cargo build --release. See CLAUDE.md for the full build matrix.

The rb-cli headless CLI

The release artifacts also include rb-cli, the scriptable counterpart to the GUI. Same engine, no eframe dependency, designed for shell pipelines and automated build farms.

rb-cli new disk.dsk --fs hfs --size 800K --name "My Disk"
rb-cli put disk.dsk ./Finder /System/Finder --type FNDR --creator MACS
rb-cli ls  disk.dsk /System
rb-cli cp  floppy.adf / harddisk.hda@1 /Floppies/d01/ -r   # consolidate an image onto a HD
rb-cli tar irix.img@1 / irix.tar.gz   # archive a case-sensitive volume (keeps case + symlinks)
rb-cli untar disk.hda src.tar.gz /   # import an archive's contents INTO an image (skips ._* + unstorable names)
rb-cli get backup.zip /unix ./unix --inside disk.img   # extract from a RAW disk inside a .zip
rb-cli fsck disk.dsk --checkonly
rb-cli inspect disk.hda
rb-cli backup /dev/disk3 ./backups --format chd --checksum sha256
rb-cli restore ./backups/my-backup ./restored.img
rb-cli batch script.json --dry-run
rb-cli new-x68k-hdd hdd.hdf --size 16M --system-disk human68k.dim
rb-cli new-x68k-hdd c.hdf --size 32M --variant scsi --system-disk human68k.dim \
                          --boot-sector-donor hd0.hds      # zero manual steps, your donor
rb-cli new-x68k-hdd c.hdf --size 32M --variant scsi --system-disk human68k.dim \
                          --builtin-boot-sector            # zero manual steps, no donor needed
rb-cli new-sgi-hdd irix.img --size 50M                     # IRIX SGI dvh + EFS root HDD
rb-cli new-sgi-cdrom irix.iso --size 600M                  # IRIX EFS CD-ROM (slot-7 SYSV, mount -t efs)
rb-cli put irix.img@1 ./bstoolbox /bstoolbox               # populate its EFS root partition
rb-cli mac-scsi-bless mac.hda                              # install Apple SCSI driver + DDR
rb-cli mac-scsi-bless mac.hda --driver-from donor.hda      # use a donor disk's driver verbatim
rb-cli make-bootable disk.dsk --boot-from "System 7.0 HD.dsk"  # auto: apply only what's missing to boot
rb-cli make-bootable mac.hda --dry-run                     # preview: detect kind + missing pieces

Shell completions for bash / zsh / fish / PowerShell:

rb-cli install-completions          # auto-detects $SHELL
rb-cli completions zsh > _rb-cli    # emit-to-stdout for packagers

Full verb-by-verb reference: docs/cli-reference.md (regenerated from cargo run --example generate_cli_reference). Open CLI follow-ups (and everything else still to do) are tracked in docs/OPEN-WORK.md.

rb-cli-mini for MiSTer FPGA (armv7)

rb-cli-mini is the MiSTer-specific build of rb-cli: a slim variant cross-compiled for the FPGA's Intel Cyclone V / Cortex-A9 SoC (armv7-unknown-linux-gnueabihf, glibc 2.31 baseline from the Buildroot rootfs). It excludes the GUI (eframe / egui / rfd) and the update checker's reqwest client — but keeps CHD support via the upstream libchdman-rs armv7 prebuilt (so .chd images work inline on the device) and the optical-disc stack (opticaldiscs / cd-da-reader), so devices with a CD/DVD drive (e.g. the SuperStation One) can rip discs on-device.

The desktop release builds use the full feature set; only the MiSTer artifact runs --no-default-features --features chd,pure-zstd,remote,optical (CHD via the C prebuilt; zstd via the pure-Rust bit-exact backend, since a cross build won't link C libzstd; remote for the network daemon — see rb-daemon below; optical for CD/DVD ripping — cd-da-reader links no system libcdio, and opticaldiscs reuses the same libchdman-rs 0.288.9 prebuilt as chd).

# Cross-compile for MiSTer (armv7-unknown-linux-gnueabihf):
cargo install cross --git https://github.com/cross-rs/cross --locked
cross build --bin rb-cli --release \
            --target armv7-unknown-linux-gnueabihf \
            --no-default-features --features chd,pure-zstd,remote,optical

# Strip + deploy. The release tarball ships the binary as `rb-cli-mini`;
# do the local rename here too so the on-MiSTer filename matches the
# downloads-page artifact (and so completion lookups land in the right
# spot — see below).
arm-linux-gnueabihf-strip target/armv7-unknown-linux-gnueabihf/release/rb-cli
scp target/armv7-unknown-linux-gnueabihf/release/rb-cli \
    root@mister.local:/media/fat/Scripts/rb-cli-mini

The repo's Cross.toml pins the cross-compile Docker image to cross-rs's Ubuntu 20.04 / GCC 9.4 / glibc 2.31 build (at a verified SHA digest) so the binary links against the same glibc + libstdc++ baseline as both the MiSTer Buildroot rootfs and the upstream libchdman-rs armv7 prebuilt — symbols line up without any version drift.

CI ships a prebuilt rb-cli-mini-armv7-linux-<version>.tar.gz as part of every release; grab it from the Releases page if you don't want to set up the cross toolchain locally.

What's in the MiSTer build:

• Every filesystem operation (ls, put, get, tar, untar, rm, mkdir, fsck, resize, expand, chmeta, bless, …) on FAT, NTFS, exFAT, HFS, HFS+, ext, AFFS, PFS3, SFS, ProDOS, Human68k, ADFS, etc.
• inspect, backup, restore for Raw, VHD, QCOW2, VMDK, Zstd, the four floppy container formats, and CHD.
• floppy convert (XDF / HDM / DIM / D88, single-file and bulk) — the X68000 workflow runs inline on the device.
• Partition table editing (partmap), backup-folder operations.
• shrink, grow .chd, single-file CHD backups — all work.
• The rb-daemon network daemon (serve) — host this device's images and disks on the LAN so the desktop app can browse/back up/restore them over rb://. Installs from the Scripts menu; see below.
• Optical-disc ripping (optical drives to find the drive, then optical rip --device /dev/sr0 --format iso|bincue), plus optical convert (ISO ↔ BIN/CUE ↔ CD-CHD) and optical browse / extract. For devices with a CD/DVD drive such as the SuperStation One.
• Machine-readable optical inspection: optical browse --format json emits a deterministic, path-sorted file listing (add --hash sha256 for per-file content hashes), and optical info --format json reports volume-level metadata (ISO 9660 PVD identity + Rock Ridge / Joliet / UDF flags, El Torito boot catalog, HFS/APM) leniently — surfacing warnings rather than failing on the sloppy 90s mastering that trips strict parsers.
• El Torito boot images: optical info lists every boot entry (platform, bootable, media type, size + sha256) and names the nested filesystem inside each. optical boot extract pulls a boot image out to a file, which is just a disk image — so ls / inspect / get / put / fsck all work on it — and optical boot replace writes an edited image back into the catalog. (The disc layer is handled by the opticaldiscs crate; rusty-backup interprets and edits the boot image's filesystem.)
• Remote ripping off-device: run rb-daemon here and drive this drive from the desktop app / CLI — the device only issues SCSI reads while the desktop does the heavy CHD encoding, so the armv7 CPU isn't taxed. optical rip --device rb://this-device:7341/dev/sr0, or the desktop Optical tab's "Add remote daemon..." button. See docs/remote_ripping.md.

What's excluded:

• GUI windows and the update-checker self-replace UI (only meaningful for the desktop binary).

Full background and the feature matrix live in docs/mister_cli.md.

Install via MiSTer Downloader (custom database)

The easiest way to get Rusty Backup onto a MiSTer is the built-in Downloader (the same tool update_all drives). It installs and keeps itself updated from the Scripts menu — no SSH, no tarball, no cross toolchain. Add this section to /media/fat/downloader.ini on the SD card:

[danifunker/rusty-backup]
db_url = 'https://github.com/danifunker/rusty-backup/releases/latest/download/rusty-backup.json.zip'

Then run Scripts > update (or Downloader) on the MiSTer. It drops rb-cli and rb-daemon.sh into /media/fat/Scripts. The db_url points at the latest release, so every later Downloader run picks up new builds automatically.

This is a MiSTer Downloader custom database: each release's CI publishes the slim armv7 binary and the daemon shim as standalone assets plus a generated rusty-backup.json.zip database that references them by md5 + size. Because Downloader places individual files (it doesn't unpack tarballs), the bare rb-cli may arrive without its executable bit — rb-daemon.sh re-applies it on first run, so the menu entry works regardless.

Prefer to install by hand? The rb-cli-mini-...tar.gz from the Releases page still ships its own install.sh (see below).

Run this device as a network daemon (rb-daemon)

The MiSTer build can run as a small network daemon so the desktop Rusty Backup app reaches into the MiSTer over your LAN — browse the SD card and the disk images on it, copy files in and out, and back up / restore whole disks — without pulling the card. It works like mrext's Remote: one entry in the Scripts menu, auto-start on boot once enabled.

Install it from the rb-cli-mini release tarball (it now bundles the daemon shim + installer):

# On the MiSTer (or over SSH), from the unpacked tarball:
./install.sh

That drops two files onto the SD card:

• /media/fat/Scripts/rb-cli — the program (no .sh, so it is not a second Scripts-menu entry).
• /media/fat/Scripts/rb-daemon.sh — the only menu entry: open it to bring up the daemon console.

Then open rb-daemon from the MiSTer Scripts menu. The console shows whether the daemon is running, whether it auto-starts on boot, and the IP:port other machines connect to, with these actions:

• Start Now / Stop Now — run or stop the daemon immediately.
• Install Autostart — start it now and launch it on every boot.
• Uninstall Autostart — stop launching it on boot (a running daemon keeps running).

Everything is scriptable too — no console needed:

rb-cli serve service install     # enable on boot + start now
rb-cli serve service status      # ACTIVE/INACTIVE, autostart, IP:port
rb-cli serve service stop        # stop the running daemon
rb-cli serve service uninstall   # remove the boot entry

Defaults (editable in /media/fat/Scripts/rb-daemon.ini) serve the whole /media/fat card on 0.0.0.0:7341, writable. From the desktop, connect to rb://<mister-ip>:7341/. The daemon design lives in docs/remote_transfer_plan.md.

Bootable backup appliances (boot the metal, no host OS)

For machines too old or too bare to run the desktop app, the same engine ships as bootable media you run on (or beside) the vintage box:

• Linux appliance — a minimal Buildroot Linux that boots straight into the rb-cli backup/restore menu (on a VGA monitor or a serial console) with the static rb-cli baked in. One hybrid ISO boots from a CD-ROM or a USB stick / CF card (dd the same file onto the device). The kernel carries a broad vintage-hardware driver set — ISA / PCI / PC-Card NICs, SCSI HBAs, bare-486 / VL-Bus + PCI IDE, Multi-I/O serial & parallel, parallel-port ZIP, USB storage — so it sees the disks and cards in a 486/Pentium-class machine out of the box. What's baked in, how to make an unusual card work (ISA modprobe io=/irq= recipes), and how to rebuild the kernel for more are in docs/appliance_hardware_support.md; build/boot overview in docs/linux_486_appliance.md.
• cb-dos — the DOS-native lane: a FreeDOS floppy / CD that images disks with a hand-written C tool over BIOS int 13h, for boxes where even a minimal Linux is too heavy. See docs/cb_dos.md.

Both build from the repo (buildroot/, crusty-backup/).

Usage

The app has five tabs:

• Backup — pick a source (physical device or image file), choose a destination folder, pick an output format and checksum type, and start. Each backup is written as a folder containing metadata.json, the partition table sidecar (mbr.json / gpt.json / apm.json / RDB / SGI), and either one compressed file per partition (Zstd / Raw / per-partition VHD) or a single <backup-name>.chd disk image that chdman info opens and MAME loads directly (CHD output). The single-file CHD also serves as the unit edit mode operates on, so changes flow back into a CHD that any CHD-aware tool can still read.
• Restore — pick a backup folder and a target device or image file. Partition sizes can be left at original, shrunk to the filesystem minimum, or set to a custom value; the filesystem is expanded in place when the restored partition is larger than the minimum. Alignment (DOS/cylinder, 1 MB, or custom) is preserved from the source by default. A top-level "Add free space for in-OS expansion" toggle pads the target image so the guest OS can extend partitions there after boot — see the Disk expansion workflow section below.
• Inspect — pick any supported source and browse the partition table, filesystem info, and file listings. Several actions live here:

  • Browse filesystem contents read-only (per partition).

  • Edit Partition Table… to add / resize / delete / retype partition entries on raw disks, image files, and devices. Writers cover MBR, GPT, APM, SGI, and RDB-bootable-flag.

  • Resize Partitions… for in-place partition data moves with filesystem-side patching.

  • Add Partition… as a streamlined entry into the editor when trailing free space exists, pre-filled per partition-table type.

  • Expand Image… to grow a raw, VHD, or CHD image with trailing zero-padding so you have room for new partitions.

  • Export Disk Image… to write VHD (fixed or dynamic), QCOW2, VMDK, Raw, 2MG, WOZ, DC42, HFV, or CHD (whole-disk or per-partition) — see docs/vhd-export.md.

  • Convert Floppy Container… to convert between the four X68000 / PC-98 / FM-7 floppy wrappers (XDF, HDM, DIM, D88) one file at a time. Bulk folder conversion lives in the existing Bulk Convert dialog, which now lists the same four formats as output targets.

  • Check (fsck) + Repair on every filesystem whose driver implements it. From the Inspect grid: HFS / HFS+, FAT / exFAT / NTFS, ext2/3/4, SGI EFS, UFS, XFS, JFS, AmigaDOS OFS/FFS (Disk Validator) / PFS3 / SFS, and the retro floppies CBM DOS / DragonDOS / RS-DOS / Acorn DFS / Human68k. From the browse view: Alto BFS/TFS (their packs open through the container path, not the block factory). Repair uses replica superblocks, lost+found, FAT-mirror resync, or allocation-bitmap rebuild depending on the filesystem. Everything here is also scriptable via rb-cli fsck (+ --repair).

  • Defragment… on Human68k (X68000) partitions: repack the volume so files are stored contiguously, reclaiming holes left by deleted files (also rb-cli repack).

  • Build a Sharp X68000 HDD from scratch via the shell: rb-cli new-x68k-hdd out.hdf --size 16M --system-disk donor.dim (SASI default, --variant scsi available) — emits a self-bootable HDD with the Sharp IPL signature, X68K partition table, and a full Human68k system clone from a donor .dim / .D88 / .xdf / .hdm floppy. Boots clean in MAME x68000 -sasi / x68030 -hard. Add --boot-sector-donor hd0.hds (the well-known 100 MB Sharp/Keisoku Giken SCSI HDD image, file size 104,857,600 bytes, widely mirrored on retro-archive sites under that exact filename) plus --variant scsi to overlay the donor's Sharp partition boot sector — the HDD then self-boots straight to C:> on every power-on with no manual SWITCH.X step. Any --size from 1 MiB to ~512 MiB works: the builder patches the donor's embedded BPB with the output partition's actual FAT geometry, so the donor boots from your sized HDD regardless of how the donor itself was sized.

  • Make a classic-Mac SCSI disk bootable via the shell: rb-cli mac-scsi-bless mac.hda installs an Apple SCSI driver and a valid Driver Descriptor Record into an APM disk so a Macintosh ROM (e.g. Quadra 800) registers the drive over SCSI. Uses a bundled known-good driver by default, or --driver-from donor.hda to copy a donor disk's driver verbatim. Operates in place; partition data never moves, and it is idempotent. (This registers the driver so the ROM can read the disk — it does not change HFS boot-block behavior.) Verified against the real Quadra 800 ROM in QEMU -M q800.

  • Make a Mac disk bootable — rb-cli make-bootable disk.img [--boot-from "System 7.5.3 HD.dsk"] (or the Inspect tab's Make Bootable... button) auto-detects what the disk is and applies only what it's missing:

    • a flat .hfv/.dsk (BasiliskII / SheepShaver / Mini vMac, e.g. a customized infinite-mac disk) — boot blocks + blessed System Folder, kept flat (no APM wrapper added);
    • a full APM disk (an infinite-mac "device image" with DDR + map + drivers, or any Mac SCSI disk image) — a SCSI driver + DDR (bundled, or --driver-from donor) if absent, then boot blocks on the Apple_HFS partition + bless, leaving the DDR / map / drivers untouched.

    Boot blocks are never synthesized — they're copied verbatim from a --boot-from donor that already boots that System, so they stay version-matched. The operation is idempotent (--dry-run previews it). The lower-level pieces are also available on their own: rb-cli put IMG[@N] --boot-from DONOR, rb-cli bless set, and the browse-view Boot Blocks... / Bless Folder buttons.

  • Edit mode on FAT, NTFS, exFAT, ext, HFS, HFS+, AFFS, PFS3, SFS, ProDOS, Apple DOS 3.3, MacPlus MFS, EFS, UFS, CP/M (multi-DPB), Human68k, and XFS (v4 + v5): stage create-file / new-folder / drag-and-drop / delete edits, then Apply atomically with snapshot rollback on error.

• Optical — browse and extract files from CD/DVD/BD images and physical optical drives. Reads ISO 9660 (with Joliet and Rock Ridge extensions), High Sierra (pre-ISO 9660), UDF, HFS and HFS+ (Mac hybrid / data discs), SGI EFS (IRIX), UFS/FFS (Tru64 / Solaris / NeXT), VMS ODS-2 (OpenVMS), and the video-game console filesystems — Nintendo GameCube & Wii (Wii decrypted internally, no key file needed), Sega Dreamcast GD-ROM (.gdi + CHD), Philips CD-i, and 3DO Opera — discs. Also identifies the console, game serial, title, and region for PlayStation, Saturn, Mega-CD, Neo Geo CD, PC-FX, CD32, and the browsable consoles. See the Optical disc filesystems table below. Re-opens automatically when the underlying disc changes.
• Archives — browse and extract classic Macintosh archives. Auto-detects StuffIt 1-5 (.sit, .sea self-extracting), Compact Pro (.cpt), MAR (.mar, read + write), MacBinary I/II/III (.bin), MacZip (Info-ZIP's Macintosh port — a .zip carrying Mac3 Finder metadata and XtraStuf.mac/ resource forks), and BinHex (.hqx) wrappers around any of them. .bin and .zip are content-detected, so a raw .bin disk image or a plain disk-image-in-a-zip still opens as a disk image. A MacBinary whose data fork is itself a StuffIt/Compact Pro archive is peeled through to the inner entries. Pick an archive, browse the entry tree (name / type / creator / size / codec), tick the entries to keep, and extract to a folder in your choice of fork-preserving container — BinHex, MacBinary, AppleDouble, or raw data + .rsrc sidecar. Export a file or folder back out as .sit, .sit.hqx, .hqx, or .mar. Single-entry archives whose payload is itself a disk image (DiskCopy 4.2, raw HFS, raw HFS+) get a one-click "Mount in new Inspect tab" handoff. rb-cli archive list / archive extract / archive create (formerly sit, still accepted) is the scriptable counterpart.

Most popups (Resize Partitions, Edit Partition Table, Export Disk Image, restore-tab partition list) use a shared Size Mode radio set (Original / Minimum / Custom / Fill) and a Current → After disk-layout bar pair so the planned outcome is always visible before you commit.

VHD export is available from the Inspect tab: produce either a whole-disk .vhd (partition table plus all partitions with their gaps) or per-partition .vhd files, ready to mount in VirtualBox, Hyper-V, or QEMU. See docs/vhd-export.md.

Disk expansion workflow

Rusty Backup can grow an existing image so its guest OS sees a bigger disk. This is useful for any filesystem the OS can expand at runtime — XFS being the motivating case (xfs_growfs can only ever grow up to the partition boundary, never the disk boundary), but the same workflow works for ext, NTFS, FAT, HFS+, exFAT, btrfs, etc.

Open an existing image and add trailing free space:

1. Open the image in the Inspect tab. Any backup, raw disk image, VHD, or CHD works.
2. Click Expand Image… in the toolbar. Enter how much MiB to add and click Expand. Raw/VHD images grow instantly via set_len; CHD images re-encode in a background worker (the CHD hunk layout is fixed at creation, so there's no in-place grow).
3. Click Re-inspect to refresh the partition list. The new trailing region appears as a gray "Free" segment in the Disk layout bar.
4. Either:
   • Click Add Partition… to allocate the free space as a new partition (defaults are pre-filled per partition-table type — XFS for SGI, 0x83 for MBR, Linux Filesystem GUID for GPT, Apple_HFS for APM), or
   • Click Edit Partition Table… and bump the last partition's size via the Size Mode radios.
5. Boot the guest OS and run the filesystem's native grow tool (xfs_growfs /mountpoint, resize2fs, Disk Management's Extend Volume, IRIX fx + xfs_growfs, …).

Same workflow during a restore (useful when the target physical disk is larger than the source):

1. Restore tab → pick the backup and an image-file target. (The feature is disabled for device targets — physical disk size is fixed.)
2. Tick Add free space for in-OS expansion and enter MiB.
3. Pick a mode:
   • Leave as unpartitioned free space (recommended) — partition table stays unchanged; the guest OS uses its native partitioner plus xfs_growfs (or equivalent). Works for any filesystem on any OS.
   • Extend last partition automatically — the last partition is sized to absorb the new free space during restore. After restore, only the filesystem-side grow tool is needed.
4. The Current / After disk-layout bar pair shows the planned result before you commit.

Note on visualisations: the Disk layout bar appears in five places (Inspect, Restore, Resize Partitions, Edit Partition Table, Export Disk Image) so what you see is always what'll be written. Partition colours cycle through a stable palette; tiny partitions (≤ ~1 MiB) get a minimum-width pip so GPT/APM disks with many small partitions stay readable.

Compatibility

Image / backup formats

Format	Extension	Read as source	Write as backup	Notes
Raw	.img, .raw, .hda	Yes	Yes	Sparse zero-skipping; optional splitting
Fixed VHD	.vhd	Yes	Yes	512-byte footer; also used for VHD export
Dynamic VHD	.vhd	Yes	Yes	Sparse, allocate-on-write
QCOW2 (QEMU)	.qcow2	Yes	Yes (create / edit)	v2 + v3
VMDK (VMware)	.vmdk	Yes	Yes (create / edit)	Flat and monolithic-sparse
Zstd stream	.zst	Yes	Yes	Good general compression, splittable
Gzip stream	.gz	Yes	Yes	DEFLATE per-partition member; the codec shared with crusty-backup (cb-dos) so DOS-side backups restore + resize here unchanged. --format gzip
LZ4 stream	.lz4	Yes	Yes	LZ4 frame per-partition member; the other codec shared with crusty-backup (cb-dos /CODEC:LZ4) — faster than gzip on a slow CPU at a lower ratio. Restored + resized exactly like a .gz member. --format lz4
cb-dos container	.cbk	Yes (native)	Yes (cbk pack)	Single-file form of a backup folder (chunked gzip members + index). Opens like any disk image — inspect, ls/get (browse + extract), fsck, GUI Inspect, and restore all work directly, no extract step. Large partitions are split into ~4 MiB source-span gzip members (via the partition-N.gz.idx seek layout), so the lazy reader seeks per-chunk instead of decompressing from the start. rb-cli cbk pack/unpack convert to/from a folder. Frozen v1; the eventual cb-dos network transport's on-disk artifact
CHD (MAME)	.chd	Yes	Yes	Native (MAME's CHD core is bundled — no external chdman needed)
Norton Ghost	.gho, .ghs	Yes	No	File-aware FAT/NTFS browse, sector + spanned sets, Ghost 7.5, password-protected images decrypted automatically
WinImage	.imz	Yes	No	Including password-protected archives
ZIP (raw disk)	.zip	Yes	No	A RAW disk image inside a plain ZIP. Auto-picks the disk entry (--inside NAME to choose one of several); inflated sparsely to a temp file at open, so a mostly-empty multi-GB image only uses its real content. Picker-visible but not OS-associated
BasiliskII HFV	.hfv	Yes	Yes	Flat classic-HFS volume (≤ 2047 MB) for 68k Mac emulators
Apple 2MG	.2mg	Yes	No	Apple II / IIgs disk images
Apple II DSK	.dsk, .do, .po	Yes	No	DOS-order, ProDOS-order, and auto-detect sector orderings
Disk Copy 4.2	.dc42, .image	Yes	No	Classic Mac floppy images. Apple Twiggy / FileWare 871 KB prototype images (the recovered MacPaint 0.5 / early Finder disks, disk-format byte 0x54) are auto-detected and de-interleaved into their MFS/HFS volume — the two sides are stored sequentially, so the volume is recovered by rotating the sector array onto its Master Directory Block.
Apple DMG	.dmg	Yes (raw/UDRW)	No	Uncompressed DMGs only
WOZ	.woz	Yes	Yes (export)	Apple II 5.25" and 3.5"; WOZ2 writer regenerates a clean image
DART	.dart, .image, extensionless	Yes (decode)	No	Apple's Disk Archive/Retrieval Tool — the compressed disk image contemporary with DiskCopy 4.2. Content-detected (no magic number). Fast (word-RLE), best (LZHUF), and uncompressed chunks all handled; LZHUF validated byte-exact against a real Apple image. Preserves the 12-byte sector tags, so Lisa DART disks open as Lisa volumes; Mac / Apple II / MS-DOS DART disks decode to their block data and route to the normal filesystem detection.
Amiga ADF / HDF	.adf, .hdf	Yes	Yes (raw)	Floppy + hard-disk images. RDB partition tables parsed. Arculator-wrapped .hdf (Acorn) auto-detected.
Gzip-wrapped	.adz, .hdz, .gz	Yes	.adz/.hdz only	Any gzip-wrapped disk image, transparently decompressed at open. .adz/.hdz are the editable Amiga floppy/HDD wrappers; a bare .gz (e.g. a .pdi.gz Alto/Pilot pack or a gzipped raw image) is read-only.
Atari MSA	.msa	Yes	No	Magic Shadow Archiver — Atari ST 720K / 800K / 1.44MB floppy
CPCEMU DSK / EDSK	.dsk	Yes	No	Amstrad CPC / PCW / Einstein / Oric CP/M floppies
Commodore disk	.d64, .d71, .d81, .d80, .d82	Yes	Yes (in-place edit)	1541 / 1571 / 1581 + PET 8050 / 8250 (IEEE-488) flat sector dumps for the C64 / C128 / C16 / VIC-20 / PET cores. Read/browse/extract + add/delete persist back into the image (bidirectionally cross-validated against the c1541 / Python d64 reference).
Commodore GCR	.g64, .g71	Yes (decode)	No	Raw 1541 / 1571 GCR track images (preservation-grade). Decoded to flat sectors so the CBM engine can read them; the .g71 side-1 mapping is validated against a real VICE c1541 image.
Atari disk	.atr, .xfd	Yes	Yes (in-place edit)	8-bit Atari (400/800/XL/XE) disk images for the Atari800 core. .atr = 16-byte header + sector body; .xfd headerless. Read/browse/extract + add/delete on the Atari DOS 2 volume.
CoCo disk	.dsk, .jvc, .vdk	Yes	Yes (in-place edit)	Tandy Color Computer (CoCo2 / CoCo3 cores) raw 35- / 40-track sector dumps. Headerless flat body (length a multiple of 256). Auto-detects the volume's filesystem: RS-DOS / Disk BASIC (flat granule FS) or OS-9 / NitrOS-9 RBF (hierarchical). Read/browse/extract + add/delete on both.
Acorn DFS disk	.ssd	Yes	Yes (in-place edit)	BBC Micro / BBC Master / Acorn Electron (MiSTer BBCMicro / AcornElectron cores) single-sided floppy. Flat 40-track (100K) / 80-track (200K) sector dump in logical order. Read/browse/extract + add/delete on the Acorn DFS catalogue. (Track-interleaved double-sided .dsd is a follow-up.)
ZX Spectrum TR-DOS	.trd	Yes	Yes (in-place edit)	ZX Spectrum Beta Disk (MiSTer ZX-Spectrum core). Flat raw sector dump in logical track order (80-/40-track, single-/double-sided; 16 × 256-byte sectors). Read/browse/extract + add/delete/rename on the TR-DOS catalogue; geometry auto-detected from the disk-info sector.
TI-99/4A disk	.dsk	Yes	Yes (in-place edit)	TI-99/4A (MiSTer TI-99_4A core) flat V9T9 sector image (SSSD 90K / DSSD / SSDD 180K / DSDD 360K). Read/browse/extract + add/delete/rename on the TI disk filesystem (VIB + FDIR + extent-based FDR files, big-endian); geometry read from the VIB. Content-detected via the "DSK" volume marker.
Sharp D88	.d88	Yes	Yes (convert + in-place edit)	X68000 / PC-88 / PC-98 / MSX / FM-7 sparse track-table container. Add/delete/mkdir on the contained Human68k FAT volume persist back into the container (decode -> edit -> re-encode).
X68000 XDF	.xdf	Yes	Yes (convert + in-place edit)	Raw headerless X68000 floppy dump; geometry inferred from size. In-place file add/delete/edit supported.
X68000 HDD	.hda, .hdf, .hds, .ima	Yes	Yes (in-place edit + resize + defrag repack)	Sharp SASI/SCSI hard-disk images; X68k partition table + Human68k FAT12/16. Read/browse/extract + add/delete/mkdir + in-place FS grow/shrink + contiguous repack (SHARP/KG big-endian BPB & FAT). Geometry auto-detected: SCSI X68SCSI1 (table @ 0x800, 1024-byte sectors) and SASI (table @ 0x400, 256-byte sectors, incl. custom-IPL game disks).
PC-98 HDM	.hdm	Yes	Yes (convert + in-place edit)	DiskExplorer raw headerless floppy dump (byte-identical to XDF). In-place file add/delete/edit supported.
DiskExplorer DIM	.dim	Yes	Yes (convert + in-place edit, DIFC)	DIFC 256-byte header + payload; generic 256-byte-header fallback for IBM XDF DIM on read. Add/delete/edit persist back into the container.
Xerox Alto pack	.pdi, .bfs, .copydisk, .altodisk	Yes	Yes	Diablo 31/44 disk packs for the Xerox Alto. .pdi = PARC Disk Image (a flat, self-describing, label-inclusive container designed as the recommended emulator format); .bfs / .copydisk / .altodisk = period CopyDisk streams, imported transparently. Detected by magic, surfaced as a single browsable Alto BFS volume. Browse + extract + add/delete + resize; edits save as PDI.
Salto disk	.dsk	Yes	Yes	Salto Alto-II emulator "cooked" Diablo-31 image ([pageno][header][label][data] per sector). Byte order auto-detected (Salto-native little-endian or big-endian); export writes Salto-native little-endian so the result loads in the emulator. Same Alto BFS content as the other Alto packs.
ContrAlto2 Diablo	.dsk	Yes	No	ContrAlto2 / Bitsavers Diablo-31 pack ([dummy][header][label][data], little-endian, sector-interleaved) — same size as a Salto .dsk but distinguished by content; sectors placed by their header disk address. Read as an Alto BFS volume.
Trident pack	— (raw, size-detected)	Yes	Yes	Trident T-80 / T-300 pack image (ContrAlto2 / dorado layout: [dummy][header][label 10w][data 1024w] per sector, little-endian, 2048-byte pages, physical sector interleave). The same Alto file system (TFS) on Trident hardware; recognized by the exact T-80 (~76 MB) / T-300 (~285 MB) size, surfaced as an Alto BFS volume. Validated against ContrAlto2's real Spruce print-server T-300 pack.
Xerox Pilot/Cedar volume	.pdi (fsFamily=2)	Yes	Yes (create / add file)	D-machine Pilot/Cedar filesystem in a PARC Disk Image. Physical/logical volume roots, subvolume table, VAM, run-table files; both file-ID generations (32-bit Cedar nucleus / 80-bit original Pilot via flags bit 2). Surfaced as a read-only Pilot/Cedar volume in the GUI; blank-volume + add-file via pilot_probe. See docs/ PARC specs.
Dwarf 6085 disk	.zdisk, .zdelta	Yes	No	Dwarf "Draco" 6085/Daybreak emulator rigid-disk image — a zlib stream of label-inclusive Pilot sectors (10-word label + 256-word data; the 6085/IOP stores labels byte-swapped, normalized on read). Opens as a read-only Pilot/Cedar volume; lists and extracts files. The disks shipped with Dwarf (ViewPoint 2.0, XDE 5.0) are the real Pilot volumes our reader was validated against.
Raw physical disk	—	Yes	Yes (restore target)	CF/SD/USB/HDD/SSD — see below

"Yes (convert)" means the format isn't a backup wrapper but is fully round-trippable via the Convert Floppy Container… dialog and rb-cli floppy convert — useful for moving images between MiSTer cores, real hardware utilities, and emulators that each prefer a different floppy container.

Filesystems

All listed filesystems support browsing in the Inspect tab and are preserved intact on backup/restore. "Shrink" means the filesystem can be safely compacted to its minimum size during backup and re-expanded during restore or VHD export. "Edit" means create / delete / drag-and-drop via the inspect-tab Edit Mode.

Filesystem	Browse	Edit	Shrink / expand	fsck	Notes
FAT12	Yes	Yes	Yes	Yes (check + repair)	Apple II SuperDrive, DOS floppies. rb-cli backup --defrag repacks files contiguously (boot-aware). fsck reconciles FAT chains (loops, bad/lost/cross-linked clusters, size vs. chain) and FAT-mirror consistency; repair is FAT-only (frees lost chains, truncates, resyncs mirrors), validated against fsck_msdos.
FAT16	Yes	Yes	Yes	Yes (check + repair)	DOS / Windows 3.x / 9x. rb-cli backup --defrag repacks files contiguously (boot-aware). fsck reconciles FAT chains + mirror copies; see FAT12.
FAT32	Yes	Yes	Yes	Yes (check + repair)	Windows 95 OSR2+ through XP, vintage Linux. rb-cli backup --defrag repacks files contiguously (boot-aware). fsck reconciles FAT chains + mirror copies; see FAT12.
exFAT	Yes	Yes	Yes (in-place + defragmenting clone)	Yes (check + repair)	Modern removable media (e.g. MiSTer SD cards). In-place resize trims trailing free space; the defragmenting clone (Compact Space toggle / shrink-to-minimum) repacks allocated clusters into a fresh, smaller volume, so a fragmented card backs up to ~its real data size. fsck reconciles the allocation bitmap against the directory tree (lost / cross-linked clusters), checks the boot-region checksum + backup, and clears the VolumeDirty flag; repair rebuilds the bitmap and resyncs the boot regions, validated against fsck_exfat.
NTFS	Yes	Yes	Yes (in-place + defragmenting clone)	Yes (check + repair)	Windows NT / 2000 / XP. In-place resize trims trailing free space; the defragmenting clone (Compact Space toggle / shrink-to-minimum) repacks into a fresh, smaller NTFS volume (from-scratch clean-room formatter, validated to mount under ntfs-3g). Create blank volumes with rb-cli new --fs ntfs (selectable --cluster-size / --sector-size, 512 B–2 MiB clusters); the defragmenting clone inherits the source volume's cluster and sector size. fsck reconciles $Bitmap against the MFT walk, resyncs $MFTMirr and the backup boot sector, and clears the VolumeDirty flag; repair rewrites these metadata structures, validated against Windows chkdsk.
ext2 / ext3 / ext4	Yes	Yes	Yes (backup-compaction group shrink)	Yes (check + repair, incl. ext4 metadata_csum)	Early Linux installs onward. Create blank volumes with rb-cli new --fs ext (plain ext2), --fs ext3 (adds a jbd2 journal), or --fs ext4 (extents + metadata_csum + journal); all e2fsck-clean. fsck reconciles the block + inode bitmaps and free counts (Pass-5 style) and repairs them, validated against e2fsck. On metadata_csum (ext4) volumes the crc32c on the superblock, descriptors, bitmaps, inodes, and directory blocks is verified and recomputed — so fsck-repair and in-place edits (create/delete/rename) keep the volume e2fsck-clean. The backup compactor packs a volume into fewer block groups (resize2fs-grade: flex_bg metadata migration, dropping the resize inode, and relocating the journal + multi-block files as contiguous runs), so a lightly-used real-world ext4 backs up to ~its real data size. Restoring at original size grows it back by adding block groups (the mirror resize2fs-grade grow) to fill the partition; both directions verify e2fsck-clean. (A grow whose GDT would need more blocks — e.g. a 1 KiB-block sub-512 MiB volume gaining groups — is left for resize2fs; 4 KiB-block ext4 up to 8 TB grows in place.)
HFS (Mac OS Standard)	Yes	Yes	Yes	Yes (check + repair: replica copy, bitmap fixup, lost+found for orphans)	Classic Mac OS 68k / early PowerPC. Includes block-size expansion via clone (Expand HFS Volume…). Volumes written by rusty-backup are fsck_hfs-clean and mountable on real Mac OS (verified on Mac OS X 10.4).
HFS+ / HFSX	Yes	Yes	Yes (defrag clone)	Yes (check + repair)	Mac OS Extended; hardlink resolution. Create blank volumes with rb-cli new --fs hfsplus (--case-sensitive for HFSX). The catalog / extents-overflow / attributes B-trees grow their backing fork on demand, so an under-sized or foreign catalog fills in place without a spurious "disk full"; all written volumes are fsck_hfs-clean and mountable on macOS.
MacPlus MFS	Yes	Yes	—	—	Macintosh File System — the original flat Mac filesystem for 128K / 512K / Plus 400 KB single-sided floppies (pre-HFS, 1984-86). Read + edit; no blank-format or resize. Resource forks round-trip both ways, like HFS: extracted (get-binhex, MacBinary / AppleDouble export, cp, remote) and written (put-binhex, put-macbinary, setrsrc, fork-carrying cp into MFS) — each fork stored as its own allocation-block chain. Applies to Twiggy / FileWare .dc42 disks too (they de-interleave to a flat MFS volume).
btrfs	Yes	No	Yes (volume resize)	—	Modern Linux; read-only browse (no file-level edit).
JFS (JFS2)	Yes	No	Yes (compaction)	Yes (check + repair)	IBM OS/2 Warp Server, AIX 5+, Linux JFS2. Read-only browse + backup compaction + integrity check. fsck repair reconnects orphaned (allocated-but-unreachable) inodes into /lost+found, verified against Linux fsck.jfs. Legacy AIX JFS1 is detected but not read.
ReiserFS (v3)	Yes	No	Yes (compaction)	—	Linux, late-1990s to mid-2000s. v3.5 / v3.6 read-only browse + backup compaction. Reiser4 is detected but not supported.
Minix (V1/V2/V3)	Yes	Yes	—	Yes (check + repair)	Minix, and Linux's original filesystem (pre-ext). Browse + edit (create / delete / rename) of all three on-disk generations: V1 (magic 0x137F/0x138F, 14/30-char names), V2 (0x2468/0x2478), V3 (0x4D5A, 60-char names). Create blank volumes with rb-cli new --fs minix (V1), --fs minix2, or --fs minix3 — geometry matches mkfs.minix. fsck reconciles the inode + zone bitmaps and link counts against the directory-tree walk and adopts orphaned inodes into /lost+found. Auto-detected as a raw floppy / hard-disk superfloppy or MBR type 0x81. Every write is validated against Linux fsck.minix.
UFS / FFS (UFS1 / UFS2)	Yes	Yes	Yes (compaction)	Yes (check + repair)	BSD Fast File System — 4.2/4.4BSD, FreeBSD, SunOS / Solaris, NeXTSTEP. Read + edit (create / delete / rename, fixture-validated), backup compaction, and fsck with replica-superblock / bitmap / orphan repair.
ProDOS	Yes	Yes	Yes	Yes	Apple II / IIgs (.po / .hdv / .2mg, 8 KiB–32 MiB). Create blank volumes with rb-cli new --fs prodos (boot + 4-block volume directory + bitmap). fsck reconciles the volume bitmap against the directory-tree + file-index walk (seedling / sapling / tree files + subdirectories, the CBM VALIDATE model): reclaims leaked blocks and flags blocks in use but marked free; repair rebuilds the bitmap, withheld on cross-links / past-end blocks / directory-chain cycles.
Apple DOS 3.3	Yes	Yes	—	Yes	Apple II. 140 KB 5.25" disks (.dsk / .do / .po, sector-order auto-detected). Gated to the exact 140 KB geometry. Create blank (non-bootable) data disks with rb-cli new --fs apple-dos. fsck reconciles the VTOC free map (bit-set-is-free) against the catalog + file T/S-list chains (the CBM VALIDATE model): reclaims leaked sectors, flags sectors in use but marked free, surfaces cross-links / broken chains read-only; the DOS-image region on tracks 0-2 is reported as a benign warning, never reclaimed.
UCSD p-System	Yes	Yes	—	Yes (check + repair)	UCSD Pascal (Apple II/III, PC, and many late-1970s/80s machines). A flat single directory of up to 77 contiguous files (no subdirectories, no allocation bitmap). Browse + edit (create / delete / rename — contiguous first-fit allocation; a create that won't fit any single free run is refused rather than fragmenting). Create blank volumes with rb-cli new --fs ucsd (alias pascal). fsck validates the directory self-consistency (volume label, in-bounds non-overlapping runs, file count); repair re-sorts entries, corrects the count, and drops invalid entries, while overlaps / past-end runs are surfaced read-only. Auto-detected via the block-2 volume label, with byte order recovered from the label's DLASTBLK. Every write is validated against an independent clean-room oracle (scripts/ucsd-oracle.py).
Apple Lisa File System	Yes	No	—	—	Apple Lisa (Office System 1.0 / 2.0 / 3.0), read-only browse + extract. Opened from tag-bearing DiskCopy 4.2 (.dc42 / .image) and DART images. Files are reconstructed from the 12-byte sector tags (file ID + file-relative block) — independent of the three catalog formats — so extraction works on every disk; friendly names come from the flat-table (0x0e) / flat-hash (0x0f) catalog, while the hierarchical B-tree version (0x11, Office System 3.0) falls back to file-XXXX. The metadata label (first 0xF0 bytes) is stripped from each file's data fork. Requires an image that still carries tags (DiskCopy versions after 4.2 strip them). Mirrors Ray Arachelian's lisafsh-tool.
CBM DOS (1541 / 1571 / 1581 / 8050 / 8250)	Yes	Yes	— (floppy, fixed geometry)	Yes	Commodore C64 / C128 / C16 / VIC-20 / PET. PETSCII names, bit-set-is-free BAM, linked-sector files. .d64 / .d71 / .d81 / .d80 / .d82; .g64 GCR decoded to sectors. fsck = CBM DOS VALIDATE (BAM reconciliation: leaked / used-but-free blocks, free-count fixes), rewrite cross-validated byte-for-byte against c1541 validate.
Atari DOS 2 (2.0S / 2.5)	Yes	Yes	— (floppy, fixed geometry)	Yes	Atari 8-bit (Atari800 core). VTOC@360 (bit-set-is-free), 64-file directory, linked-sector files. Single + enhanced density .atr / .xfd. Create blank single-density disks with rb-cli new --fs atari. fsck reconciles the VTOC bitmap + free-sector count against the directory's linked-sector chains (the CBM VALIDATE model): reclaims leaked sectors, flags sectors in use but marked free, surfaces cross-links / broken chains read-only; repair rewrites the bitmap + count (single density — the DOS 2.5 VTOC2 upper region is left unchecked).
RS-DOS (CoCo Disk BASIC)	Yes	Yes	— (floppy, fixed geometry)	Yes	Tandy Color Computer (CoCo2 / CoCo3 cores). Granule allocation table on track 17, 72-file directory, granule-chain files. Raw 35- / 40-track .dsk / .jvc. Read/extract + add/delete bidirectionally cross-validated against an independent clean-room reader/writer derived from the toolshed libdecb semantics. fsck reconciles the granule table against the directory file chains (the CBM VALIDATE model): reclaims leaked granules into the free list, surfaces cross-linked granules and broken chains read-only.
OS-9 / NitrOS-9 RBF	Yes	Yes	— (floppy, fixed geometry)	Yes	Tandy Color Computer (CoCo2 / CoCo3 cores) and Dragon. Hierarchical Unix-like FS: LSN-0 identification sector, per-file/dir 256-byte file descriptors, segment-list extents, allocation bitmap (set-bit = allocated). Raw .dsk / .vdk. Read/extract + add/delete (incl. subdirectories) cross-validated byte-exact against an independent clean-room RBF reader on real NitrOS-9 toolshed disks. Create blank 35-track floppies with rb-cli new --fs os9. fsck walks the directory tree from the root FD (FDs + segment-list runs, recursing into subdirectories) and reconciles it against the cluster bitmap: a referenced cluster marked free is a repairable error; allocated-but-unreferenced clusters (the boot area or a reserved track — a real NitrOS-9 disk reserves its last track) are surfaced as a benign warning, never freed; cross-links / past-end segments are read-only.
DragonDOS	Yes	Yes	— (floppy, fixed geometry)	Yes	Dragon Data Dragon 32/64 (and CoCo running DragonDOS), MiSTer Dragon core. Directory track 20 (backup on 16), one's-complement geometry signature, sector bitmap (set-bit = free), 25-byte directory entries with header + continuation extent blocks. Raw single- / double-sided 40-track .dsk. Read/extract + add/delete cross-validated byte-exact against an independent clean-room reader/writer and against real third-party DragonDOS disks (empty + a populated 9-file disk). fsck reconciles the sector bitmap against the directory extent chains (the CBM VALIDATE model — leaked / used-but-free sectors), rewriting both the main and backup directory-track copies.
Acorn DFS	Yes	Yes	— (floppy, fixed geometry)	Yes	BBC Micro / BBC Master / Acorn Electron (MiSTer BBCMicro / AcornElectron cores). Flat-catalogue FS in sectors 0–1: 12-char disc title, up to 31 contiguous files in descending start-sector order, single-character directory namespaces, 18-bit load/exec/length. Single-sided .ssd (40-/80-track). Read/extract + add/delete bidirectionally cross-validated byte-exact against an independent clean-room DFS reader/writer (locked files, non-$ directories, real load/exec addresses all round-trip). fsck verifies the contiguous-file catalogue is self-consistent — flags overlapping and out-of-bounds files read-only, and reorders a scrambled catalogue back into canonical descending start-sector order as the one safe repair.
Acorn ADFS / FileCore	Yes	Partial	—	—	Acorn Archimedes, BBC Master, RISC OS. Read + browse .adf floppy and bare / Arculator-wrapped .hdf HDD (E-format validated). Create/delete implemented for E-format; the full write path is still maturing.
TI-99	Yes	Yes	— (floppy, fixed geometry)	Yes (check + repair)	TI-99/4A (MiSTer TI-99_4A core). A proper little filesystem (unlike the contiguous CoCo/ZX floppies): a Volume Information Block with an allocation bitmap (bit set = used), a sorted File Descriptor Index of File Descriptor Records, and extent-based files (a packed 3-byte-per-cluster chain). All fields big-endian (TMS9900). Flat V9T9 .dsk (SSSD 90K / DSSD / SSDD 180K / DSDD 360K); geometry read from the VIB. Browse + edit (create / delete / rename): create allocates from the bitmap, writes an FDR + cluster chain, and inserts a sorted FDIR pointer; delete frees the bitmap bits (files are stored as PROGRAM files). Create blank volumes with rb-cli new --fs ti99 (alias ti99_4a); the geometry follows --size (smallest of 90 KB SSSD / 180 KB DSSD / 360 KB DSDD that covers it, DSDD default). fsck reconciles the VIB bitmap against the directory walk (FDIR -> FDR -> cluster chain): structural checks (in-range FDR/data sectors, chain-length agreement, FDIR sort order, cross-linked sectors) then the bitmap comparison; repair rebuilds the bitmap and is withheld on structural damage. Content-detected via the "DSK" volume marker. Every write is cross-validated against both MAME's imgtool reader and an independent clean-room oracle (scripts/ti99-oracle.py).
TR-DOS	Yes	Yes	— (floppy, fixed geometry)	Yes (check + repair)	ZX Spectrum Beta Disk (MiSTer ZX-Spectrum core). A flat single directory of up to 128 contiguous files (no subdirectories, no allocation bitmap); files pack from the first data sector and a first-free high-water mark advances on save, never retreating on erase (space is reclaimed only by TR-DOS's MOVE). Raw .trd — geometry (80-/40-track, single-/double-sided) comes from the disk-info sector's type byte; addressing is a flat logical-track sector array. Browse + edit (create / delete / rename): create appends at the high-water mark, delete tombstones the entry (name byte 0x01, deleted-count bumped, sectors kept — authentic TR-DOS). A file addresses its type via a NAME.T suffix (e.g. LOADER.B, SCREEN.C). Create blank volumes with rb-cli new --fs trdos (alias beta); the geometry follows --size (smallest of 160 KB / 320 KB / 640 KB that covers it, 640 KB default). fsck verifies the disk-info signature and the contiguous catalogue packing, then reconciles the disk-info counters (file / deleted counts, first-free pointer, free-sector count) against a catalogue walk; repair recomputes those counters, and is withheld when the packing itself is damaged (non-contiguous / past-end entries are surfaced read-only). Auto-detected via the disk-info sector's id byte (0x10). Every write is cross-validated against an independent clean-room oracle (scripts/trdos-oracle.py).
Human68k (FAT12 / FAT16)	Yes	Yes	Yes (HDD in-place grow + shrink, plus defragmenting repack)	Yes	Sharp X68000. SASI/SCSI hard disks use a Sharp/KG big-endian BPB + big-endian FAT; floppies use standard little-endian FAT. Shift-JIS 18.3 filenames. Shrink stays above the FAT16 floor. rb-cli repack / the Inspect-tab "Defragment…" button repack the volume contiguously, reclaiming holes left by deleted files. fsck reconciles the FAT against the directory tree (the CBM VALIDATE model): reclaims lost clusters, resyncs the backup FAT copy from the primary, and surfaces cross-linked clusters and broken chains read-only.
CP/M (2.2 / 3 / Plus)	Yes	Yes	—	Yes	Amstrad CPC / PCW, Tatung Einstein, Spectravideo SV-328, MITS Altair, Grant Searle MultiComp, ZX Spectrum +3. Nine built-in disk-parameter blocks (DPBs); CP/M has no on-disk signature, so the format is chosen explicitly (--fs-type cpm:<preset>, or rb-cli new --fs cpm --cpm-preset <name> to format a blank disk). fsck is a directory self-consistency check (CP/M keeps no on-disk free map): it flags cross-linked blocks, out-of-range block pointers, and invalid directory entries (CP/M 3 disk-label / timestamp entries are recognized as valid); repair reclaims invalid entries — cross-links have no redundant metadata to recover from, so they are surfaced read-only.
QDOS (QXL.WIN)	Yes	Yes	Yes (in-place resize)	—	Sinclair QL hard-disk container. Read + write + resize; the per-file 64-byte QDOS header is preserved. Microdrive .mdv is detect-only.
AFFS (OFS / FFS)	Yes	Yes	Yes (in-place; bm_pages only)	Yes (Amiga Disk Validator)	Amiga DOS\0..DOS\7. In-place resize relocates root + bitmap pages; refuses on bm_ext-chain volumes or when allocated data would be clobbered.
PFS3 / PDS3 / muFS	Yes	Yes	Yes (in-place + defragmenting clone)	Yes (validate + repair)	Amiga PFS3 family. Shrink refuses to truncate live data; clone path packs the volume for genuinely smaller targets. fsck walks the directory tree + anode chains and reconciles both the data and reserved allocation bitmaps (plus the free-block counters) against the walk, rebuilding them when the structure is intact — the classic "validation needed" after an unclean unmount. PFS3 has no block checksums, so structural damage is surfaced read-only rather than silently rewritten.
SFS (Smart File System)	Yes	Yes (single-leaf btree)	Yes (in-place trim/grow)	Yes (validate + repair)	Amiga SFS\0 / SFS\2. fsck validates every metadata-block checksum, walks the AdminSpaceContainer chain + object tree, and reconciles the single block bitmap against the walk, rebuilding it when the structure is intact. Repair touches only bitmap blocks, so it is safe regardless of btree depth.
SGI EFS	Yes	Yes	Yes (in-place grow + conservative + aggressive shrink)	Yes (check + repair: replica copy, bitmap fixup, lost+found)	IRIX < 6.0. Aggressive shrink renumbers inodes into low CGs.
SGI XFS (v4 / v5)	Yes	Yes (v4 only; v5 editing pending)	Grow only — disk-layout "Add free space" + in-OS xfs_growfs. Known limitation: no backup compaction or in-place shrink (XFS backups are written full-size); clone-into-fresh shrink is planned (see docs/OPEN-WORK.md §2.2)	Yes (R1-R8 repair pipeline; v4 oracle-validated)	IRIX 6.x and Linux. xfs_repair-clean writes.
Alto BFS / TFS	Yes	Yes	Yes (resize)	Yes	Xerox Alto Basic File System on Diablo 31/44 packs and the same file system on Trident T-80/T-300 (TFS) — one codec parameterized by page size (512 vs 2048 B), label shape (8- vs 10-word), and disk-address width (1- vs 2-word). Flat SysDir namespace, leader pages, page-chain files, and out-of-band sector labels (the file structure lives in the labels, not the data area). Browse + extract + add/delete + resize; opened from .pdi / .bfs / .copydisk / .altodisk / Salto .dsk / Trident pack images (edits save as PDI). Diablo validated against every CopyDisk pack in the CHM Xerox PARC archive + the Salto/dorado disks; Trident validated against ContrAlto2's real Spruce print-server T-300 pack (plus synthetic round-trip for the write path). fsck reconciles the DiskDescriptor free-page bitmap + count against the file page-chains (VALIDATE model), flagging overlaps / broken chains read-only and rebuilding the bitmap as the repair; rb-cli fsck --repair writes the fix back as a PDI (in place for a .pdi input).
Pilot / Cedar	Yes	No (read-only in GUI)	—	—	Xerox D-machine Pilot/Cedar nucleus filesystem (Dolphin/Dorado/Dandelion), structurally unrelated to BFS: physical/logical volume roots (seals 121212₈ / 131313₈), a subvolume table, the VAM free bitmap, and extent-based files behind out-of-band sector labels. Both file-ID generations (32-bit Cedar nucleus / 80-bit original Pilot) and both label schemes (Cedar-nucleus + classic Pilot 12.3). Browse + extract files in the GUI (enumerated by page-label scan across all subvolumes; the nucleus has no name directory, so real names come from the Cedar client name directory — the FS name->FileID B-tree in rootFile[client], decoded when present — then from each file's leader page (XDE volumes name ~90% of files this way, ViewPoint names its boot/system files), and otherwise are synthesized from the file ID); blank-volume creation + add/delete files + installing a client name directory (pilot_probe set-dir) via pilot_probe. Validated against real ViewPoint 2.0 / XDE 5.0 volumes from the Dwarf 6085 emulator (.zdisk) as well as round-trip. (ViewPoint client files have no on-disk name — no leader name and no Pilot central directory; their names live in the desktop / NS-Filing layer, not on the local disk — so they surface by ID.) See the PARC specs under docs/.
Carve (raw recovery)	Yes (read-only)	No	—	—	Fallback for disks with no mountable filesystem: custom bootblock Amiga disks (demos / intros / diagnostics that boot from the boot block and write raw sectors — AmigaDOS labels these "NDOS"), and any superfloppy whose filesystem isn't recognized. Surfaces whole-disk.img, bootblock.bin (Amiga), and carved-blkNNNNNN.{jsonl,json,txt} for each recoverable run of contiguous text. Browse + extract only (rb-cli ls / get). Scans the first 10 MB by default; the browse-view Full scan toggle (CLI --carve-full) scans the whole image.

Two more filesystems are detect-only scaffolds — Rusty Backup recognizes them but cannot yet browse their contents: ANDOS (Soviet BK0011M / Elektronika BK) and the Sinclair QL Microdrive (.mdv). The complete engine-level matrix — every filesystem's detect / browse / edit / create / shrink / fsck level, plus the filesystems not yet supported and why — lives in docs/filesystem_coverage_audit.md.

Optical disc filesystems

Optical discs are read through the opticaldiscs engine and surfaced in the Optical tab (and rb-cli optical browse / extract). These are browse + extract only — no edit, resize, or fsck — and are read from .iso / .toast, .bin + .cue, and CD/DVD .chd containers (a raw 2352-byte-sector image inside a bare .iso is auto-detected), plus the Dreamcast .gdi track descriptor and the Nintendo GameCube / Wii container family (.gcm .rvz .wbfs .ciso .gcz .wia .tgc .nfs; a raw GameCube/Wii dump in a bare .iso is auto-detected by magic).

Filesystem	Typical discs
ISO 9660 (+ Joliet, Rock Ridge)	PC / Unix / mixed data CDs and DVDs. Joliet = Unicode long names; Rock Ridge = POSIX names, permissions, and symlinks.
High Sierra	Pre-ISO 9660 CD-ROMs (early Microsoft / IBM titles).
UDF	DVDs and data discs (UDF 1.02–2.01). UDF 2.50+ metadata-partition discs (Blu-ray) are detected only.
HFS / HFS+	Classic Mac and Mac OS X CDs / DVDs, including "Mac/PC" hybrids — resource forks and type/creator preserved.
SGI EFS	IRIX install / distribution CDs (read via the SGI Volume Header).
UFS / FFS	Digital UNIX / Tru64 and SunOS / Solaris CDs, plus NeXT / OpenStep / Rhapsody discs.
VMS ODS-2 / Files-11	OpenVMS (VAX / Alpha) discs.
GameCube / Wii	Nintendo GameCube (GCM/FST) and Wii discs. Wii encrypted partitions are decrypted internally — no key file required. Read via the nod crate, including the compressed .rvz / .wbfs / .ciso / .gcz / .wia containers.
CD-i	Philips CD-i (Green Book) discs — big-endian ISO 9660 variant.
3DO Opera	Panasonic / 3DO game discs (big-endian block tree).

Game discs also carry a console / serial / title / region identity line (shown in the Optical tab, the browse header, and rb-cli optical browse), recognized for PlayStation 1/2, Saturn, Mega-CD, Dreamcast, Neo Geo CD, PC-FX, PC Engine CD, CD32, GameCube, Wii, CD-i, and 3DO.

Partition tables

Scheme	Parse	Edit (resize / add / delete / retype)	Notes
MBR	Yes	Yes	PC standard. Logical partitions inside an extended container are surfaced read-only.
GPT	Yes	Yes	Primary + backup header rewritten with refreshed CRCs on every edit.
APM	Yes	Yes	Apple Partition Map (68k / PowerPC Macs).
RDB	Yes	Bootable flag only	Amiga RDSK. Full RDB editing deferred until the DosEnv geometry story is settled.
SGI	Yes	Yes	SGI Volume Header (IRIX). 16 fixed slots; checksum recomputed on every write; geometry (vh_dp) preserved across edits. rb-cli new-sgi-hdd synthesizes a dvh + EFS-root hard disk from scratch (IRIX 5.3-6.5).
None (superfloppy)	Yes — auto-detects the filesystem at sector 0 (FAT / HFS / HFS+ / Apple DOS 3.3 / CBM DOS / Atari DOS / RS-DOS / OS-9 RBF / DragonDOS / Acorn DFS / ADFS / TR-DOS / TI-99 / QDOS / Human68k / Alto BFS / Pilot/Cedar / Apple Lisa FS / …)	—	Standard floppy / disk sizes are recognised even without a partition table. Xerox Alto packs (.pdi / .bfs / CopyDisk / Salto .dsk), Pilot/Cedar PDIs (fsFamily=2), Dwarf 6085 .zdisk images, and tag-bearing Apple Lisa DiskCopy 4.2 / DART disks are detected by content and presented as a single browsable volume.

The Clonezilla image format is also parsed as a source (MBR, GPT, partclone images, partition table sidecars) for restore — see docs/clonezilla.md.

What works well vs. what to watch out for

• FAT12 / FAT16 / FAT32 → VHD is the best-exercised path. Whole-disk and per-partition export, shrink, grow, and in-place FAT table patching are all covered by tests.
• exFAT / NTFS / HFS / HFS+ / ext / btrfs → VHD will write a correctly sized VHD with the filesystem patched in place, but less of this path is test-covered; verify the exported image by mounting it before trusting a restore from it. Some docs in docs/ predate full coverage — the code now wires resize for every filesystem in the table.
• HFS classic block-size expansion ("Expand HFS Volume…") clones a source volume into a freshly formatted target with a larger allocation block size and a verified-bootable APM layout (DDR + APM map + driver partitions + alt MDB). Useful when an old 2 GB classic-HFS volume runs out of 16-bit block addresses.
• SGI EFS / XFS: EFS is fully read/write/resize. XFS gained a full edit + repair surface (R1-R8 repair pipeline; oracle-validated against xfs_repair) on the v4 format. Open XFS holes (multi-block leaf/node directories, bmap-btree forks, v5/CRC write side) and the planned shrink-via-clone path are tracked in docs/OPEN-WORK.md §2.1 and §2.2. XFS grow is still done at the disk-layout level ("Add free space" + in-OS xfs_growfs).
• ProDOS → VHD is not implemented yet; restore to raw / CHD / Zstd / physical disk works.
• Raw → raw restore always works regardless of filesystem; only the shrink/expand paths depend on filesystem-specific code.
• Write-back to source formats: WOZ2 export is supported (the writer regenerates a clean WOZ from the decoded sector buffer). 2MG, DC42, and DMG are still read-only as sources — to round-trip those, restore to raw / VHD / CHD / Zstd or a physical disk.
• CHD as both source and edit target: rusty-backup uses MAME's native CHD core, so .chd files are first-class — no external chdman required for read, write, browse, or in-place expand (Phase 6c of the disk-expansion workflow re-encodes the CHD with a new logical size).
• Optical CD-DA preview (desktop GUI only): the Optical tab plays audio tracks straight from a CHD or BIN/CUE image — select the disc, open "Audio Tracks", and play/stop any track with a live position readout. Playback is desktop-only (rodio, linking ALSA on Linux / WASAPI on Windows / CoreAudio on macOS); the slim rb-cli-mini MiSTer build still rips and converts optical images but ships no player.
• Browsing compressed backups: native .zst backups stream-decompress lazily on open, so browsing a multi-gigabyte zstd backup is fast. .chd backups currently require building a full seekable cache on open, which can be slow for large partitions — plan to work around this in a future release.

MiSTer FPGA cores

Rusty Backup can build, browse, and convert images that drop straight into MiSTer FPGA computer cores. The list below is the subset where the full filesystem + container + partition pipeline works end to end. Full per-core status (including outstanding cores) lives in docs/full_MiSTer_support_status.md.

MiSTer core	Filesystem(s)	Media path
ao486 (486 PC)	FAT12 / FAT16 / FAT32 (MBR), ISO9660	Floppy, HDD, CD
PCXT	FAT12 / FAT16 (MBR)	Floppy, HDD
MSX / MSX1 / TurboR	FAT12 / FAT16 (Nextor VHD)	Floppy, HDD
ZXNext (ZX Spectrum Next)	FAT32 / FAT16 / FAT12	SD / HDD (VHD)
TSConf (ZX-Evolution)	FAT32 (non-MBR)	SD / HDD (VHD)
Minimig-AGA (Amiga)	AFFS (OFS/FFS), PFS3, SFS on RDB, ISO9660	Floppy (.adf/.adz), HDD (.hdf/.hdz), CD
MacPlus	HFS	HDD (.hda / .hfv) — 400K MFS floppy outstanding
AtariST	GEMDOS (FAT12 / FAT16), MSA containers	Floppy (.st / .msa); HDD pending AHDI write-side
Apple-II	ProDOS + Apple DOS 3.3	.dsk / .do / .po / .2mg / .woz (sector-order auto-detect)
Atari800	Atari DOS 2 (2.0S / 2.5, read + write)	Floppy .atr / .xfd (single + enhanced density)
ZX-Spectrum	TR-DOS (read + write + create + fsck), esxDOS FAT	TR-DOS floppy (.trd), DivMMC / esxDOS SD; +3DOS via CP/M (zxplus3), G+DOS (MGT) pending
X68000 (Sharp)	Human68k (FAT-derived)	Floppy (.d88 / .xdf / .hdm / .dim — any-to-any conversion + in-place add/delete/mkdir), SASI/SCSI HDD (.hda / .hdf / .hds — read/browse/extract + add/delete/mkdir + in-place grow/shrink + defragmenting repack, incl. real BlueSCSI X68SCSI1 1024-byte-sector images). rb-cli new-x68k-hdd builds self-bootable HDDs from scratch (--system-disk donor.dim clones a Human68k system floppy into the partition; one SWITCH.X /HD on first FDD0 boot installs the partition boot sector and the HDD self-boots to C: thereafter). For users with the well-known hd0.hds donor (100 MB Sharp/Keisoku Giken SCSI HDD image, 104,857,600 bytes), --boot-sector-donor hd0.hds --size 100M --variant scsi overlays the donor's Sharp partition boot sector at build time — zero manual steps, self-boots to C:> on first power-on. MAME-verified on x68000 SASI + x68030 SCSI.
Archie (Acorn Archimedes)	ADFS / FileCore (read)	.adf floppy, bare + Arculator-wrapped .hdf HDD
QL (Sinclair)	QDOS (QXL.WIN, read + write)	HDD (.win)
Amstrad CPC	AMSDOS + CP/M 2.2 / Plus (amstrad_data + amstrad_sys DPBs)	Floppy .dsk
AmstradPCW	CP/M Plus (amstrad_pcw DPB)	Floppy .dsk
TatungEinstein	Xtal-DOS / CP/M (einstein DPB)	Floppy .dsk
Altair8800	CP/M (altair_8in 8-inch floppy + altair_cf CF/HDD DPBs)	Floppy + IDE/CF
MultiComp	CP/M (multicomp DPB)	Floppy .dsk
C64 / C128	CBM DOS (1541 / 1571 / 1581, read + write)	Floppy .d64 / .d71 / .d81
VIC20 / C16 / Plus-4	CBM DOS (1541, read + write)	Floppy .d64
PET / CBM-II	CBM DOS (1541 + 8050/8250 IEEE-488, read + write)	Floppy .d64 / .d80 / .d82
CoCo2 / CoCo3 (Tandy)	RS-DOS / Disk BASIC + OS-9 / NitrOS-9 RBF (both read + write)	Floppy .dsk / .jvc / .vdk (35- / 40-track)
Dragon (Dragon 32/64)	DragonDOS + OS-9 / NitrOS-9 RBF (both read + write)	Floppy .dsk (single- / double-sided 40-track)
BBCMicro / AcornElectron	Acorn DFS (read + write)	Floppy .ssd (single-sided 40- / 80-track)

For X68000 specifically, the floppy converter lets you take an image in any of the four formats Sharp tooling and MiSTer cores expect — XDF (headerless raw), HDM (PC-98 raw), DIM (DiskExplorer DIFC), or D88 (sparse track-table) — and produce any of the others, single-file or in bulk. Geometry inference covers the X68000 + PC-98 set: 1.2 MB 2HD, 1.44 MB 2HD, 720 KB 2DD, and 640 KB 2DD.

Physical drive compatibility

Rusty Backup talks to whatever the OS exposes as a raw block device. Anything that shows up via the platform enumerator (Disk Management / diskutil / /sys/block) is a candidate.

Media	Backup from physical	Restore to physical	Notes
CompactFlash (via USB/PCMCIA reader)	Yes	Yes	Primary use case
SD / microSD / MMC	Yes	Yes
USB flash drives	Yes	Yes
USB-attached IDE / SATA (HDD, SSD)	Yes	Yes	Docks, toasters, bridges
Internal SATA / NVMe drives	Yes	Yes	Requires elevation; verify target
USB floppy drives (1.44 MB, 720 KB)	Yes (as block device)	Yes	Treated as a regular block device; no copy-protection support
5.25" / 3.5" floppies via Kryoflux / Greaseweazle / Applesauce	No (use their tools)	No	Dump to .woz / .dc42 / .2mg and feed that image in
Optical media (CD/DVD/BD)	Yes*	No	Needs additional testing, many/most filesystems support for CD and DVD, I don't think it supports any form of copy protection
Tape drives	No	No

Physical floppies are supported only through the OS block-device layer, which covers standard MFM formats (PC 1.44 MB, 720 KB). Copy-protected, variable speed, or GCR-encoded Apple floppies must be dumped with a flux-level tool first and then ingested as a .woz / .dc42 / .2mg image.

Further reading

• PROJECT-SPEC.md — full design document.
• CONTRIBUTING.md — contributor guide.
• docs/ — per-feature deep dives (VHD export, alignment, code signing, Apple II floppy formats, …).
• docs/linux_486_appliance.md / docs/appliance_hardware_support.md — the bootable Linux backup appliance and its vintage-hardware driver support (which cards work, and how to add more in Buildroot).

Donations

Support me on ko-fi!
(https://ko-fi.com/danifunker)

License

AGPL-3.0 — see LICENSE.