Second-pass recovery summary

APP:
- Read-only e2fsck was run; see recovery/e2fsck.readonly.txt.
- Filesystem header details are in recovery/dumpe2fs.header.txt.
- Extracted root filesystem with rsync -aHAX --numeric-ids --one-file-system --delete.
- Extraction output: recovery/extracted_ext4
- Temporary mountpoint recovery/mnt_app_ro was unmounted after extraction.

A_KERNEL:
- Extracted ramdisk at offset 42307584, size 15870399.
- Ramdisk file type: /data/temp/gb1/gb2/img/A_KERNEL/recovery/unpacked_boot/ramdisk: gzip compressed data, max compression, from Unix, original size modulo 2^32 37286912
- Decompressed gzip ramdisk to recovery/unpacked_boot/ramdisk.cpio, size 37286912.
- Extracted ramdisk.cpio into recovery/unpacked_boot/ramdisk_root.
- See recovery/signature_hits.txt and recovery/strings.first5000.txt for scan output.

A_KERNEL-DTB:
- Initial file type: /data/temp/gb1/gb2/img/2.A_kernel-dtb.img: Device Tree Blob version 17, size=256636, boot CPU=0, string block size=18460, DT structure block size=238120
- Device-tree blob recovered to recovery/dtb/A_kernel-dtb.dtb, declared size 256636.
- DTB file type: /data/temp/gb1/gb2/img/A_KERNEL-DTB/recovery/dtb/A_kernel-dtb.dtb: Device Tree Blob version 17, size=256636, boot CPU=0, string block size=18460, DT structure block size=238120
- Wrote signature scan with 20 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.

A_RESERVED_ON_USER:
- The non-zero content is one span from offset 0 through 9182325.
- That span was carved to recovery/carved/nonzero_payload.bin.
- SHA-256 of nonzero_payload.bin: 8aeb99c7037dca481f108605a9eb4f283e46cb3136bf71e0796250ab75fcf0a1
- Entropy of the non-zero span is 7.973384 bits/byte.
- No validated embedded file/container signatures were extracted by this local pass.

B_KERNEL:
- Extracted ramdisk at offset 42307584, size 15870399.
- Ramdisk file type: /data/temp/gb1/gb2/img/B_KERNEL/recovery/unpacked_boot/ramdisk: gzip compressed data, max compression, from Unix, original size modulo 2^32 37286912
- Decompressed gzip ramdisk to recovery/unpacked_boot/ramdisk.cpio, size 37286912.
- Extracted ramdisk.cpio into recovery/unpacked_boot/ramdisk_root.
- See recovery/signature_hits.txt and recovery/strings.first5000.txt for scan output.

B_KERNEL-DTB:
- Initial file type: /data/temp/gb1/gb2/img/5.B_kernel-dtb.img: Device Tree Blob version 17, size=256636, boot CPU=0, string block size=18460, DT structure block size=238120
- Device-tree blob recovered to recovery/dtb/B_kernel-dtb.dtb, declared size 256636.
- DTB file type: /data/temp/gb1/gb2/img/B_KERNEL-DTB/recovery/dtb/B_kernel-dtb.dtb: Device Tree Blob version 17, size=256636, boot CPU=0, string block size=18460, DT structure block size=238120
- Wrote signature scan with 1 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.

B_RESERVED_ON_USER:
- Wrote signature scan with 0 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.
- A full byte scan found 0 non-zero bytes.
- Entropy is 0.0 bits/byte and no validated signatures were found.
- This image is all zero-filled; there is no data to recover from this file.

RECOVERY:
- Extracted ramdisk at offset 42307584, size 20974799.
- Ramdisk file type: /data/temp/gb1/gb2/img/RECOVERY/recovery/unpacked_boot/ramdisk: gzip compressed data, max compression, from Unix, original size modulo 2^32 49355776
- Decompressed gzip ramdisk to recovery/unpacked_boot/ramdisk.cpio, size 49355776.
- Extracted ramdisk.cpio into recovery/unpacked_boot/ramdisk_root.
- See recovery/signature_hits.txt and recovery/strings.first5000.txt for scan output.

RECOVERY-DTB:
- Initial file type: /data/temp/gb1/gb2/img/8.recovery-dtb.img: Device Tree Blob version 17, size=256636, boot CPU=0, string block size=18460, DT structure block size=238120
- Device-tree blob recovered to recovery/dtb/recovery-dtb.dtb, declared size 256636.
- DTB file type: /data/temp/gb1/gb2/img/RECOVERY-DTB/recovery/dtb/recovery-dtb.dtb: Device Tree Blob version 17, size=256636, boot CPU=0, string block size=18460, DT structure block size=238120
- Wrote signature scan with 1 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.

ESP:
- FAT-like filesystem detected at image start.
- Ran fsck.vfat -vn; see recovery/fsck.vfat.readonly.txt.
- 7z filesystem extraction completed into recovery/extracted.
- Wrote signature scan with 6 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.

RECOVERY_ALT:
- Wrote signature scan with 0 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.
- A full byte scan found 0 non-zero bytes.
- Entropy is 0.0 bits/byte and no validated signatures were found.
- This image is all zero-filled; there is no data to recover from this file.

RECOVERY-DTB_ALT:
- Wrote signature scan with 0 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.
- A full byte scan found 0 non-zero bytes.
- Entropy is 0.0 bits/byte and no validated signatures were found.
- This image is all zero-filled; there is no data to recover from this file.

ESP_ALT:
- Carved and padded FAT image to /data/temp/gb1/gb2/img/ESP_ALT/recovery/12.esp_alt.carved.fat32.img, declared size 67108864 bytes.
- Ran fsck.vfat -vn; see recovery/fsck.vfat.readonly.txt.
- 7z filesystem extraction completed into recovery/extracted.
- Wrote signature scan with 6 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.

UDA:
- Possible ext4 superblock magic at offset 180474936; carved candidate filesystem from offset 180473856.
- The superblock reports 31058432 blocks at 4096 bytes each.
- The carved ext4 filesystem was padded sparsely to its superblock-declared size: recovery/carved.ext4.padded.img.
- Tried read-only mount with journal replay disabled and copied accessible mounted entries if available.
- The temporary padded-image mountpoint was unmounted after extraction.

RESERVED:
- Initial file type: /data/temp/gb1/gb2/img/14.reserved.img: OpenPGP Public Key
- The image is not treated as a mountable filesystem; apt-cache was used as a structured APT binary package cache reader.
- Structured recovery output was written under recovery/apt_cache/.
- Wrote signature scan with 200 hit(s) to recovery/signature_hits.txt.
- Captured first strings to recovery/strings.first5000.txt.