Source: 12.esp_alt.img
Source apparent size: 67,108,864 bytes
Source SHA-256: 3833b76bc08a024c69d84893f5bc32c6c18b2368de239dcd3944a56eb1635c57

Findings:
- The image has no partition table or filesystem signature at byte 0.
- A FAT32 filesystem boot sector was found at byte offset 28,966,912
  (sector 56,576).
- The FAT32 header describes a 64 MiB filesystem. Because it starts inside
  this 64 MiB source image, the filesystem tail is not present in the source.
- The source file is sparse: most of its apparent 64 MiB size is zero-filled.

Recovery method:
- Carved from offset 28,966,912 into recovery/esp_alt.carved.fat32.img.
- Padded the carved file back to the FAT32-declared size of 67,108,864 bytes.
- Ran read-only FAT validation with fsck.vfat -vn.
- Extracted the readable FAT tree with 7z.

Recovered files:
- recovery/extracted/EFI/BOOT/BOOTAA64.efi
  Size: 73,728 bytes
  Type: PE32+ executable (EFI application) Aarch64
  SHA-256: f5c7e93ba684b248cc6be5c5c7e344391bdf8ff360be782d18f92c1c341ca8b9

Verification:
- BOOTAA64.efi was also carved directly from source offset 30,018,048 into
  recovery/BOOTAA64.raw-from-source.efi.
- The FAT-extracted file and raw-carved file have identical SHA-256 hashes.
- Signature scanning found one PE/MZ executable header in the source, matching
  the recovered BOOTAA64.efi location.

Limitations:
- No additional files were listed by the FAT directory tree.
- No additional executable/archive/kernel signatures were found outside the
  recovered EFI binary during the scan performed here.
- Data beyond the available sparse extents cannot be reconstructed from this
  image alone.