Free File Recovery 8.1.0 - complete corresponding source

This archive contains the actual frozen Windows GUI, complete TestDisk/PhotoRec
7.2 and libntfs 2.0.0 trees, nine exact TestDisk modifications/additions, compiler
compatibility header, original upstream tarballs, patch overlay, build/relink
scripts, exact MSYS2 dependency source packages, licenses, and installer inputs.
COPYING and NOTICE.txt apply subject to component-specific notices.

Extract to a short local path without spaces, for example C:\Source\FreeFileRecovery.
No signing key, certificate private key, token, password or RK runtime is supplied.
Unsigned rebuild hashes may differ with toolchain/time/path changes; an authentic
signature also changes the full PE hash. See RELEASE-PROVENANCE.json.

1. Native engine FIRST (an existing compatible MSYS2 UCRT64 environment)

The recorded toolchain is GCC 16.2.0 Rev6, GNU make 4.4.1, binutils, static zlib
1.3.2-2, libiconv/libcharset 1.19-1. Exact dependency source packages and MSYS2
build recipes are in engine/redistribution-sources. No compiler/runtime binary
is embedded here. To rebuild/relink against modified LGPL components, rebuild
the corresponding static libraries into the selected UCRT64 prefix first.

From that UCRT64 shell:
  cd /c/Source/FreeFileRecovery/engine
  export FFR_PYTHON='/c/path/to/windows/python.exe'
  bash build_from_source.sh

The script configures/builds libntfs and the upstream object set, then invokes
build_bridge.py. It exports FFR_TOOLCHAIN_BIN for the current UCRT64 prefix;
build_bridge.py also accepts that variable when called directly. It explicitly
links genuine libz.a/libiconv.a/libcharset.a and rejects non-system PE imports.
Only engine/bin/ffr-engine.exe is the native runtime payload. Do not distribute
the baseline upstream photorec.exe/testdisk.exe generated during object building.
See engine/BUILD.txt for configuration flags and exact upstream source hashes.

The tree already contains the verified changes. For a separately extracted
pristine TestDisk 7.2 tree, python apply_engine_patches.py <tree> applies the same
nine-file overlay, accepting only original or already-patched hashes. The full
unified patch and per-file original/modified hashes are under engine/patches.
The libntfs tree is original except for ffr-mingw-compat.h, force-included by
the build. Original tarballs are retained for independent comparison.

2. Windows GUI SECOND

Use official .NET SDK 8.0.417 (gui/global.json permits latestPatch). The project
targets net8.0-windows/win-x64 and a self-contained .NET Desktop 8.0.32 runtime.
An initial dotnet restore/publish may download official NuGet runtime packs.
From PowerShell in this source root:
  dotnet publish .\gui\FreeFileRecovery.csproj -c Release -r win-x64 `
    --self-contained true -o .\Application `
    -p:EngineSourceDirectory="C:\Source\FreeFileRecovery\engine\bin"

EngineSourceDirectory may be overridden with another compatible engine bin path.
Without override this source layout resolves ../engine/bin automatically. Native
engine must exist first: the project refuses to build/publish if it is absent.
Publishing copies the engine, brand.ini, README and license files. No external
zlib/iconv DLL is required by the current engine. Leave the complete app together.

The actual icon generator is gui/Assets/MakeAppIcon.ps1; Lucide SVGs and multi-size
app.ico are included. It is optional for rebuilding an unchanged icon. The GUI
supports light/dark and brand.ini. Its explicit review-only --export-screenshot
<new.png> option renders the live WPF window at 2x/192dpi after real startup/scan;
it never runs by default or overwrites an existing image.

3. Optional installer rebuild (separate from rebuilding the free application)

All 24 exact approved installer inputs, high-resolution wizard BMPs, scripts,
disclosures and licenses are under installer/. The full reviewed source manifest
is installer/Validation/Installer-Source-Freeze.json, whose SHA256 is:
  E244F94ED535331A1315A5BF94EA50CCA648E312DE1639DF6AC8FD0CF542ACA2

The original compiler was Inno Setup 6.5.4, ISCC SHA256:
  876B87E1F4261448BB682E597F5E62201594DD4B43E6779BC91FC1687F74D840
Obtain a properly licensed matching official compiler. InnoCompiler is an
explicit override parameter; BUILD-INSTALLER verifies the pinned compiler hash.
BUILD-PREVIEW creates only a blocked UI preview and cannot install. It is not a
replacement for building the main application or the real signed installer.

The optional RK runtime is proprietary vendor software and is deliberately NOT
inside this source ZIP or the application payload. The source contains its pinned
download URL/hash and official invitation integration only. To prepare its audit
download, run installer/VERIFY-RK-DOWNLOAD.ps1 once; it downloads and validates
the official pinned binary without executing it. In an interactive installation,
the Welcome page discloses the separate optional invitation. Clicking Next on
that page prepares the vendor's unchanged official Agree/Decline interface before
the main application installation continues. Only the vendor's Agree action
consents to the research software. Decline, skipping the invitation download,
download failure or invitation cancellation permits the free application to
continue. Silent install never downloads/starts RK or launches the app. No silent
acceptance flag is supplied and an exit code is never treated as consent.

For an official signed setup, sign your rebuilt FreeFileRecovery.exe,
FreeFileRecovery.dll and Engine/ffr-engine.exe with your own appropriate code
signing certificate, record their post-signing SHA256 values, and supply the
exact signer thumbprint and a parent-controlled Inno SignTool command. Keys are
not included and cannot be recreated from this archive. Example parameter shape:

  .\installer\BUILD-INSTALLER.ps1 -Stage Compile `
    -PayloadDirectory C:\Source\FreeFileRecovery\Application `
    -OutputDirectory C:\Source\FreeFileRecovery\InstallerOutput `
    -ExpectedSignedMainSHA256 <your-signed-main-sha256> `
    -ExpectedSignedManagedSHA256 <your-signed-dll-sha256> `
    -ExpectedSignedEngineSHA256 <your-signed-engine-sha256> `
    -ExpectedInstallerSourceManifestSHA256 E244F94ED535331A1315A5BF94EA50CCA648E312DE1639DF6AC8FD0CF542ACA2 `
    -ExpectedSignerThumbprint <your-certificate-thumbprint> `
    -InnoCompiler C:\Tools\InnoSetup\ISCC.exe `
    -ReleaseSignCommand '<your Inno SignTool command using $f and $q placeholders>'

Inno expands $f to the file to sign and quotes that filename. Use $q as needed
for executable/other argument quoting; do not place an extra quote pair around
an already-quoted $f. Do not put tokens/passwords/keys in source files or logs.
Compile requires all three valid timestamped input signatures, freezes payload
and installer inputs, and signs the uninstaller and final Setup through the
supplied command. Verify repeats identity/signature/frozen-source checks without
installing. It does not substitute for actual installation/uninstaller testing.
See installer/README-BUILD.txt for every parameter and the parent release gates.

Changes to installer inputs require regenerating a complete matching source
freeze manifest and supplying its new externally reviewed SHA256. Do not reuse
the original manifest hash after modifying a script, ISS, license or bitmap.

Archive integrity

SOURCE-MANIFEST.json lists every archive member except itself with byte count,
SHA256, source origin and file kind. Complete original archives and the exact
frozen engine/installer manifests are included. This packager changed no GUI,
engine or installer source and did not run builds, signing, installation or RK.
