Add TIBX archive parser

[falklindner]

Add a parser for the Acronis CyberBackup/CyberProtect TIBX ("archive3") backup format as a dissect.archive.tibx subpackage.

Closes #20

Proposed changes

The parser handles the full TIBX format:

• Page store: 4 KiB pages with CRC-32C verification, ARCH commit-root superblocks, live-root / commit-root selection
• LSM B-tree index: TLV directory, L-SB superblocks, LEAF/LDIR cell decoding, data_map / segment_map with mem-tree and on-disk ctree layers, tombstone masking for backup-version cleanup
• Compression: zstd and linked-LZ4 (dictionary-seeded block chain)
• Encryption: AES-256-CBC with PBKDF2 key derivation
• Chain reconstruction: full incremental/differential chain with recovery-point selection
• Volume reconstruction: NTFS, FAT32, exFAT, FAT12/16 and ext boot-sector detection for accurate volume sizing
• Archive variants: split archives (auto-stitched), version sets (TLV[18] file table with compacted bases), multi-disk archives

TIBX is materially more complex than VBK (page store + LSM index + crypto + chain reconstruction), so a subpackage is proposed rather than a flat module. Happy to consolidate if preferred.

Dependencies

pycryptodome and backports.zstd added to the full optional extra; lz4 added to the test dependency group.

Testing

70 unit tests covering all parser layers (page store, LSM trees, segments, codecs, crypto, volume reconstruction, version sets, tombstone masking). Tests are fully hermetic — they build synthetic CRC-correct archives via tests/_synth.py, no binary fixtures required.

Validated byte-for-byte against real Acronis True Image 2026 (Build 42980) output across: single-partition, multi-partition, whole-disk (MBR and GPT), multi-disk, split, incremental, differential, and encrypted archives; NTFS, FAT32, and exFAT volumes.

Acknowledgments

Thanks to @mniedermaier for his contributions and support in developing this parser.

Checklist

• PR title is descriptive of the changes
• The description is descriptive of the changes
• Tests are included and pass
• Closes Add support for TIB and TIBX format (Acronis backup) #20

[yunzheng]

Very nice work, and thanks for sharing it! I haven't started reviewing yet, but I pushed a commit filling in a few of the unknown fields based on some of our own reversing efforts.

[yunzheng]

Regarding the last commit, can the TIBX encryption not be detected via the encr_alg in the superblock header?

[falklindner]

Regarding the last commit, can the TIBX encryption not be detected via the encr_alg in the superblock header?

Good point — checked against the full real-sample corpus (12 archives): encr_alg in the ARCH superblock agrees with the keymap detection everywhere (AES_256_CBC on the encrypted sample, NONE on the rest), so yes, it does indicate encryption.

The keymap scan answers a narrower question though: not "is this encrypted" but "does a password-wrapped data key exist" — which is what drives the password prompt / keychain lookup. Acronis also supports certificate-wrapped keys (format byte 0x02 next to the 0x01 we locate), where encr_alg would be set but asking for a password can't help. Detection via the keymap also can't disagree with unlock(), since both parse the same structure, and it doesn't depend on the superblock byte layout, which we've only verified for header_version 8.

The two compose nicely, and encr_alg is essentially free: happy to use encr_alg != NONE as the archive-level signal and the keymap scan to decide password vs. certificate — that would let a certificate-wrapped archive fail with "encrypted, but not password-protected" instead of a generic missing-password error.