# PFES-ENG-003 — Firmware Recovery

**Status:** Active  
**Knowledge Cycle Stages:** Recover, Preserve

## Purpose

Recover firmware and related artifacts from acquired distributions without erasing the path used to obtain them.

## Engineering Problem

Firmware is frequently embedded in wrappers, archives, resources, self-extracting images, encrypted containers, compressed streams, or vendor-specific layouts.

## Historical Engineering Evolution

Recovery initially meant obtaining usable bytes. New container families and alternate extraction paths showed that recovery is a first-class engineering discipline with confidence, competing candidates, and historical significance.

## Engineering Discoveries

- Recovery method is evidence.
- Multiple recovery paths may need side-by-side comparison.
- Successful recovery does not obsolete the source artifact.

## Architectural Decisions

- Preserve competing recovery candidates.
- Record recovery confidence.
- Retain intermediates until their unique value is assessed.
- Do not promote diagnostic reconstructions as canonical without validation.

## Knowledge Produced

- Recovered firmware
- Recovery candidates
- Recovery provenance
- Container-family knowledge

## Knowledge Consumed

- Acquired artifacts
- Container specifications
- Compression and encryption knowledge

## Current Engineering State

Recovery supports multiple HLDS container families and special distribution mechanisms, including Sydex/CopyQM-style self-extracting disk-image executables. Some recovery paths remain diagnostic and must not be promoted prematurely.

## Engineering Lessons

- Recovery confidence must reflect evidence.
- Container reconstruction can be as important as payload extraction.

## Negative Knowledge

Project Frankenstein no longer assumes:

- Any plausible carved payload is usable firmware.
- A successful decompression automatically establishes correctness.

## Current Implementations

- Stage 1 extraction
- Stage 2 normalization
- Stage 3 routing
- Container-specific probes

## Future Implementations

- Confidence-aware recovery
- Automated path comparison
- Expanded container classification

## Open Questions

To be expanded during engineering review.

## Why This Chapter Exists

Firmware cannot enter the engineering cycle until it is recovered with sufficient confidence.
