Offline image analysis

By default Delta inspects the live host (/). --root <dir> redirects the collectors’ path-based filesystem reads under <dir> instead, so you can analyze a mounted firmware image or extracted rootfs without booting it:

delta --root /mnt/image --fingerprint /                 # hash the whole rootfs
delta --root /mnt/image --baseline image-golden.json    # capture a baseline
delta --root /mnt/image --cve-feed advisories.json --json
delta --root /mnt/image --netif                         # declared interfaces

- / / / empty mean “no redirection” (the live host).

What gets redirected

Read

Under --root /mnt/image

File fingerprints

/mnt/image/<dir> (recursive; symlinks not followed)

Linux process / port lists

/mnt/image/proc/...

Mount sources

/mnt/image/proc/... and /mnt/image/etc/fstab

Packages

/mnt/image/var/lib/dpkg/status, …

Routes / neighbors

/mnt/image/proc/net/...

Declared interfaces

/mnt/image/etc/network/interfaces, .../systemd/network/*.network, .../netplan/*.yaml

Operator-supplied paths are not redirected: --cfg, --output-json, the --baseline output file.

Native collectors describe the live host

Some collectors call kernel APIs that, by definition, describe the running machine and cannot be pointed at an image — process/port enumeration on macOS/Windows, native mount/volume enumeration, and live getifaddrs. To avoid mixing host data into an image analysis, these are disabled when ``–root`` is set; the offline equivalents are:

  • a static image has no running processes / open sockets → those domains are expected to be empty;

  • mounts come from the image’s /etc/fstab;

  • interfaces come from the image’s network configuration.

Fingerprinting, mount-target classification, package inventory and routes/ARP go through ordinary path-based fopen/stat and are fully redirected.

Limitations

  • No image extraction built in — mount/unpack first (mount -o loop, unsquashfs, binwalk).

  • netplan parsing recovers interface names via a best-effort indentation scanner, not a full YAML parser.

  • --root is a path-prefix mechanism, not a chroot; nothing is executed inside the image.