The specifics | Hawk Eye Backup

The boring specifics.

For anyone who reads the back of the box. Everything on the main page, in the words engineers use.

Language: Rust 1.97, 2024 edition, compiled to native machine code. No runtime, no garbage collector.
Interface: Slint 1.18, compiled ahead of time into native code with the app. No web view, no browser inside.
Notifications: Direct2D and DirectWrite on Direct3D 11, composited with DirectComposition, so the corners are truly transparent.
Runs on: Windows 10 and 11, 64-bit.
Footprint: The background service idles in under 5 MB of memory.
Network: Nothing of its own. No account, no telemetry, no update checks. It only reaches the backup location you choose, such as a NAS, and talks to its own programs over the local pipe.

Your data: XChaCha20-Poly1305, with a fresh random 24-byte nonce for every chunk.
Your password: Argon2id at 256 MiB, 3 passes, 4 lanes. It unwraps the master key and is never stored.
Password rules: New ones must rate Fair or better on a 0 to 4 scale from length, character variety, a list of common passwords, and runs, repeats and keyboard rows. Enforced in the app, the service and the command line.
Recovery file: Optional. A random 256-bit secret kept by you wraps the master key (BLAKE3-derived key, XChaCha20-Poly1305). A new one revokes the old; a password change leaves it working.

The pipe: One local named pipe with an explicit access list: users can connect but never create it, the service claims it first so nothing can squat it, and remote clients are refused.
Handshake: Noise NKpsk0 (25519, ChaChaPoly, BLAKE2s). The service's key is new on every start and pinned by the app. The pre-shared key comes from a 2048-bit key each program derives in an AVX2-vectorised loop and keeps encrypted in memory with CryptProtectMemory. Every message after that is encrypted, with forward secrecy.
Who may do what: Decided per request from the caller's Windows token. Admin rights count only when elevated; everyone else reaches their own profile only, and sees activity filtered to it, with other paths and accounts hidden.
Hardening: DEP, forced ASLR and strict handle checks in every process. The service also refuses dynamic code, DLLs not signed by Microsoft and the Windows graphics kernel.
Restores: Never written through a link: each folder below the destination is checked, and the new file's handle must resolve inside it before a byte is written.

Chunk IDs: Keyed BLAKE3, recomputed and checked on every read.
Write check: Every pack is read back uncached and compared before anything depends on it. Up to 3 rewrites, then the job stops and says so.
Publishing: A moment is re-read and checked end to end before it appears in the vaults.

Deduplication: FastCDC content-defined chunking with a keyed gear table.
Compression: zstd at levels 1, 3, 9 and 19. Already-compressed files (photos, video, archives) are stored as they are.
Index and journal: redb: transactional and crash-safe. An interrupted backup resumes from its journal.

Files in use: Volume Shadow Copy, with Restart Manager naming any app that still holds a file.
Stopping: A read stuck on a drive or share that stopped answering is cancelled (CancelSynchronousIo) the moment a backup is stopped.
Where it goes: The volume and physical disk of a backup location are compared with the folders it protects, and with where the recovery file is saved.
Logs: Every record sealed and tamper-evident, kept for 14 days.
Previews: Documents are opened by the app, never by the background service, each in a guarded reader with a 48 MB limit.