SERVICE #10 • COLD STORAGE & PORTABILITY

USB Air-Gap Backup Kit & True Offline Portability

⏱️ 7 min read 💾 100% Client-Side PKZIP Engine ⚡ Zero External Font CDNs

In high-threat environments or emergency cold storage scenarios, relying on an active internet connection or third-party CDNs is a critical operational vulnerability. ZevSafe provides a 1-Click USB Air-Gap Backup Kit and a completely decoupled font architecture, empowering users to export an entire self-contained, air-gapped cryptographic vault onto any USB thumb drive, external SSD, or optical disc with zero external network dependencies forever.

🟢 Simple User Guide

How to Create and Run an Air-Gapped USB Vault

STEP 01

Open the USB Backup Kit

Click the 💾 USB Backup Kit button in the top navigation bar (or open the phone menu drawer and tap USB Air-Gap Backup Kit). A cybernetic modal appears presenting your export options.

STEP 02

Choose Your Export Method

ZevSafe offers two ways to export your offline vault:

  • ⬇️ Download Standalone ZIP Kit: Instantly generates ZevSafe-Offline-USB-Kit.zip in your browser. Extract it directly onto your USB drive or external hard drive.
  • ⚡ Write Directly to USB Flash Drive: In supported browsers (Chrome, Edge), select your USB drive folder, and ZevSafe writes all offline files and folders directly to the drive with live progress feedback.
STEP 03

Launch on Any Air-Gapped Computer

Plug your USB drive into any offline or air-gapped PC, Mac, or Linux computer:

  • Windows: Double-click Launch-ZevSafe-Windows.bat. It starts a sandboxed local 127.0.0.1 server or opens in your default browser.
  • Mac & Linux: Double-click or execute ./Launch-ZevSafe-Mac-Linux.sh in Terminal.
  • Direct Browser: Open index.html directly in any browser.
🔵 Technical Specification

Google Font Decoupling & CSP Air-Gap Hardening

Prior versions loaded web fonts from fonts.googleapis.com and fonts.gstatic.com. In cold-boot air-gapped environments, external CSS requests fail, triggering HTTP timeouts, layout shift (CLS), and telemetry leakage risks. In Phase 13, all external CDN dependencies were completely eliminated.

Strict Air-Gapped Content Security Policy (_headers & HTML) Zero CDN 
Content-Security-Policy: default-src 'self';
  script-src 'self' 'unsafe-inline';
  style-src 'self' 'unsafe-inline';
  font-src 'self' data:;
  img-src 'self' data: blob:;
  media-src 'self' blob:;
  frame-src 'self' blob:;
  connect-src 'self' blob: data:;
  object-src 'none';
  base-uri 'self';
  frame-ancestors 'none';

Native Modern System Font Stacks

Typography is resolved locally with zero render-blocking requests:

  • Body: 'Inter', -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif
  • Headings: 'Outfit', -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", sans-serif
  • Monospace: 'JetBrains Mono', ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace
🔵 Technical Specification

Pure Client-Side PKZIP 2.0 Engine

The backup kit incorporates a standalone binary PKZIP generator in js/usb-backup-kit.js. It generates valid ZIP archives in RAM using native TypedArrays without any third-party dependencies: 

+-------------------------------------------------------+
| Local File Header 1 (0x04034b50) + UTF-8 Path + Data  |
+-------------------------------------------------------+
| Local File Header 2 (0x04034b50) + UTF-8 Path + Data  |
+-------------------------------------------------------+
| ... (All App Shell & Manual Files)                    |
+-------------------------------------------------------+
| Central Directory Record 1 (0x02014b50)               |
+-------------------------------------------------------+
| Central Directory Record 2 (0x02014b50)               |
+-------------------------------------------------------+
| End of Central Directory (EOCD 0x06054b50, 22 Bytes)  |
+-------------------------------------------------------+

IEEE 802.3 CRC-32 Verification

Every bundled file is hashed with a 256-entry precomputed CRC lookup table: 

function computeCRC32(data) {
    let crc = 0xFFFFFFFF;
    for (let i = 0; i < data.length; i++) {
        crc = CRC_TABLE[(crc ^ data[i]) & 0xFF] ^ (crc >>> 8);
    }
    return (crc ^ 0xFFFFFFFF) >>> 0;
}
🔵 Technical Specification

Direct USB Drive Writer (File System Access API)

Using the W3C File System Access API, ZevSafe can stream directory structures directly to a physical drive without creating an intermediate ZIP file:

Direct Drive Streaming Loop (js/usb-backup-kit.js) W3C FSA API 
const dirHandle = await window.showDirectoryPicker({ mode: 'readwrite' });
for (const file of files) {
    const parts = file.name.split('/');
    let currentDir = dirHandle;
    for (let p = 0; p < parts.length - 1; p++) {
        currentDir = await currentDir.getDirectoryHandle(parts[p], { create: true });
    }
    const fileHandle = await currentDir.getFileHandle(parts[parts.length - 1], { create: true });
    const writable = await fileHandle.createWritable();
    await writable.write(file.data);
    await writable.close();
}
🔵 Technical Specification

Cross-Platform Zero-Config Launchers

Launch-ZevSafe-Windows.bat

Checks for python or py in PATH. If found, starts a local sandboxed 127.0.0.1:8080 HTTP server. If Python is absent, opens index.html directly via the default Windows browser.

Launch-ZevSafe-Mac-Linux.sh

Detects python3 or python, binds to 127.0.0.1:8080, launches the default browser with open / xdg-open, and falls back cleanly to file URIs.

Security & Portability Invariants

  • Zero Network Dependency: The exported USB kit makes 0 network calls, fetches 0 CDNs, and transmits 0 telemetry.
  • Universal Compatibility: Any .zev container created on the air-gapped USB vault decrypts seamlessly on the web app, Android app, or PC desktop scripts.
  • Cryptographic Integrity: SHA-256 and IEEE 802.3 CRC-32 checksums guarantee bit-level authenticity across all exported assets.