Difference between revisions of "Libewf"

From ForensicsWiki
Jump to: navigation, search
(25 intermediate revisions by 3 users not shown)
Line 3: Line 3:
 
   maintainer = [[Joachim Metz]], [[David Loveall]] |
 
   maintainer = [[Joachim Metz]], [[David Loveall]] |
 
   os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
 
   os = [[Linux]], [[FreeBSD]], [[NetBSD]], [[OpenBSD]], [[Mac OS X]], [[Windows]] |
   genre = [[File type support]] |
+
   genre = {{Disk imaging}} |
   license = [[LGPL]] |
+
   license = {{LGPL}} |
   website = [http://libewf.sourceforge.net libewf.sourceforge.net] |
+
   website = [http://code.google.com/p/libewf/ code.google.com/p/libewf/] |
 
}}
 
}}
  
The '''libewf''' package contains [[Linux]] based library and applications to read and write EnCase E0* and SMART s0* storage media bitstream copies.
+
The '''libewf''' package contains a library and applications to read and write EnCase E0* and SMART s0* storage media bitstream copies. Recent versions also support the Logical Evidence (LEV) L0* files.
It has been ported to other platforms like [[FreeBSD]] [[NetBSD]] [[OpenBSD]] [[Mac OS X]] and [[Windows]] as well.
+
  
 
== History ==  
 
== History ==  
Line 15: Line 14:
 
Libewf was created by [[Joachim Metz]] in 2006, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
 
Libewf was created by [[Joachim Metz]] in 2006, while working for [http://en.hoffmannbv.nl/ Hoffmann Investigations].
  
Libewf is a rewrite of earlier work on the EnCase 4 file format by [[Michael Cohen]] part of [[PyFlag]] and the [http://www.asrdata.com/SMART/whitepaper.html Expert Witness Compression Format Specification] by [Andrew Rosen]. It has been updated to read and write EnCase version 1 to 6 E01 files and SMART s01 files (EWF files). Libewf has initiated an Extended EWF (EWF-X) specifications to bypass limitations on the format imposed by EnCase.
+
Libewf is a rewrite of earlier work on the EnCase 4 file format by [[Michael Cohen]] part of [[PyFlag]] and the [http://www.asrdata.com/SMART/whitepaper.html Expert Witness Compression Format Specification] by [[Andrew Rosen]]. It has been updated to read and write EnCase version 1 to 6 E01 files and SMART s01 files (EWF files). Libewf has initiated an Extended EWF (EWF-X) specifications to bypass limitations on the format imposed by EnCase.
  
Currently libewf partially supports the EnCase L01 format but this functionality has been disabled.
+
libewf also has read support for the EnCase L01 format.
  
 
In 2007 [[David Loveall]] contributed mount_ewf.py to the libewf project. This application allows a [[fuse]] based mount of the storage media data in the EWF files to be mounted.
 
In 2007 [[David Loveall]] contributed mount_ewf.py to the libewf project. This application allows a [[fuse]] based mount of the storage media data in the EWF files to be mounted.
Line 23: Line 22:
 
== Tools ==  
 
== Tools ==  
 
The '''libewf''' package contains the following tools:
 
The '''libewf''' package contains the following tools:
* '''ewfacquire''' and '''ewfacquire''' , which writes storage media data from a device handle EWF files.
+
* '''ewfacquire''', which writes storage media data from devices and files to EWF files.
* '''ewfexport''', which exports storage media data in a set of E01 or s01 files to raw (dd) format or a specific version of EWF files.
+
* '''ewfacquirestream''', which writes data from stdin to EWF files.
 +
* '''ewfexport''', which exports storage media data in EWF files to (split) RAW format or a specific version of EWF files.
 
* '''ewfinfo''', which shows the metadata in EWF files.
 
* '''ewfinfo''', which shows the metadata in EWF files.
 +
* '''ewfmount''', which FUSE mounts EWF files.
 
* '''ewfverify''', which verifies the storage media data in EWF files.
 
* '''ewfverify''', which verifies the storage media data in EWF files.
* '''mount_ewf.py''', which allows the storage media data in a EWF files to be mounted.
 
  
[[Dennis Schreiber]] created a menu based interface for ewfacquirestream called pyEWF. However this seems currently not to be maintained.
+
The '''libewf''' package also contains the following bindings:
 +
* '''ewf.net''', bindings for .Net
 +
* '''pyewf''', bindings for Python contributed by [[David Collett]] in 2008
 +
 
 +
Provided as separate tools on the libewf project site:
 +
* '''mount_ewf.py''', which allows the storage media data in a EWF files to be mounted, contributed by [[David Loveall]] in 2007.
 +
* '''libewf-java''', Java (JNA) bindings were contributed by [[Bradley Schatz]] in 2009.
 +
* '''delphi imdisk proxy''', Borland Delphi imdisk proxy, as an alternative to mount_ewf.py for Windows, contributed by [[Brendan Berney]] in 2010.
 +
* '''jlibewf''', native Java EWF reader contributed by [[Bruce Allen]] in 2010.
 +
 
 +
A menu based interface for ewfacquirestream called pyEWF, contributed by [[Dennis Schreiber]], was originally also available on the uitwisselplatform project site. However this is currently no longer maintained and was not moved to the sourceforge project size. The uitwisselplatform no longer exists. The name pyewf was reused for the libewf Python bindings created by [[David Collett]] which is now included in the libewf package.
 +
 
 +
== Examples ==
 +
 
 +
Imaging a device on a Unix-based system:
 +
<pre>
 +
ewfacquire /dev/sda
 +
</pre>
 +
 
 +
Imaging a device on a Windows system:
 +
<pre>
 +
ewfacquire \\.\PhysicalDrive0
 +
</pre>
 +
 
 +
Converting a split RAW into an EWF image
 +
<pre>
 +
ewfacquire split.raw.???
 +
</pre>
 +
 
 +
or
 +
 
 +
<pre>
 +
cat split.raw.??? | ewfacquirestream
 +
</pre>
 +
 
 +
Converting an optical disc (split) RAW into an EWF image (libewf 20110109 or later)
 +
<pre>
 +
ewfacquire -T optical.cue optical.iso
 +
</pre>
 +
 
 +
Converting an EWF into another EWF format or a (split) RAW image
 +
<pre>
 +
ewfexport image.E01
 +
</pre>
 +
 
 +
Exporting files from a logical image (L01)
 +
<pre>
 +
ewfexport image.L01
 +
</pre>
 +
 
 +
FUSE mounting an EWF image (libewf 20110828 or later)
 +
<pre>
 +
ewfmount image.E01 mount_point
 +
</pre>
 +
 
 +
FUSE mounting a logical image (L01) (libewf 20111016 or later)
 +
<pre>
 +
ewfmount -f files image.L01 mount_point
 +
</pre>
  
 
== External Links ==
 
== External Links ==
  
* [http://libewf.sourceforge.net libewf project site]
+
* [http://code.google.com/p/libewf/ Project site]
* [https://www.uitwisselplatform.nl/projects/libewf/ old libewf project site]
+
* [http://libewf.sourceforge.net Old project site]

Revision as of 00:44, 5 July 2012

libewf
Maintainer: Joachim Metz, David Loveall
OS: Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows
Genre: Disk imaging
License: LGPL
Website: code.google.com/p/libewf/

The libewf package contains a library and applications to read and write EnCase E0* and SMART s0* storage media bitstream copies. Recent versions also support the Logical Evidence (LEV) L0* files.

History

Libewf was created by Joachim Metz in 2006, while working for Hoffmann Investigations.

Libewf is a rewrite of earlier work on the EnCase 4 file format by Michael Cohen part of PyFlag and the Expert Witness Compression Format Specification by Andrew Rosen. It has been updated to read and write EnCase version 1 to 6 E01 files and SMART s01 files (EWF files). Libewf has initiated an Extended EWF (EWF-X) specifications to bypass limitations on the format imposed by EnCase.

libewf also has read support for the EnCase L01 format.

In 2007 David Loveall contributed mount_ewf.py to the libewf project. This application allows a fuse based mount of the storage media data in the EWF files to be mounted.

Tools

The libewf package contains the following tools:

  • ewfacquire, which writes storage media data from devices and files to EWF files.
  • ewfacquirestream, which writes data from stdin to EWF files.
  • ewfexport, which exports storage media data in EWF files to (split) RAW format or a specific version of EWF files.
  • ewfinfo, which shows the metadata in EWF files.
  • ewfmount, which FUSE mounts EWF files.
  • ewfverify, which verifies the storage media data in EWF files.

The libewf package also contains the following bindings:

  • ewf.net, bindings for .Net
  • pyewf, bindings for Python contributed by David Collett in 2008

Provided as separate tools on the libewf project site:

  • mount_ewf.py, which allows the storage media data in a EWF files to be mounted, contributed by David Loveall in 2007.
  • libewf-java, Java (JNA) bindings were contributed by Bradley Schatz in 2009.
  • delphi imdisk proxy, Borland Delphi imdisk proxy, as an alternative to mount_ewf.py for Windows, contributed by Brendan Berney in 2010.
  • jlibewf, native Java EWF reader contributed by Bruce Allen in 2010.

A menu based interface for ewfacquirestream called pyEWF, contributed by Dennis Schreiber, was originally also available on the uitwisselplatform project site. However this is currently no longer maintained and was not moved to the sourceforge project size. The uitwisselplatform no longer exists. The name pyewf was reused for the libewf Python bindings created by David Collett which is now included in the libewf package.

Examples

Imaging a device on a Unix-based system:

ewfacquire /dev/sda

Imaging a device on a Windows system:

ewfacquire \\.\PhysicalDrive0

Converting a split RAW into an EWF image

ewfacquire split.raw.???

or

cat split.raw.??? | ewfacquirestream

Converting an optical disc (split) RAW into an EWF image (libewf 20110109 or later)

ewfacquire -T optical.cue optical.iso

Converting an EWF into another EWF format or a (split) RAW image

ewfexport image.E01

Exporting files from a logical image (L01)

ewfexport image.L01

FUSE mounting an EWF image (libewf 20110828 or later)

ewfmount image.E01 mount_point

FUSE mounting a logical image (L01) (libewf 20111016 or later)

ewfmount -f files image.L01 mount_point

External Links