Difference between revisions of "Libewf"
Joachim Metz (Talk | contribs) (→Tools) |
Joachim Metz (Talk | contribs) (→Tools) |
||
| Line 35: | Line 35: | ||
* '''delphi imdisk proxy''', Borland Delphi imdisk proxy, as an alternative to mount_ewf.py for Windows, contributed by [[Brendan Berney]] in 2010. | * '''delphi imdisk proxy''', Borland Delphi imdisk proxy, as an alternative to mount_ewf.py for Windows, contributed by [[Brendan Berney]] in 2010. | ||
| − | A menu based interface for ewfacquirestream called pyEWF contributed by [[Dennis Schreiber]] was originally also available on the project site. However this is currently no longer maintained. Instead the name pyewf was reused for the libewf Python bindings created by [[David Collett]] which is now included in the libewf package. | + | A menu based interface for ewfacquirestream called pyEWF, contributed by [[Dennis Schreiber]], was originally also available on the project site. However this is currently no longer maintained. Instead the name pyewf was reused for the libewf Python bindings created by [[David Collett]] which is now included in the libewf package. |
== Examples == | == Examples == | ||
Revision as of 12:19, 13 October 2010
| libewf | |
|---|---|
| Maintainer: | Joachim Metz, David Loveall |
| OS: | Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows |
| Genre: | Disk imaging |
| License: | LGPL |
| Website: | libewf.sourceforge.net |
The libewf package contains Linux based library and applications to read and write EnCase E0* and SMART s0* storage media bitstream copies.
It has been ported to other platforms like FreeBSD, NetBSD, OpenBSD, Mac OS X, and Windows as well.
Contents |
History
Libewf was created by Joachim Metz in 2006, while working for Hoffmann Investigations.
Libewf is a rewrite of earlier work on the EnCase 4 file format by Michael Cohen part of PyFlag and the Expert Witness Compression Format Specification by Andrew Rosen. It has been updated to read and write EnCase version 1 to 6 E01 files and SMART s01 files (EWF files). Libewf has initiated an Extended EWF (EWF-X) specifications to bypass limitations on the format imposed by EnCase.
libewf also has read support for the EnCase L01 format.
In 2007 David Loveall contributed mount_ewf.py to the libewf project. This application allows a fuse based mount of the storage media data in the EWF files to be mounted.
Tools
The libewf package contains the following tools:
- ewfacquire, which writes storage media data from devices and files to EWF files.
- ewfacquirestream, which writes data from stdin to EWF files.
- ewfexport, which exports storage media data in EWF files to (split) RAW format or a specific version of EWF files.
- ewfinfo, which shows the metadata in EWF files.
- ewfverify, which verifies the storage media data in EWF files.
Provided as separate tools on the libewf project site:
- mount_ewf.py, which allows the storage media data in a EWF files to be mounted, contributed by David Loveall in 2007.
- libewf-java, Java (JNA) bindings were contributed by Bradley Schatz in 2009.
- delphi imdisk proxy, Borland Delphi imdisk proxy, as an alternative to mount_ewf.py for Windows, contributed by Brendan Berney in 2010.
A menu based interface for ewfacquirestream called pyEWF, contributed by Dennis Schreiber, was originally also available on the project site. However this is currently no longer maintained. Instead the name pyewf was reused for the libewf Python bindings created by David Collett which is now included in the libewf package.
Examples
Imaging a device on a Unix-based system:
ewfacquire /dev/sda
Imaging a device on a Windows system:
ewfacquire \\.\PhysicalDrive0
Converting a split RAW into an EWF image
ewfacquire split.raw.???
or
cat split.raw.??? | ewfacquirestream
Converting an EWF into another EWF format or a (split) RAW image
ewfexport image.E01
Exporting files from a logical image (L01)
ewfexport image.L01
