Difference between pages "Excel Spreadsheet (XLSB)" and "Libewf"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
m (Ewftools moved to Libewf)
 
Line 1: Line 1:
The '''Excel Spreadsheet (XLSB) file format''' has the '''.xlsb''' extension. This file type originates from [[Microsoft Excel]]. However, other spreadsheet software can be used to display these files as well. These include:
+
{{Infobox_Software |
* [[OpenOffice]] (probably as of version 3)
+
  name = ewftools |
 +
  maintainer = [[Joachim Metz]], [[David Loveall]] |
 +
  os = {{Linux | BSD | MacOS-X | Windows}} |
 +
  genre = [[File type support]] |
 +
  license = {{LGPL}} |
 +
  website = [http://libewf.sourceforge.net libewf.sourceforge.net] |
 +
}}
  
== MIME types ==
+
The '''ewftools''' are a [[Linux]] based programs to read and write EnCase E01 and SMART s01 bitstream copies of storage media. It has been ported to other platforms like *BSD, MacOS-X and Windows as well.
  
The following [[MIME types]] apply to this [[file format]]:
+
== History ==
  
* application/msexcel
+
The ewftools were developed by [[Joachim Metz]] while working for [[Hoffmann Investigations]].
* application/xls
+
  
== File signature ==
+
The ewftools are part of libewf package which was created in 2006.
 +
Libewf is a rewrite of earlier work on the EnCase 4 file format by [[Michael Cohen]] part of [[PyFlag]] and the [http://www.asrdata.com/SMART/whitepaper.html Expert Witness Compression Format Specification] by [Andrew Rosen]. It has been updated to read and write EnCase 1 to 6 E01 files and SMART s01 files. Libewf has initiated an Extended EWF (EWF-X) specifications to bypass limitations on the format imposed by EnCase.
  
[[Microsoft Excel]] spreadsheets of version 2007 are stored in a [[ZIP archive]] file. These files therefore have the ZIP file signature
+
Currently libewf partially supports the EnCase L01 format but this functionality has been disabled.
  
== See Also==
+
== Tools ==  
 +
The ewftools consists of:
 +
* '''ewfacquire''' and '''ewfacquire''' , which writes storage media data from a device handle to a set of E01 or s01 files.
 +
* '''ewfexport''', which exports storage media data in a set of E01 or s01 files to raw (dd) format or a specific version of E01 or s01 files.
 +
* '''ewfinfo''', which shows the metadata in a set of E01 or s01 files.
 +
* '''ewfverify''', which verifies the storage media data in a set of E01 or s01 files.
 +
* '''mount_ewf.py''', which allows the storage media data in a set of E01 or s01 files to be mounted.
  
[http://download.microsoft.com/download/0/B/E/0BE8BDD7-E5E8-422A-ABFD-4342ED7AD886/Excel2007BinaryFileFormat(xlsb)Specification.pdf Excel 2007 Binary File format by Microsoft]
+
== External Links ==
  
[[Category:File Formats]]
+
* [http://libewf.sourceforge.net libewf project site]

Revision as of 06:57, 31 January 2009

ewftools
Maintainer: Joachim Metz, David Loveall
OS: Linux
Genre: File type support
License: LGPL
Website: libewf.sourceforge.net

The ewftools are a Linux based programs to read and write EnCase E01 and SMART s01 bitstream copies of storage media. It has been ported to other platforms like *BSD, MacOS-X and Windows as well.

History

The ewftools were developed by Joachim Metz while working for Hoffmann Investigations.

The ewftools are part of libewf package which was created in 2006. Libewf is a rewrite of earlier work on the EnCase 4 file format by Michael Cohen part of PyFlag and the Expert Witness Compression Format Specification by [Andrew Rosen]. It has been updated to read and write EnCase 1 to 6 E01 files and SMART s01 files. Libewf has initiated an Extended EWF (EWF-X) specifications to bypass limitations on the format imposed by EnCase.

Currently libewf partially supports the EnCase L01 format but this functionality has been disabled.

Tools

The ewftools consists of:

  • ewfacquire and ewfacquire , which writes storage media data from a device handle to a set of E01 or s01 files.
  • ewfexport, which exports storage media data in a set of E01 or s01 files to raw (dd) format or a specific version of E01 or s01 files.
  • ewfinfo, which shows the metadata in a set of E01 or s01 files.
  • ewfverify, which verifies the storage media data in a set of E01 or s01 files.
  • mount_ewf.py, which allows the storage media data in a set of E01 or s01 files to be mounted.

External Links