ewfinfo(1) [debian man page]
ewfinfo LOCAL ewfinfo NAME
ewfinfo -- show meta data stored in EWF files SYNOPSIS
ewfinfo [-A codepage] [-d date_format] [-ehimvV] ewf_files DESCRIPTION
ewfinfo is a utility to show meta data stored in EWF files. ewfinfo is part of the libewf package. libewf is a library to support the Expert Witness Compression Format (EWF). libewf supports both the SMART format (EWF-S01) and the EnCase format (EWF-E01). libewf currently does not support the Logical Volume format (EWF-L01). EWF-X is an expirimental format intended for testing purposes to enhance the EWF format. libewf allows you to read and write media data in the EWF for- mat. ewf_files the first or the entire set of EWF segment files The options are as follows: -A codepage the codepage of header section, options: ascii (default), windows-874, windows-1250, windows-1251, windows-1252, windows-1253, win- dows-1254, windows-1255, windows-1256, windows-1257, windows-1258 -d date_format the date format, options: ctime (default), dm (day/month), md (month/day), iso8601 -e only show EWF read error information -h shows this help -i only show EWF acquiry information -m only show EWF media information -v verbose output to stderr -V print version ENVIRONMENT
None FILES
None EXAMPLES
# ewfinfo -d dm floppy.E01 ewfinfo 20090427 (libewf 20090427, libuna 20090427, libbfio 20090426, zlib 1.2.3, libcrypto 0.9.8g, libuuid) Acquiry information Case number: 1 Description: Floppy Examiner name: John D. Evidence number: 1.1 Notes: Just a floppy in my system Acquiry date: 09/12/2006 10:00:12 System date: 09/12/2006 10:00:12 Operating system used: Linux Software version used: 20061209 Password: N/A EWF information File format: EnCase 5 Sectors per chunk: 64 Error granularity: 64 Compression type: no compression GUID: 869910fc-e143-4908-9328-afedf4a7be1e Media information Media type: removable disk Is physical: no Bytes per sector: 512 Amount of sectors: 2880 Media size: 1.4 MiB (1474560 bytes) Digest hash information MD5: ae1ce8f5ac079d3ee93f97fe3792bda3 DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation. BUGS
Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website: http://libewf.sourceforge.net/ AUTHOR
These man pages were written by Kees Mastwijk. Alterations for distribution have been made by Joachim Metz. COPYRIGHT
Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. SEE ALSO
ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfverify(1) libewf October 17, 2009 libewf
Check Out this Related Man Page
ewfverify LOCAL ewfverify NAME
ewfverify -- verifies media data stored in EWF files SYNOPSIS
ewfverify [-A codepage] [-d digest_type] [-l log_filename] [-p process_buffer_size] [-hqvVw] ewf_files DESCRIPTION
ewfverify is a utility to verify media data stored in EWF files. ewfverify is part of the libewf package. libewf is a library to support the Expert Witness Compression Format (EWF). libewf supports both the SMART format (EWF-S01) and the EnCase format (EWF-E01). libewf currently does not support the Logical Volume format (EWF-L01). EWF-X is an expirimental format intended for testing purposes to enhance the EWF format. libewf allows you to read and write media data in the EWF format. ewf_files the first or the entire set of EWF segment files The options are as follows: -A codepage the codepage of header section, options: ascii (default), windows-874, windows-1250, windows-1251, windows-1252, windows-1253, win- dows-1254, windows-1255, windows-1256, windows-1257, windows-1258 -d digest_type calculate additional digest (hash) types besides md5, options: sha1 -h shows this help -l log_filename logs verification errors and the digest (hash) to the log filename -p process_buffer_size the process buffer size (default is the chunk size) -q quiet shows no status information -v verbose output to stderr -V print version -w wipe sectors on CRC error (mimic EnCase like behavior) ENVIRONMENT
None FILES
None EXAMPLES
# ewfverify floppy.E01 ewfverify 20090229 (libewf 20090229, libuna 20090124, zlib 1.2.3, libcrypto 0.9.8g, libuuid) Verify started at: Sat Feb 28 19:21:51 2009 This could take a while. Status: at 2%. verified 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes). ... Status: at 100%. verified 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes). completion in 1 second(s) with 1 MiB/s (1474560 bytes/second). Verify completed at: Sat Feb 28 19:21:52 2009 Read: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second). MD5 hash stored in file: ae1ce8f5ac079d3ee93f97fe3792bda3 MD5 hash calculated over data: ae1ce8f5ac079d3ee93f97fe3792bda3 ewfverify: SUCCESS DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation. BUGS
Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website: http://libewf.sourceforge.net/ AUTHOR
These man pages were written by Kees Mastwijk. Alterations for distribution have been made by Joachim Metz. COPYRIGHT
Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. SEE ALSO
ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfinfo(1) libewf October 17, 2009 libewf