ewfexport(1)

1ewfexport                            LOCAL                           ewfexport
2

NAME

4     ewfexport — exports media data stored in EWF files
5

SYNOPSIS

7     ewfexport [-A codepage] [-B amount_of_bytes] [-c compression_type]
8               [-d digest_type] [-f format] [-l log_filename] [-o offset]
9               [-p process_buffer_size] [-S segment_file_size] [-t target]
10               [-hqsuvVw] ewf_files
11

DESCRIPTION

13     ewfexport is a utility to export media data stored in EWF files.
14
15     ewfexport is part of the libewf package.  libewf is a library to support
16     the Expert Witness Compression Format (EWF).  libewf supports both the
17     SMART format (EWF-S01) and the EnCase format (EWF-E01).  libewf currently
18     does not support the Logical Volume format (EWF-L01). EWF-X is an expiri‐
19     mental format intended for testing purposes to enhance the EWF format.
20     libewf allows you to read and write media data in the EWF format.
21
22     ewf_files the first or the entire set of EWF segment files
23
24     The options are as follows:
25
26     -A codepage
27             the codepage of header section, options: ascii (default), win‐
28             dows-874, windows-1250, windows-1251, windows-1252, windows-1253,
29             windows-1254, windows-1255, windows-1256, windows-1257, win‐
30             dows-1258
31
32     -B amount_of_bytes
33             the amount of bytes to export
34
35     -c compression_type
36             the compression type, options: none (default), empty-block, fast,
37             best (not used for raw format)
38
39     -d digest_type
40             calculate additional digest (hash) types besides md5, options:
41             sha1 (not used for raw format)
42
43     -f format
44             the file format to write to, options: raw (default), ewf, smart,
45             ftk, encase1, encase2, encase3, encase4, encase5, encase6,
46             linen5, linen6, ewfx.
47
48     -h      shows this help
49
50     -l log_filename
51             logs export errors and the digest (hash) to the log filename
52
53     -o offset
54             the offset to start the export (default is 0)
55
56     -p process_buffer_size
57             the process buffer size (default is the chunk size)
58
59     -s      swap byte pairs of the media data (from AB to BA) (use this for
60             big to little endian conversion and vice versa)
61
62     -S segment_file_size
63             the segment file size in bytes (default is 1.4 GiB) (minimum is
64             1.0 MiB, maximum is 7.9 EiB for encase6 format and 1.9 GiB for
65             other formats) (not used for raw format)
66
67     -t target
68             the target file to export to, use - for stdout (default is
69             export) stdout is only supported for the raw format
70
71     -u      unattended mode (disables user interaction)
72
73     -v      verbose output to stderr
74
75     -V      print version
76
77     -w      wipe sectors on CRC error (mimic EnCase like behavior)
78

ENVIRONMENT

80     None
81

FILES

83     None
84

EXAMPLES

86     ewfexport will ask the information it needs.
87
88     # ewfexport floppy.E01
89     ewfexport 20090229 (libewf 20090229, libuna 20090124, zlib 1.2.3, libcrypto 0.9.8g, libuuid)
90
91     Information for export required, please provide the necessary input
92     Export to file format (raw, ewf, smart, ftk, encase1, encase2, encase3, encase4, encase5, encase6, linen5, linen6, ewfx) [raw]:
93     Target path and filename with extension or - for stdout: floppy.raw
94     Start export at offset (0 >= value >= 1474560) [0]:
95     Amount of bytes to export (0 >= value >= 1474560) [1474560]:
96
97     Export started at: Sat Feb 28 19:19:40 2009
98
99     This could take a while.
100
101     Status: at 2%.
102             exported 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes).
103
104           ...
105
106     Status: at 100%.
107             exported 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes).
108             completion in 1 second(s) with 1 MiB/s (1474560 bytes/second).
109
110     Export completed at: Sat Feb 28 19:19:41 2009
111
112     Written: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).
113     MD5 hash calculated over data:  ae1ce8f5ac079d3ee93f97fe3792bda3
114

DIAGNOSTICS

116     Errors, verbose and debug output are printed to stderr when verbose out‐
117     put -v is enabled. Verbose and debug output are only printed when enabled
118     at compilation.
119

BUGS

121     Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
122     project website: http://libewf.sourceforge.net/
123

AUTHOR

125     These man pages were written by Kees Mastwijk.
126
127     Alterations for distribution have been made by Joachim Metz.
128

COPYRIGHT

130     Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <foren‐
131     sics@hoffmannbv.nl> and contributors.
132
133     This is free software; see the source for copying conditions. There is NO
134     warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PUR‐
135     POSE.
136