1ewfinfo                              LOCAL                             ewfinfo
2

NAME

4     ewfinfo — show meta data stored in EWF files
5

SYNOPSIS

7     ewfinfo [-A codepage] [-d date_format] [-ehimvV] ewf_files
8

DESCRIPTION

10     ewfinfo is a utility to show meta data stored in EWF files.
11
12     ewfinfo is part of the libewf package.  libewf is a library to support
13     the Expert Witness Compression Format (EWF).  libewf supports both the
14     SMART format (EWF-S01) and the EnCase format (EWF-E01).  libewf currently
15     does not support the Logical Volume format (EWF-L01). EWF-X is an expiri‐
16     mental format intended for testing purposes to enhance the EWF format.
17     libewf allows you to read and write media data in the EWF format.
18
19     ewf_files the first or the entire set of EWF segment files
20
21     The options are as follows:
22
23     -A codepage
24             the codepage of header section, options: ascii (default), win‐
25             dows-874, windows-1250, windows-1251, windows-1252, windows-1253,
26             windows-1254, windows-1255, windows-1256, windows-1257, win‐
27             dows-1258
28
29     -d date_format
30             the date format, options: ctime (default), dm (day/month), md
31             (month/day), iso8601
32
33     -e      only show EWF read error information
34
35     -h      shows this help
36
37     -i      only show EWF acquiry information
38
39     -m      only show EWF media information
40
41     -v      verbose output to stderr
42
43     -V      print version
44

ENVIRONMENT

46     None
47

FILES

49     None
50

EXAMPLES

52     # ewfinfo -d dm floppy.E01
53     ewfinfo 20090427 (libewf 20090427, libuna 20090427, libbfio 20090426, zlib 1.2.3, libcrypto 0.9.8g, libuuid)
54
55     Acquiry information
56             Case number:            1
57             Description:            Floppy
58             Examiner name:          John D.
59             Evidence number:        1.1
60             Notes:                  Just a floppy in my system
61             Acquiry date:           09/12/2006 10:00:12
62             System date:            09/12/2006 10:00:12
63             Operating system used:  Linux
64             Software version used:  20061209
65             Password:               N/A
66
67     EWF information
68             File format:            EnCase 5
69             Sectors per chunk:      64
70             Error granularity:      64
71             Compression type:       no compression
72             GUID:                   869910fc-e143-4908-9328-afedf4a7be1e
73
74     Media information
75             Media type:             removable disk
76             Is physical:            no
77             Bytes per sector:       512
78             Amount of sectors:      2880
79             Media size:             1.4 MiB (1474560 bytes)
80
81     Digest hash information
82             MD5:                    ae1ce8f5ac079d3ee93f97fe3792bda3
83
84

DIAGNOSTICS

86     Errors, verbose and debug output are printed to stderr when verbose out‐
87     put -v is enabled. Verbose and debug output are only printed when enabled
88     at compilation.
89

BUGS

91     Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
92     project website: http://libewf.sourceforge.net/
93

AUTHOR

95     These man pages were written by Kees Mastwijk.
96
97     Alterations for distribution have been made by Joachim Metz.
98

100     Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <foren‐
101     sics@hoffmannbv.nl> and contributors.
102
103     This is free software; see the source for copying conditions. There is NO
104     warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PUR‐
105     POSE.
106

SEE ALSO

108     ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfverify(1)
109
110libewf                         October 17, 2009                         libewf
Impressum