libewf(3)

1libewf(3)                BSD Library Functions Manual                libewf(3)
2

NAME

4     libewf.h — Library to read from and write to the Expert Witness Compres‐
5     sion Format (EWF) file format
6

LIBRARY

8     library “libewf”
9

SYNOPSIS

11     #include <libewf.h>
12
13     Support functions
14
15     const char *
16     libewf_get_version(void);
17
18     uint8_t
19     libewf_get_flags_read();
20
21     uint8_t
22     libewf_get_flags_read_write();
23
24     uint8_t
25     libewf_get_flags_write();
26
27     uint8_t
28     libewf_get_flags_write_resume();
29
30     int
31     libewf_check_file_signature(const char *filename);
32
33     int
34     libewf_glob(const char *filename, size_t filename_length, uint8_t format, char ** filenames[]);
35
36     Available when compiled with wide character string support:
37
38     int
39     libewf_check_file_signature_wide(const wchar_t *filename);
40
41     int
42     libewf_glob_wide(const wchar_t *filename, size_t filename_length, uint8_t format, wchar_t ** filenames[]);
43
44     Support functions (APIv2)
45
46     int
47     libewf_check_file_signature(const char *filename, libewf_error_t **error);
48
49     int
50     libewf_glob(const char *filename, size_t filename_length, uint8_t format, char **filenames[], int *amount_of_filenames, libewf_error_t **error);
51
52     int
53     libewf_glob_free(char *filenames[], int amount_of_filenames, libewf_error_t **error);
54
55     Available when compiled with wide character string support:
56
57     int
58     libewf_check_file_signature_wide(const wchar_t *filename, libewf_error_t **error);
59
60     int
61     libewf_glob_wide(const wchar_t *filename, size_t filename_length, uint8_t format, wchar_t **filenames[], int *amount_of_filenames, libewf_error_t **error);
62
63     int
64     libewf_glob_free_wide(wchar_t *filenames[], int amount_of_filenames, libewf_error_t **error);
65
66     Available when compiled with libbfio support:
67
68     int
69     libewf_check_file_signature_file_io_handle(libbfio_handle_t *file_io_handle, libewf_error_t **error);
70
71     Notify functions (APIv1)
72
73     void
74     libewf_set_notify_values(FILE *stream, uint8_t verbose);
75
76     Notify functions (APIv2)
77
78     void
79     libewf_notify_set_verbose(int verbose);
80
81     int
82     libewf_notify_set_stream(FILE *stream, libewf_error_t **error);
83
84     int
85     libewf_notify_stream_open(const char *filename, libewf_error_t **error);
86
87     int
88     libewf_notify_stream_close(libewf_error_t **error);
89
90     Error functions (APIv2)
91
92     void
93     libewf_error_free(libewf_error_t **error);
94
95     int
96     libewf_error_fprint(libewf_error_t *error, FILE *stream);
97
98     int
99     libewf_error_sprint(libewf_error_t *error, char *string, size_t size);
100
101     int
102     libewf_error_backtrace_fprint(libewf_error_t *error, FILE *stream);
103
104     int
105     libewf_error_backtrace_sprint(libewf_error_t *error, char *string, size_t size);
106
107     File/Handle functions (APIv1)
108
109     int
110     libewf_signal_abort(libewf_handle_t *handle);
111
112     libewf_handle_t *
113     libewf_open(char * const filenames[], int amount_of_filenames, uint8_t flags);
114
115     int
116     libewf_close(libewf_handle_t *handle);
117
118     off64_t
119     libewf_seek_offset(libewf_handle_t *handle, off64_t offset);
120
121     off64_t
122     libewf_get_offset(libewf_handle_t *handle);
123
124     ssize_t
125     libewf_raw_read_prepare_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size, void *uncompressed_buffer, size_t *uncompressed_buffer_size, int8_t is_compressed, EWF_CRC chunk_crc, int8_t read_crc);
126
127     ssize_t
128     libewf_raw_read_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size, int8_t *is_compressed, uint32_t *chunk_crc, int8_t *read_crc);
129
130     ssize_t
131     libewf_read_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size);
132
133     ssize_t
134     libewf_read_random(libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset);
135
136     ssize_t
137     libewf_raw_write_prepare_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size, void *compressed_buffer, size_t *compressed_buffer_size, int8_t *is_compressed, uint32_t *chunk_crc, int8_t *write_crc);
138
139     ssize_t
140     libewf_raw_write_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size, size_t data_size, int8_t is_compressed, uint32_t chunk_crc, int8_t write_crc);
141
142     ssize_t
143     libewf_write_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size);
144
145     ssize_t
146     libewf_write_random(libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset);
147
148     ssize_t
149     libewf_write_finalize(libewf_handle_t *handle);
150
151     int
152     libewf_get_segment_filename(libewf_handle_t *handle, char *filename, size_t filename_size);
153
154     int
155     libewf_set_segment_filename(libewf_handle_t *handle, const char *filename, size_t filename_length);
156
157     int
158     libewf_get_segment_file_size(libewf_handle_t *handle, size64_t *segment_file_size);
159
160     int
161     libewf_set_segment_file_size(libewf_handle_t *handle, size64_t segment_file_size);
162
163     int
164     libewf_get_delta_segment_filename(libewf_handle_t *handle, char *filename, size_t filename_size);
165
166     int
167     libewf_set_delta_segment_filename(libewf_handle_t *handle, const char *filename, size_t filename_length);
168
169     int
170     libewf_get_delta_segment_file_size(libewf_handle_t *handle, size64_t *delta_segment_file_size);
171
172     int
173     libewf_set_delta_segment_file_size(libewf_handle_t *handle, size64_t delta_segment_file_size);
174
175     Available when compiled with wide character string support:
176
177     libewf_handle_t *
178     libewf_open_wide(wchar_t * const filenames[], int amount_of_filenames, uint8_t flags);
179
180     int
181     libewf_get_segment_filename_wide(libewf_handle_t *handle, wchar_t *filename, size_t filename_size);
182
183     int
184     libewf_set_segment_filename_wide(libewf_handle_t *handle, const wchar_t *filename, size_t filename_length);
185
186     int
187     libewf_get_delta_segment_filename_wide(libewf_handle_t *handle, wchar_t *filename, size_t filename_size);
188
189     int
190     libewf_set_delta_segment_filename_wide(libewf_handle_t *handle, const wchar_t *filename, size_t filename_length);
191
192     File/Handle functions (APIv2)
193
194     int
195     libewf_handle_signal_abort(libewf_handle_t *handle, libewf_error_t **error);
196
197     int
198     libewf_handle_initialize(libewf_handle_t **handle, libewf_error_t **error);
199
200     int
201     libewf_handle_free(libewf_handle_t **handle, libewf_error_t **error);
202
203     int
204     libewf_handle_open(libewf_handle_t *handle, char * const filenames[], int amount_of_filenames, uint8_t flags, libewf_error_t **error);
205
206     int
207     libewf_handle_close(libewf_handle_t *handle, libewf_error_t **error);
208
209     off64_t
210     libewf_handle_seek_offset(libewf_handle_t *handle, off64_t offset, int whence, libewf_error_t **error);
211
212     off64_t
213     libewf_handle_get_offset(libewf_handle_t *handle, libewf_error_t **error);
214
215     ssize_t
216     libewf_handle_prepare_read_chunk(libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, void *uncompressed_buffer, size_t *uncompressed_buffer_size, int8_t is_compressed, EWF_CRC chunk_crc, int8_t read_crc, libewf_error_t **error);
217
218     ssize_t
219     libewf_handle_read_chunk(libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, int8_t *is_compressed, void *crc_buffer, uint32_t *chunk_crc, int8_t *read_crc, libewf_error_t **error);
220
221     ssize_t
222     libewf_handle_read_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size, libewf_error_t **error);
223
224     ssize_t
225     libewf_handle_read_random(libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset, libewf_error_t **error);
226
227     ssize_t
228     libewf_handle_prepare_write_chunk(libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, void *compressed_buffer, size_t *compressed_buffer_size, int8_t *is_compressed, uint32_t *chunk_crc, int8_t *write_crc, libewf_error_t **error);
229
230     ssize_t
231     libewf_handle_write_chunk(libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, size_t data_size, int8_t is_compressed, void *crc_buffer, uint32_t chunk_crc, int8_t write_crc, libewf_error_t **error);
232
233     ssize_t
234     libewf_handle_write_buffer(libewf_handle_t *handle, void *buffer, size_t buffer_size, libewf_error_t **error);
235
236     ssize_t
237     libewf_handle_write_random(libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset, libewf_error_t **error);
238
239     ssize_t
240     libewf_handle_write_finalize(libewf_handle_t *handle, libewf_error_t **error);
241
242     int
243     libewf_handle_get_segment_filename_size(libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error);
244
245     int
246     libewf_handle_get_segment_filename(libewf_handle_t *handle, char *filename, size_t filename_size, libewf_error_t **error);
247
248     int
249     libewf_handle_set_segment_filename(libewf_handle_t *handle, const char *filename, size_t filename_length, libewf_error_t **error);
250
251     int
252     libewf_handle_get_segment_file_size(libewf_handle_t *handle, size64_t *segment_file_size, libewf_error_t **error);
253
254     int
255     libewf_handle_set_segment_file_size(libewf_handle_t *handle, size64_t segment_file_size, libewf_error_t **error);
256
257     int
258     libewf_handle_get_delta_segment_filename_size(libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error);
259
260     int
261     libewf_handle_get_delta_segment_filename(libewf_handle_t *handle, char *filename, size_t filename_size, libewf_error_t **error);
262
263     int
264     libewf_handle_set_delta_segment_filename(libewf_handle_t *handle, const char *filename, size_t filename_length, libewf_error_t **error);
265
266     int
267     libewf_handle_get_delta_segment_file_size(libewf_handle_t *handle, size64_t *delta_segment_file_size, libewf_error_t **error);
268
269     int
270     libewf_handle_set_delta_segment_file_size(libewf_handle_t *handle, size64_t delta_segment_file_size, libewf_error_t **error);
271
272     int
273     libewf_handle_get_filename_size(libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error);
274
275     int
276     libewf_handle_get_filename(libewf_handle_t *handle, char *filename, size_t filename_size, libewf_error_t **error);
277
278     Available when compiled with wide character string support:
279
280     int
281     libewf_handle_open_wide(libewf_handle_t *handle, wchar_t * const filenames[], int amount_of_filenames, uint8_t flags);
282
283     int
284     libewf_handle_get_segment_filename_size_wide(libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error);
285
286     int
287     libewf_handle_get_segment_filename_wide(libewf_handle_t *handle, wchar_t *filename, size_t filename_size, libewf_error_t **error);
288
289     int
290     libewf_handle_set_segment_filename_wide(libewf_handle_t *handle, const wchar_t *filename, size_t filename_length, libewf_error_t **error);
291
292     int
293     libewf_handle_get_delta_segment_filename_size_wide(libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error);
294
295     int
296     libewf_handle_get_delta_segment_filename_wide(libewf_handle_t *handle, wchar_t *filename, size_t filename_size, libewf_error_t **error);
297
298     int
299     libewf_handle_set_delta_segment_filename_wide(libewf_handle_t *handle, const wchar_t *filename, size_t filename_length, libewf_error_t **error);
300
301     int
302     libewf_handle_get_filename_size_wide(libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error);
303
304     int
305     libewf_handle_get_filename_wide(libewf_handle_t *handle, wchar_t *filename, size_t filename_size, libewf_error_t **error);
306
307     Available when compiled with libbfio support:
308
309     int
310     libewf_handle_open_file_io_pool(libewf_handle_t *handle, libbfio_pool_t *file_io_pool, uint8_t flags, libewf_error_t **error);
311
312     int
313     libewf_handle_get_file_io_handle(libewf_handle_t *handle, libbfio_handle_t **file_io_handle, libewf_error_t **error);
314
315     Meta data functions (APIv1)
316
317     int
318     libewf_get_sectors_per_chunk(libewf_handle_t *handle, uint32_t *sectors_per_chunk);
319
320     int
321     libewf_set_sectors_per_chunk(libewf_handle_t *handle, uint32_t sectors_per_chunk);
322
323     int
324     libewf_get_bytes_per_sector(libewf_handle_t *handle, uint32_t *bytes_per_sector);
325
326     int
327     libewf_set_bytes_per_sector(libewf_handle_t *handle, uint32_t bytes_per_sector);
328
329     int
330     libewf_get_amount_of_sectors(libewf_handle_t *handle, uint32_t *amount_of_sectors);
331
332     int
333     libewf_get_chunk_size(libewf_handle_t *handle, size32_t *chunk_size);
334
335     int
336     libewf_get_error_granularity(libewf_handle_t *handle, uint32_t *error_granularity);
337
338     int
339     libewf_set_error_granularity(libewf_handle_t *handle, uint32_t error_granularity);
340
341     int
342     libewf_get_compression_values(libewf_handle_t *handle, int8_t *compression_level, uint8_t *compress_empty_block);
343
344     int
345     libewf_set_compression_values(libewf_handle_t *handle, int8_t compression_level, uint8_t compress_empty_block);
346
347     int
348     libewf_get_media_size(libewf_handle_t *handle, size64_t *media_size);
349
350     int
351     libewf_set_media_size(libewf_handle_t *handle, size64_t media_size);
352
353     int
354     libewf_get_media_type(libewf_handle_t *handle, uint8_t *media_type);
355
356     int
357     libewf_set_media_type(libewf_handle_t *handle, uint8_t media_type);
358
359     int
360     libewf_get_media_flags(libewf_handle_t *handle, uint8_t *media_flags);
361
362     int
363     libewf_set_media_flags(libewf_handle_t *handle, uint8_t media_flags);
364
365     int
366     libewf_get_volume_type(libewf_handle_t *handle, uint8_t *volume_type);
367
368     int
369     libewf_set_volume_type(libewf_handle_t *handle, uint8_t volume_type);
370
371     int
372     libewf_get_format(libewf_handle_t *handle, uint8_t* format);
373
374     int
375     libewf_set_format(libewf_handle_t *handle, uint8_t format);
376
377     int
378     libewf_get_guid(libewf_handle_t *handle, uint8_t *guid, size_t size);
379
380     int
381     libewf_set_guid(libewf_handle_t *handle, uint8_t *guid, size_t size);
382
383     int
384     libewf_get_md5_hash(libewf_handle_t *handle, uint8_t *md5_hash, size_t size);
385
386     int
387     libewf_set_md5_hash(libewf_handle_t *handle, uint8_t *md5_hash, size_t size);
388
389     int
390     libewf_get_sha1_hash(libewf_handle_t *handle, uint8_t *sha1_hash, size_t size);
391
392     int
393     libewf_set_sha1_hash(libewf_handle_t *handle, uint8_t *sha1_hash, size_t size);
394
395     int
396     libewf_get_write_amount_of_chunks(libewf_handle_t *handle, uint32_t *amount_of_chunks);
397
398     int
399     libewf_set_read_wipe_chunk_on_error(libewf_handle_t *handle, uint8_t wipe_on_error);
400
401     int
402     libewf_copy_media_values(libewf_handle_t *destination_handle, libewf_handle_t *source_handle);
403
404     int
405     libewf_get_amount_of_acquiry_errors(libewf_handle_t *handle, uint32_t *amount_of_errors);
406
407     int
408     libewf_get_acquiry_error(libewf_handle_t *handle, uint32_t index, off64_t *first_sector, uint32_t *amount_of_sectors);
409
410     int
411     libewf_add_acquiry_error(libewf_handle_t *handle, off64_t first_sector, uint32_t amount_of_sectors);
412
413     int
414     libewf_get_amount_of_crc_errors(libewf_handle_t *handle, uint32_t *amount_of_errors);
415
416     int
417     libewf_get_crc_error(libewf_handle_t *handle, uint32_t index, off64_t *first_sector, uint32_t *amount_of_sectors);
418
419     int
420     libewf_add_crc_error(libewf_handle_t *handle, off64_t first_sector, uint32_t amount_of_sectors);
421
422     int
423     libewf_get_amount_of_sessions(libewf_handle_t *handle, uint32_t *amount_of_sessions);
424
425     int
426     libewf_get_session(libewf_handle_t *handle, uint32_t index, off64_t *first_sector, uint32_t *amount_of_sectors);
427
428     int
429     libewf_add_session(libewf_handle_t *handle, off64_t first_sector, uint32_t amount_of_sectors);
430
431     int
432     libewf_get_header_codepage(libewf_handle_t *handle, int *codepage);
433
434     int
435     libewf_set_header_codepage(libewf_handle_t *handle, int codepage);
436
437     int
438     libewf_get_amount_of_header_values(libewf_handle_t *handle, uint32_t *amount_of_values);
439
440     int
441     libewf_get_header_value_identifier_size(libewf_handle_t *handle, uint32_t index, size_t *identifier_size);
442
443     int
444     libewf_get_header_value_identifier(libewf_handle_t *handle, uint32_t index, char *identifier, size_t identifier_size);
445
446     int
447     libewf_get_header_value_size(libewf_handle_t *handle, const char *identifier, size_t *value_size);
448
449     int
450     libewf_get_header_value(libewf_handle_t *handle, const char *identifier, char *value, size_t value_size);
451
452     int
453     libewf_get_header_value_case_number(libewf_handle_t *handle, char *value, size_t value_size);
454
455     int
456     libewf_get_header_value_description(libewf_handle_t *handle, char *value, size_t value_size);
457
458     int
459     libewf_get_header_value_examiner_name(libewf_handle_t *handle, char *value, size_t value_size);
460
461     int
462     libewf_get_header_value_evidence_number(libewf_handle_t *handle, char *value, size_t value_size);
463
464     int
465     libewf_get_header_value_notes(libewf_handle_t *handle, char *value, size_t value_size);
466
467     int
468     libewf_get_header_value_acquiry_date(libewf_handle_t *handle, char *value, size_t value_size);
469
470     int
471     libewf_get_header_value_system_date(libewf_handle_t *handle, char *value, size_t value_size);
472
473     int
474     libewf_get_header_value_acquiry_operating_system(libewf_handle_t *handle, char *value, size_t value_size);
475
476     int
477     libewf_get_header_value_acquiry_software_version(libewf_handle_t *handle, char *value, size_t value_size);
478
479     int
480     libewf_get_header_value_password(libewf_handle_t *handle, char *value, size_t value_size);
481
482     int
483     libewf_get_header_value_compression_type(libewf_handle_t *handle, char *value, size_t value_size);
484
485     int
486     libewf_set_header_value(libewf_handle_t *handle, const char *identifier, const char *value, size_t value_length);
487
488     int
489     libewf_set_header_value_case_number(libewf_handle_t *handle, const char *value, size_t value_length);
490
491     int
492     libewf_set_header_value_description(libewf_handle_t *handle, const char *value, size_t value_length);
493
494     int
495     libewf_set_header_value_examiner_name(libewf_handle_t *handle, const char *value, size_t value_length);
496
497     int
498     libewf_set_header_value_evidence_number(libewf_handle_t *handle, const char *value, size_t value_length);
499
500     int
501     libewf_set_header_value_notes(libewf_handle_t *handle, const char *value, size_t value_length);
502
503     int
504     libewf_set_header_value_acquiry_date(libewf_handle_t *handle, const char *value, size_t value_length);
505
506     int
507     libewf_set_header_value_system_date(libewf_handle_t *handle, const char *value, size_t value_length);
508
509     int
510     libewf_set_header_value_acquiry_operating_system(libewf_handle_t *handle, const char *value, size_t value_length);
511
512     int
513     libewf_set_header_value_acquiry_software_version(libewf_handle_t *handle, const char *value, size_t value_length);
514
515     int
516     libewf_set_header_value_password(libewf_handle_t *handle, const char *value, size_t value_length);
517
518     int
519     libewf_set_header_value_compression_type(libewf_handle_t *handle, const char *value, size_t value_length);
520
521     int
522     libewf_set_header_value_model(libewf_handle_t *handle, const char *value, size_t value_length);
523
524     int
525     libewf_set_header_value_serial_number(libewf_handle_t *handle, const char *value, size_t value_length);
526
527     int
528     libewf_parse_header_values(libewf_handle_t *handle, uint8_t date_format);
529
530     int
531     libewf_copy_header_values(libewf_handle_t *destination_handle, libewf_handle_t *source_handle);
532
533     int
534     libewf_get_amount_of_hash_values(libewf_handle_t *handle, uint32_t *amount_of_values);
535
536     int
537     libewf_get_hash_value_identifier_size(libewf_handle_t *handle, uint32_t index, size_t *identifier_size);
538
539     int
540     libewf_get_hash_value_identifier(libewf_handle_t *handle, uint32_t index, char *identifier, size_t identifier_size);
541
542     int
543     libewf_get_hash_value_size(libewf_handle_t *handle, const char *identifier, size_t *value_size);
544
545     int
546     libewf_get_hash_value(libewf_handle_t *handle, const char *identifier, char *value, size_t value_size);
547
548     int
549     libewf_get_hash_value_md5(libewf_handle_t *handle, char *value, size_t value_size);
550
551     int
552     libewf_get_hash_value_sha1(libewf_handle_t *handle, char *value, size_t value_size);
553
554     int
555     libewf_set_hash_value(libewf_handle_t *handle, const char *identifier, const char *value, size_t value_length);
556
557     int
558     libewf_set_hash_value_md5(libewf_handle_t *handle, const char *value, size_t value_length);
559
560     int
561     libewf_set_hash_value_sha1(libewf_handle_t *handle, const char *value, size_t value_length);
562
563     int
564     libewf_parse_hash_values(libewf_handle_t *handle);
565
566     Meta data functions (APIv2)
567
568     int
569     libewf_handle_get_sectors_per_chunk(libewf_handle_t *handle, uint32_t *sectors_per_chunk, libewf_error_t **error);
570
571     int
572     libewf_handle_set_sectors_per_chunk(libewf_handle_t *handle, uint32_t sectors_per_chunk, libewf_error_t **error);
573
574     int
575     libewf_handle_get_bytes_per_sector(libewf_handle_t *handle, uint32_t *bytes_per_sector, libewf_error_t **error);
576
577     int
578     libewf_handle_set_bytes_per_sector(libewf_handle_t *handle, uint32_t bytes_per_sector, libewf_error_t **error);
579
580     int
581     libewf_handle_get_amount_of_sectors(libewf_handle_t *handle, uint64_t *amount_of_sectors, libewf_error_t **error);
582
583     int
584     libewf_handle_get_chunk_size(libewf_handle_t *handle, size32_t *chunk_size, libewf_error_t **error, libewf_error_t **error);
585
586     int
587     libewf_handle_get_error_granularity(libewf_handle_t *handle, uint32_t *error_granularity, libewf_error_t **error);
588
589     int
590     libewf_handle_set_error_granularity(libewf_handle_t *handle, uint32_t error_granularity, libewf_error_t **error);
591
592     int
593     libewf_handle_get_compression_values(libewf_handle_t *handle, int8_t *compression_level, uint8_t *compression_flags, libewf_error_t **error);
594
595     int
596     libewf_handle_set_compression_values(libewf_handle_t *handle, int8_t compression_level, uint8_t compression_flags, libewf_error_t **error);
597
598     int
599     libewf_handle_get_media_size(libewf_handle_t *handle, size64_t *media_size, libewf_error_t **error);
600
601     int
602     libewf_handle_set_media_size(libewf_handle_t *handle, size64_t media_size, libewf_error_t **error);
603
604     int
605     libewf_handle_get_media_type(libewf_handle_t *handle, uint8_t *media_type, libewf_error_t **error);
606
607     int
608     libewf_handle_set_media_type(libewf_handle_t *handle, uint8_t media_type, libewf_error_t **error);
609
610     int
611     libewf_handle_get_media_flags(libewf_handle_t *handle, uint8_t *media_flags, libewf_error_t **error);
612
613     int
614     libewf_handle_set_media_flags(libewf_handle_t *handle, uint8_t media_flags, libewf_error_t **error);
615
616     int
617     libewf_handle_get_format(libewf_handle_t *handle, uint8_t* format, libewf_error_t **error);
618
619     int
620     libewf_handle_set_format(libewf_handle_t *handle, uint8_t format, libewf_error_t **error);
621
622     int
623     libewf_handle_get_guid(libewf_handle_t *handle, uint8_t *guid, size_t size, libewf_error_t **error);
624
625     int
626     libewf_handle_set_guid(libewf_handle_t *handle, uint8_t *guid, size_t size, libewf_error_t **error);
627
628     int
629     libewf_handle_get_md5_hash(libewf_handle_t *handle, uint8_t *md5_hash, size_t size, libewf_error_t **error);
630
631     int
632     libewf_handle_set_md5_hash(libewf_handle_t *handle, uint8_t *md5_hash, size_t size, libewf_error_t **error);
633
634     int
635     libewf_handle_get_sha1_hash(libewf_handle_t *handle, uint8_t *sha1_hash, size_t size, libewf_error_t **error);
636
637     int
638     libewf_handle_set_sha1_hash(libewf_handle_t *handle, uint8_t *sha1_hash, size_t size, libewf_error_t **error);
639
640     int
641     libewf_handle_get_write_amount_of_chunks(libewf_handle_t *handle, uint32_t *amount_of_chunks, libewf_error_t **error);
642
643     int
644     libewf_handle_set_read_wipe_chunk_on_error(libewf_handle_t *handle, uint8_t wipe_on_error, libewf_error_t **error);
645
646     int
647     libewf_handle_copy_media_values(libewf_handle_t *destination_handle, libewf_handle_t *source_handle, libewf_error_t **error);
648
649     int
650     libewf_handle_get_amount_of_acquiry_errors(libewf_handle_t *handle, uint32_t *amount_of_errors, libewf_error_t **error);
651
652     int
653     libewf_handle_get_acquiry_error(libewf_handle_t *handle, uint32_t index, uint64_t *first_sector, uint64_t *amount_of_sectors, libewf_error_t **error);
654
655     int
656     libewf_handle_add_acquiry_error(libewf_handle_t *handle, uint64_t first_sector, uint64_t amount_of_sectors, libewf_error_t **error);
657
658     int
659     libewf_handle_get_amount_of_crc_errors(libewf_handle_t *handle, uint32_t *amount_of_errors, libewf_error_t **error);
660
661     int
662     libewf_handle_get_crc_error(libewf_handle_t *handle, uint32_t index, uint64_t *first_sector, uint64_t *amount_of_sectors, libewf_error_t **error);
663
664     int
665     libewf_handle_add_crc_error(libewf_handle_t *handle, uint64_t first_sector, uint64_t amount_of_sectors, libewf_error_t **error);
666
667     int
668     libewf_handle_get_amount_of_sessions(libewf_handle_t *handle, uint32_t *amount_of_sessions, libewf_error_t **error);
669
670     int
671     libewf_handle_get_session(libewf_handle_t *handle, uint32_t index, uint64_t *first_sector, uint64_t *amount_of_sectors, libewf_error_t **error);
672
673     int
674     libewf_handle_add_session(libewf_handle_t *handle, uint64_t first_sector, uint64_t amount_of_sectors, libewf_error_t **error);
675
676     int
677     libewf_handle_get_header_codepage(libewf_handle_t *handle, int *codepage, libewf_error_t **error);
678
679     int
680     libewf_handle_set_header_codepage(libewf_handle_t *handle, int codepage, libewf_error_t **error);
681
682     int
683     libewf_handle_get_header_values_data_format(libewf_handle_t *handle, int date_format, libewf_error_t **error);
684
685     int
686     libewf_handle_set_header_values_data_format(libewf_handle_t *handle, int date_format, libewf_error_t **error);
687
688     int
689     libewf_handle_get_amount_of_header_values(libewf_handle_t *handle, uint32_t *amount_of_values, libewf_error_t **error);
690
691     int
692     libewf_handle_get_header_value_identifier_size(libewf_handle_t *handle, uint32_t index, size_t *identifier_size, libewf_error_t **error);
693
694     int
695     libewf_handle_get_header_value_identifier(libewf_handle_t *handle, uint32_t index, uint8_t *identifier, size_t identifier_size, libewf_error_t **error);
696
697     int
698     libewf_handle_get_header_value_size(libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, size_t *value_size, libewf_error_t **error);
699
700     int
701     libewf_handle_get_header_value(libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, uint8_t *value, size_t value_size, libewf_error_t **error);
702
703     int
704     libewf_handle_get_header_value_case_number(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
705
706     int
707     libewf_handle_get_header_value_description(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
708
709     int
710     libewf_handle_get_header_value_examiner_name(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
711
712     int
713     libewf_handle_get_header_value_evidence_number(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
714
715     int
716     libewf_handle_get_header_value_notes(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
717
718     int
719     libewf_handle_get_header_value_acquiry_date(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
720
721     int
722     libewf_handle_get_header_value_system_date(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
723
724     int
725     libewf_handle_get_header_value_acquiry_operating_system(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
726
727     int
728     libewf_handle_get_header_value_acquiry_software_version(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
729
730     int
731     libewf_handle_get_header_value_password(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
732
733     int
734     libewf_handle_get_header_value_compression_type(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
735
736     int
737     libewf_handle_set_header_value(libewf_handle_t *handle, const uint8_t *identifier, const uint8_t *value, size_t value_length);
738
739     int
740     libewf_handle_set_header_value_case_number(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
741
742     int
743     libewf_handle_set_header_value_description(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
744
745     int
746     libewf_handle_set_header_value_examiner_name(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
747
748     int
749     libewf_handle_set_header_value_evidence_number(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
750
751     int
752     libewf_handle_set_header_value_notes(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
753
754     int
755     libewf_handle_set_header_value_acquiry_date(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
756
757     int
758     libewf_handle_set_header_value_system_date(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
759
760     int
761     libewf_handle_set_header_value_acquiry_operating_system(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
762
763     int
764     libewf_handle_set_header_value_acquiry_software_version(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
765
766     int
767     libewf_handle_set_header_value_password(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
768
769     int
770     libewf_handle_set_header_value_compression_type(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
771
772     int
773     libewf_handle_set_header_value_model(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
774
775     int
776     libewf_handle_set_header_value_serial_number(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
777
778     int
779     libewf_handle_copy_header_values(libewf_handle_t *destination_handle, libewf_handle_t *source_handle, libewf_error_t **error);
780
781     int
782     libewf_handle_get_amount_of_hash_values(libewf_handle_t *handle, uint32_t *amount_of_values, libewf_error_t **error);
783
784     int
785     libewf_handle_get_hash_value_identifier_size(libewf_handle_t *handle, uint32_t index, size_t *identifier_size, libewf_error_t **error);
786
787     int
788     libewf_handle_get_hash_value_identifier(libewf_handle_t *handle, uint32_t index, uint8_t *identifier, size_t identifier_size, libewf_error_t **error);
789
790     int
791     libewf_handle_get_hash_value_size(libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, size_t *value_size, libewf_error_t **error);
792
793     int
794     libewf_handle_get_hash_value(libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, uint8_t *value, size_t value_size, libewf_error_t **error);
795
796     int
797     libewf_handle_get_hash_value_md5(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
798
799     int
800     libewf_handle_get_hash_value_sha1(libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error);
801
802     int
803     libewf_handle_set_hash_value(libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, const uint8_t *value, size_t value_length, libewf_error_t **error);
804
805     int
806     libewf_handle_set_hash_value_md5(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
807
808     int
809     libewf_handle_set_hash_value_sha1(libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error);
810

DESCRIPTION

812     The libewf_get_version() function is used to retrieve the library ver‐
813     sion.
814
815     The libewf_get_flags_*() functions are used to get the values of the
816     flags for read and/or write.
817
818     The libewf_check_file_signature() and libewf_check_file_signature_wide()
819     functions are used to test if the EWF file signature is present within a
820     certain filename.
821
822     The libewf_signal_abort() function signals the handle to aborts it cur‐
823     rent activity.
824
825     The libewf_glob() and libewf_glob_wide() functions glob filenames using
826     the filename and the format according to the EWF segment file naming
827     schema.  If the format is known the filename should contain the base of
828     the filename otherwise the function will try to determine the format
829     based on the extension.
830
831     The libewf_open(), libewf_open_wide(), libewf_seek_offset(),
832     libewf_read_buffer(), libewf_read_random(), libewf_write_buffer(),
833     libewf_write_random(), libewf_close() functions can be used to open, seek
834     in, read from, write to and close a set of EWF files.
835
836     The libewf_write_finalize() function needs to be called after writing a
837     set of EWF files without knowing the input size upfront, e.g. reading
838     from a pipe.  libewf_write_finalize() will the necessary correction to
839     the set of EWF files.
840
841     The libewf_raw_read_prepare_buffer(), libewf_raw_read_buffer() functions
842     can be used to read 'raw' chunks to a set of EWF files.
843
844     The libewf_raw_write_prepare_buffer(), libewf_raw_write_buffer() func‐
845     tions can be used to write 'raw' chunks to a set of EWF files.
846
847     The libewf_get_*() functions can be used to retrieve information from the
848     handle. This information is read from a set of EWF files when
849     libewf_open() or libewf_open_wide() is used. The
850     libewf_parse_header_values,() libewf_parse_hash_values() functions need
851     to be called before retrieving header or hash values.
852
853     The libewf_set_*() functions can be used to set information in the
854     handle. This information is written to a set of EWF files when
855     libewf_write_buffer() is used.
856
857     The libewf_parse_header_values() function can be used to parse the values
858     in the header strings within a set of EWF files.
859
860     The libewf_parse_hash_values() function can be used to parse the values
861     in the hash string within a set of EWF files. The hash string is cur‐
862     rently only present in the EWF-X format.
863
864     The libewf_add_acquiry_error() function can be used to add an acquiry
865     error (a read error during acquiry) to be written into a set of EWF
866     files.
867
868     The libewf_add_crc_error() function can be used to add a CRC error (a
869     validation error in a chunk in a set of EWF files) to be set in the han‐
870     dle.
871
872     The libewf_add_session() function can be used to add a sesssion to be
873     written into a set of EWF files. Note that the only the start offset is
874     stored in a set of EWF files. Libewf ignores the session amount of sec‐
875     tors on write and determines the session sizes using the available ses‐
876     sion and media information on read.
877
878     The libewf_copy_*() functions copy information from the source_handle to
879     the destination_handle.
880
881     The libewf_set_notify_values() function can be used to direct the warn‐
882     ing, verbose and debug output from the library.
883

RETURN VALUES

885     Most of the functions return NULL or -1 on error, dependent on the return
886     type. For the actual return values refer to libewf.h
887

ENVIRONMENT

889     None
890

FILES

892     None
893

NOTES

895     libewf allows to be compiled with wide character support.  To compile
896     libewf with wide character support use ./configure
897     --enable-wide-character-type=yes or pass the definition
898     HAVE_WIDE_CHARACTER_TYPE
899      to the compiler (i.e. in case of Microsoft Visual Studio (MSVS) C++).
900
901     To have other code to determine if libewf was compiled with wide charac‐
902     ter support it defines LIBEWF_HAVE_WIDE_CHARACTER_TYPE
903      in libewf/features.h.
904
905     As of version 20080903 libewf uses UTF-8 encoded strings except for file‐
906     names.
907
908     The Windows API has both ASCII and UTF16 functions and some functions
909     have wrapper macros that hide the actual implementation.  As of version
910     20090328 libewf detects the UNICODE or _UNICODE directives to compile
911     either with or without wide system character support.  The directive
912     HAVE_WIDE_CHARACTER_SUPPORT_FUNCTIONS is no longer used.
913
914     The header in a set of EWF files contains an extended ASCII string using
915     the codepage of the system it was created on. The function
916     libewf_set_header_codepage
917      allows to set the required codepage for reading and writing. The default
918     codepage is ASCII and replaces all extended characters to the Unicode
919     replacement character (U+fffd) when reading and the ASCII substitude
920     character (0x1a) when writing.
921
922     The header2 contains UTF-16 little endian stream and the xheader and
923     xhash contain a UTF-8 stream without or with byte order mark (as of ver‐
924     sion 20080903).
925
926     libewf allows to be compiled with chained IO support using libbfio.
927     libewf will automatically detect if a compatible version of libbfio is
928     available.
929
930     To have other code to determine if libewf was compiled with libbfio sup‐
931     port it defines LIBEWF_HAVE_BFIO
932      in libewf/features.h.
933
934

BUGS

936     Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
937     project website: http://libewf.sourceforge.net/
938

AUTHOR

940     These man pages were written by Joachim Metz.
941

COPYRIGHT

943     Copyright 2006-2009 Joachim Metz, Hoffmann Investigations <foren‐
944     sics@hoffmannbv.nl> and contributors.  This is free software; see the
945     source for copying conditions. There is NO warranty; not even for MER‐
946     CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
947