1ewfverify LOCAL ewfverify
2
4 ewfverify — verifies media data stored in EWF files
5
7 ewfverify [-A codepage] [-d digest_type] [-l log_filename]
8 [-p process_buffer_size] [-hqvVw] ewf_files
9
11 ewfverify is a utility to verify media data stored in EWF files.
12
13 ewfverify is part of the libewf package. libewf is a library to support
14 the Expert Witness Compression Format (EWF). libewf supports both the
15 SMART format (EWF-S01) and the EnCase format (EWF-E01). libewf currently
16 does not support the Logical Volume format (EWF-L01). EWF-X is an expiri‐
17 mental format intended for testing purposes to enhance the EWF format.
18 libewf allows you to read and write media data in the EWF format.
19
20 ewf_files the first or the entire set of EWF segment files
21
22 The options are as follows:
23
24 -A codepage
25 the codepage of header section, options: ascii (default), win‐
26 dows-874, windows-1250, windows-1251, windows-1252, windows-1253,
27 windows-1254, windows-1255, windows-1256, windows-1257, win‐
28 dows-1258
29
30 -d digest_type
31 calculate additional digest (hash) types besides md5, options:
32 sha1
33
34 -h shows this help
35
36 -l log_filename
37 logs verification errors and the digest (hash) to the log file‐
38 name
39
40 -p process_buffer_size
41 the process buffer size (default is the chunk size)
42
43 -q quiet shows no status information
44
45 -v verbose output to stderr
46
47 -V print version
48
49 -w wipe sectors on CRC error (mimic EnCase like behavior)
50
52 None
53
55 None
56
58 # ewfverify floppy.E01
59 ewfverify 20090229 (libewf 20090229, libuna 20090124, zlib 1.2.3, libcrypto 0.9.8g, libuuid)
60
61 Verify started at: Sat Feb 28 19:21:51 2009
62
63 This could take a while.
64
65 Status: at 2%.
66 verified 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes).
67
68 ...
69
70 Status: at 100%.
71 verified 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes).
72 completion in 1 second(s) with 1 MiB/s (1474560 bytes/second).
73
74 Verify completed at: Sat Feb 28 19:21:52 2009
75
76 Read: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).
77
78 MD5 hash stored in file: ae1ce8f5ac079d3ee93f97fe3792bda3
79 MD5 hash calculated over data: ae1ce8f5ac079d3ee93f97fe3792bda3
80
81 ewfverify: SUCCESS
82
84 Errors, verbose and debug output are printed to stderr when verbose out‐
85 put -v is enabled. Verbose and debug output are only printed when enabled
86 at compilation.
87
89 Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
90 project website: http://libewf.sourceforge.net/
91
93 These man pages were written by Kees Mastwijk.
94
95 Alterations for distribution have been made by Joachim Metz.
96
98 Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <foren‐
99 sics@hoffmannbv.nl> and contributors.
100
101 This is free software; see the source for copying conditions. There is NO
102 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PUR‐
103 POSE.
104
106 ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfinfo(1)
107
108libewf October 17, 2009 libewf