ewfexport(1)

1ewfexport                            LOCAL                           ewfexport
2

NAME

4     ewfexport — exports media data stored in EWF files
5

SYNOPSIS

7     ewfexport [-A codepage] [-b number_of_sectors] [-B number_of_bytes]
8               [-c compression_values] [-d digest_type] [-f format]
9               [-l log_filename] [-o offset] [-p process_buffer_size]
10               [-S segment_file_size] [-t target] [-hqsuvVwx] ewf_files
11

DESCRIPTION

13     ewfexport is a utility to export media data stored in EWF files.
14
15     ewfexport is part of the libewf package.  libewf is a library to access
16     the Expert Witness Compression Format (EWF).
17
18     ewf_files the first or the entire set of EWF segment files
19
20     The options are as follows:
21
22     -A codepage
23             the codepage of header section, options: ascii (default), win‐
24             dows-874, windows-932, windows-936, windows-949, windows-950,
25             windows-1250, windows-1251, windows-1252, windows-1253, win‐
26             dows-1254, windows-1255, windows-1256, windows-1257 or win‐
27             dows-1258
28
29     -b number_of_sectors
30             the number of sectors to read at once (per chunk), options: 16,
31             32, 64 (default), 128, 256, 512, 1024, 2048, 4096, 8192, 16384 or
32             32768
33
34     -B number_of_bytes
35             the number of bytes to export
36
37     -c compression_values
38             specify the compression values as: level or method:level compres‐
39             sion method options: deflate (default), bzip2 (bzip2 is only sup‐
40             ported by EWF2 formats) compression level options: none
41             (default), empty-block, fast or best
42
43     -d digest_type
44             calculate additional digest (hash) types besides md5, options:
45             sha1 (not used for raw and files formats)
46
47     -f format
48             the output format to write to, options: raw (default), files
49             (restricted to logical volume files), ewf, smart, ftk, encase1,
50             encase2, encase3, encase4, encase5, encase6, encase7, encase7-v2,
51             linen5, linen6, linen7, ewfx.
52
53     -h      shows this help
54
55     -l log_filename
56             logs export errors and the digest (hash) to the log filename
57
58     -o offset
59             the offset to start the export (default is 0)
60
61     -p process_buffer_size
62             the process buffer size (default is the chunk size)
63
64     -s      swap byte pairs of the media data (from AB to BA) (use this for
65             big to little endian conversion and vice versa)
66
67     -S segment_file_size
68             the segment file size in bytes (default is 1.4 GiB) (minimum is
69             1.0 MiB, maximum is 7.9 EiB for raw, encase6 and encase7 format
70             and 1.9 GiB for other formats) (not used for files format)
71
72     -t target
73             the target file to export to, use - for stdout (default is
74             export) stdout is only supported for the raw format
75
76     -u      unattended mode (disables user interaction)
77
78     -v      verbose output to stderr
79
80     -V      print version
81
82     -w      zero sectors on checksum error (mimic EnCase like behavior)
83
84     -x      use the chunk data instead of the buffered read and write func‐
85             tions.
86

ENVIRONMENT

88     None
89

FILES

91     None
92

EXAMPLES

94     ewfexport will ask the information it needs.
95
96     # ewfexport floppy.E01
97     ewfexport 20120805
98
99     Information for export required, please provide the necessary input
100     Export to format (raw, files, ewf, smart, ftk, encase1, encase2, encase3, encase4, encase5, encase6, encase7, encase7-v2, linen5, linen6, linen7, ewfx) [raw]:
101     Target path and filename without extension or - for stdout: floppy
102     Evidence segment file size in bytes (1.0 MiB <= value <= 7.9 EiB) [1.4 GiB]:
103     Start export at offset (0 <= value <= 1474560) [0]:
104     Number of bytes to export (0 <= value <= 1474560) [1474560]:
105
106     Export started at: Sun Aug  5 19:19:40 2012
107
108     This could take a while.
109
110     Status: at 2%.
111             exported 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes).
112
113           ...
114
115     Status: at 100%.
116             exported 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes).
117             completion in 1 second(s) with 1 MiB/s (1474560 bytes/second).
118
119     Export completed at: Sun Aug  5 19:19:41 2012
120
121     Written: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).
122     MD5 hash calculated over data:          ae1ce8f5ac079d3ee93f97fe3792bda3
123

DIAGNOSTICS

125     Errors, verbose and debug output are printed to stderr when verbose out‐
126     put -v is enabled. Verbose and debug output are only printed when enabled
127     at compilation.
128

BUGS

130     Please report bugs of any kind to <joachim.metz@gmail.com> or on the
131     project website: http://code.google.com/p/libewf/
132

AUTHOR

134     These man pages were written by Kees Mastwijk.
135
136     Alterations for distribution have been made by Joachim Metz.
137

COPYRIGHT

139     Copyright 2006-2014, Joachim Metz <joachim.metz@gmail.com>.
140
141     This is free software; see the source for copying conditions. There is NO
142     warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PUR‐
143     POSE.
144