1ewfinfo                              LOCAL                             ewfinfo
2

NAME

4     ewfinfo — show meta data stored in EWF files
5

SYNOPSIS

7     ewfinfo [-A codepage] [-d date_format] [-f format] [-ehimvV] ewf_files
8

DESCRIPTION

10     ewfinfo is a utility to show meta data stored in EWF files.
11
12     ewfinfo is part of the libewf package.  libewf is a library to access the
13     Expert Witness Compression Format (EWF).
14
15     ewf_files the first or the entire set of EWF segment files
16
17     The options are as follows:
18
19     -A codepage
20             the codepage of header section, options: ascii (default), win‐
21             dows-874, windows-932, windows-936, windows-949, windows-950,
22             windows-1250, windows-1251, windows-1252, windows-1253, win‐
23             dows-1254, windows-1255, windows-1256, windows-1257 or win‐
24             dows-1258
25
26     -d date_format
27             the date format, options: ctime (default), dm (day/month), md
28             (month/day), iso8601
29
30     -e      only show EWF read error information
31
32     -f format
33             specify the output format, options: text (default), dfxml
34
35     -h      shows this help
36
37     -i      only show EWF acquiry information
38
39     -m      only show EWF media information
40
41     -v      verbose output to stderr
42
43     -V      print version
44

ENVIRONMENT

46     None
47

FILES

49     None
50

EXAMPLES

52     # ewfinfo -d dm floppy.E01
53     ewfinfo 20120805
54
55     Acquiry information
56             Case number:            1
57             Description:            Floppy
58             Examiner name:          John D.
59             Evidence number:        1.1
60             Notes:                  Just a floppy in my system
61             Acquiry date:           09/12/2006 10:00:12
62             System date:            09/12/2006 10:00:12
63             Operating system used:  Linux
64             Software version used:  20061209
65             Password:               N/A
66
67     EWF information
68             File format:            EnCase 5
69             Sectors per chunk:      64
70             Error granularity:      64
71             Compression method:     deflate
72             Compression level:      no compression
73             Set identifier:         869910fc-e143-4908-9328-afedf4a7be1e
74
75     Media information
76             Media type:             removable disk
77             Is physical:            no
78             Bytes per sector:       512
79             Number of sectors:      2880
80             Media size:             1.4 MiB (1474560 bytes)
81
82     Digest hash information
83             MD5:                    ae1ce8f5ac079d3ee93f97fe3792bda3
84
85

DIAGNOSTICS

87     Errors, verbose and debug output are printed to stderr when verbose out‐
88     put -v is enabled. Verbose and debug output are only printed when enabled
89     at compilation.
90

BUGS

92     Please report bugs of any kind to <joachim.metz@gmail.com> or on the
93     project website: http://code.google.com/p/libewf/
94

AUTHOR

96     These man pages were written by Kees Mastwijk.
97
98     Alterations for distribution have been made by Joachim Metz.
99

101     Copyright 2006-2014, Joachim Metz <joachim.metz@gmail.com>.
102
103     This is free software; see the source for copying conditions. There is NO
104     warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PUR‐
105     POSE.
106

SEE ALSO

108     ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfmount(1),
109     ewfrecover(1), ewfverify(1)
110
111libewf                         January 19, 2014                         libewf
Impressum