1ewfinfo                              LOCAL                             ewfinfo
2

NAME

4     ewfinfo — show meta data stored in EWF files
5

SYNOPSIS

7     ewfinfo [-d date_format] [-himvV] ewf_files
8

DESCRIPTION

10     ewfinfo is a utility to show meta data stored in EWF files.
11
12     ewfinfo is part of the libewf package.  libewf is a library to support
13     the Expert Witness Compression Format (EWF).  libewf supports both the
14     SMART format (EWF-S01) and the EnCase format (EWF-E01).  libewf currently
15     does not support the Logical Volume format (EWF-L01).  EWF-X is an expir‐
16     imental format intended for testing purposes to enhance the EWF format.
17     libewf allows you to read and write media data in the EWF format.
18
19     ewf_files are the EWF file(s) to read the meta data from.
20
21     The options are as follows:
22
23     -d date_format
24             specify a date format, options: dm (day/month is default), md
25             (month/day), iso8601
26
27     -h      shows this help
28
29     -i      only show EWF acquiry information
30
31     -m      only show EWF media information
32
33     -v      verbose output to stderr
34
35     -V      print version
36

ENVIRONMENT

38     None
39

FILES

41     None
42

EXAMPLES

44     # ewfinfo floppy.E01
45     ewfinfo 20070512 (libewf 20070512, zlib 1.2.3, libcrypto 0.9.8, libuuid)
46
47     Acquiry information
48             Case number:            1
49             Description:            Floppy
50             Examiner name:          John D.
51             Evidence number:        1.1
52             Notes:                  Just a floppy in my system
53             Acquiry date:           09/12/2006 10:00:12
54             System date:            09/12/2006 10:00:12
55             Operating system used:  Linux
56             Software version used:  20061209
57             Password:               N/A
58
59     Media information
60             Media type:             removable disk
61             Media is physical:      no
62             Amount of sectors:      2880
63             Bytes per sector:       512
64             Media size:             1474560
65             Compression type:       best compression
66             GUID:                   c1450a26-2737-eb43-a2c3-448ae3f05a51
67             MD5 hash in file:       ae1ce8f5ac079d3ee93f97fe3792bda3
68

DIAGNOSTICS

70     Errors, verbose and debug output are printed to stderr when verbose out‐
71     put -v is enabled.  Verbose and debug output are only printed when
72     enabled at compilation.
73

BUGS

75     Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
76     project website: https://libewf.uitwisselplatform.nl/
77

AUTHOR

79     These man pages were written by Kees Mastwijk.  Alterations for distribu‐
80     tion have been made by Joachim Metz.
81

83     Copyright 2006-2007 Kees Mastwijk, Hoffmann Investigations <foren‐
84     sics@hoffmannbv.nl> and contributors.  This is free software; see the
85     source for copying conditions. There is NO warranty; not even for MER‐
86     CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
87

SEE ALSO

89     ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfverify(1)
90
91libewf                           May 12, 2007                           libewf
Impressum