ewfinfo(1) - Linux man page

Name

ewfinfo - show meta data stored in EWF files

Synopsis

ewfinfo [-A codepage] [-d date_format] [-ehimvV] ewf_files

Description

ewfinfo is a utility to show meta data stored in EWF files.

ewfinfo is part of the libewf package. libewf is a library to support the Expert Witness Compression Format (EWF). libewf supports both the SMART format (EWF-S01) and the EnCase format (EWF-E01). libewf currently does not support the Logical Volume format (EWF-L01). EWF-X is an expirimental format intended for testing purposes to enhance the EWF format. libewf allows you to read and write media data in the EWF format.

ewf_files the first or the entire set of EWF segment files

The options are as follows:

       -A codepage

the codepage of header section, options: ascii (default), windows-874, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258

-d date_format
the date format, options: ctime (default), dm (day/month), md (month/day), iso8601

-e' only show EWF read error information

-h' shows this help

-i' only show EWF acquiry information

-m' only show EWF media information

-v' verbose output to stderr

-V' print version

Environment

None

Files

None

Examples

# ewfinfo -d dm floppy.E01
ewfinfo 20090427 (libewf 20090427, libuna 20090427, libbfio 20090426, zlib 1.2.3, libcrypto 0.9.8g, libuuid)

Acquiry information
        Case number:            1
        Description:            Floppy
        Examiner name:          John D.
        Evidence number:        1.1
        Notes:                  Just a floppy in my system
        Acquiry date:           09/12/2006 10:00:12
        System date:            09/12/2006 10:00:12
        Operating system used:  Linux
        Software version used:  20061209
        Password:               N/A

EWF information

File format:

EnCase 5

Sectors per chunk:

Error granularity:

Compression type:

no compression

GUID:

869910fc-e143-4908-9328-afedf4a7be1e

Media information
Media type: removable disk

Is physical:

Bytes per sector: 512
Amount of sectors: 2880
Media size: 1.4 MiB (1474560 bytes)

Digest hash information
MD5: ae1ce8f5ac079d3ee93f97fe3792bda3

Diagnostics

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

Bugs

Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website: http://libewf.sourceforge.net/

Author

These man pages were written by Kees Mastwijk.

Alterations for distribution have been made by Joachim Metz.

Copyright

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.