NAME
ewfinfo - show meta data stored in EWF files
SYNOPSIS
ewfinfo [-A codepage] [-d date_format] [-ehimvV] ewf_files
DESCRIPTION
ewfinfo is a utility to show meta data stored in EWF files.
ewfinfo is part of the libewf package. libewf is a library to support
the Expert Witness Compression Format (EWF). libewf supports both the
SMART format (EWF-S01) and the EnCase format (EWF-E01). libewf currently
does not support the Logical Volume format (EWF-L01). EWF-X is an
expirimental format intended for testing purposes to enhance the EWF
format. libewf allows you to read and write media data in the EWF
format.
ewf_files the first or the entire set of EWF segment files
The options are as follows:
-A codepage
the codepage of header section, options: ascii (default),
windows-874, windows-1250, windows-1251, windows-1252,
windows-1253, windows-1254, windows-1255, windows-1256,
windows-1257, windows-1258
-d date_format
the date format, options: ctime (default), dm (day/month), md
(month/day), iso8601
-e only show EWF read error information
-h shows this help
-i only show EWF acquiry information
-m only show EWF media information
-v verbose output to stderr
-V print version
ENVIRONMENT
None
FILES
None
EXAMPLES
# ewfinfo -d dm floppy.E01
ewfinfo 20090427 (libewf 20090427, libuna 20090427, libbfio 20090426, zlib 1.2.3, libcrypto 0.9.8g, libuuid)
Acquiry information
Case number: 1
Description: Floppy
Examiner name: John D.
Evidence number: 1.1
Notes: Just a floppy in my system
Acquiry date: 09/12/2006 10:00:12
System date: 09/12/2006 10:00:12
Operating system used: Linux
Software version used: 20061209
Password: N/A
EWF information
File format: EnCase 5
Sectors per chunk: 64
Error granularity: 64
Compression type: no compression
GUID: 869910fc-e143-4908-9328-afedf4a7be1e
Media information
Media type: removable disk
Is physical: no
Bytes per sector: 512
Amount of sectors: 2880
Media size: 1.4 MiB (1474560 bytes)
Digest hash information
MD5: ae1ce8f5ac079d3ee93f97fe3792bda3
DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose
output -v is enabled. Verbose and debug output are only printed when
enabled at compilation.
BUGS
Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
project website: http://libewf.sourceforge.net/
AUTHOR
These man pages were written by Kees Mastwijk.
Alterations for distribution have been made by Joachim Metz.
COPYRIGHT
Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations
<forensics@hoffmannbv.nl> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
PURPOSE.
SEE ALSO
ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfverify(1)