ewfverify LOCAL ewfverifyNAMEewfverify — verifies media data stored in EWF files
SYNOPSISewfverify [-A codepage] [-d digest_type] [-l log_filename]
[-p process_buffer_size] [-hqvVw] ewf_files
DESCRIPTIONewfverify is a utility to verify media data stored in EWF files.
ewfverify is part of the libewf package. libewf is a library to support
the Expert Witness Compression Format (EWF). libewf supports both the
SMART format (EWF-S01) and the EnCase format (EWF-E01). libewf currently
does not support the Logical Volume format (EWF-L01). EWF-X is an expiri‐
mental format intended for testing purposes to enhance the EWF format.
libewf allows you to read and write media data in the EWF format.
ewf_files the first or the entire set of EWF segment files
The options are as follows:
-A codepage
the codepage of header section, options: ascii (default), win‐
dows-874, windows-1250, windows-1251, windows-1252, windows-1253,
windows-1254, windows-1255, windows-1256, windows-1257, win‐
dows-1258
-d digest_type
calculate additional digest (hash) types besides md5, options:
sha1
-h shows this help
-l log_filename
logs verification errors and the digest (hash) to the log file‐
name
-p process_buffer_size
the process buffer size (default is the chunk size)
-q quiet shows no status information
-v verbose output to stderr
-V print version
-w wipe sectors on CRC error (mimic EnCase like behavior)
ENVIRONMENT
None
FILES
None
EXAMPLES
# ewfverify floppy.E01
ewfverify 20090229 (libewf 20090229, libuna 20090124, zlib 1.2.3, libcrypto 0.9.8g, libuuid)
Verify started at: Sat Feb 28 19:21:51 2009
This could take a while.
Status: at 2%.
verified 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes).
...
Status: at 100%.
verified 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes).
completion in 1 second(s) with 1 MiB/s (1474560 bytes/second).
Verify completed at: Sat Feb 28 19:21:52 2009
Read: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).
MD5 hash stored in file: ae1ce8f5ac079d3ee93f97fe3792bda3
MD5 hash calculated over data: ae1ce8f5ac079d3ee93f97fe3792bda3
ewfverify: SUCCESS
DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose out‐
put -v is enabled. Verbose and debug output are only printed when enabled
at compilation.
BUGS
Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
project website: http://libewf.sourceforge.net/
AUTHOR
These man pages were written by Kees Mastwijk.
Alterations for distribution have been made by Joachim Metz.
COPYRIGHT
Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <foren‐
sics@hoffmannbv.nl> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PUR‐
POSE.
SEE ALSOewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfinfo(1)libewf October 17, 2009 libewf