ewfinfo 							       LOCAL								   ewfinfo

NAME

     ewfinfo -- show meta data stored in EWF files

SYNOPSIS

     ewfinfo [-A codepage] [-d date_format] [-ehimvV] ewf_files

DESCRIPTION

     ewfinfo is a utility to show meta data stored in EWF files.

     ewfinfo is part of the libewf package.  libewf is a library to support the Expert Witness Compression Format (EWF).  libewf supports both the
     SMART format (EWF-S01) and the EnCase format (EWF-E01).  libewf currently does not support the Logical Volume format (EWF-L01). EWF-X is an
     expirimental format intended for testing purposes to enhance the EWF format.  libewf allows you to read and write media data in the EWF for-
     mat.

     ewf_files the first or the entire set of EWF segment files

     The options are as follows:

     -A codepage
	     the codepage of header section, options: ascii (default), windows-874, windows-1250, windows-1251, windows-1252, windows-1253, win-
	     dows-1254, windows-1255, windows-1256, windows-1257, windows-1258

     -d date_format
	     the date format, options: ctime (default), dm (day/month), md (month/day), iso8601

     -e      only show EWF read error information

     -h      shows this help

     -i      only show EWF acquiry information

     -m      only show EWF media information

     -v      verbose output to stderr

     -V      print version

ENVIRONMENT

     None

FILES

     None

EXAMPLES

     # ewfinfo -d dm floppy.E01
     ewfinfo 20090427 (libewf 20090427, libuna 20090427, libbfio 20090426, zlib 1.2.3, libcrypto 0.9.8g, libuuid)

     Acquiry information
	     Case number:	     1
	     Description:	     Floppy
	     Examiner name:	     John D.
	     Evidence number:	     1.1
	     Notes:		     Just a floppy in my system
	     Acquiry date:	     09/12/2006 10:00:12
	     System date:	     09/12/2006 10:00:12
	     Operating system used:  Linux
	     Software version used:  20061209
	     Password:		     N/A

     EWF information
	     File format:	     EnCase 5
	     Sectors per chunk:      64
	     Error granularity:      64
	     Compression type:	     no compression
	     GUID:		     869910fc-e143-4908-9328-afedf4a7be1e

     Media information
	     Media type:	     removable disk
	     Is physical:	     no
	     Bytes per sector:	     512
	     Amount of sectors:      2880
	     Media size:	     1.4 MiB (1474560 bytes)

     Digest hash information
	     MD5:		     ae1ce8f5ac079d3ee93f97fe3792bda3

DIAGNOSTICS

     Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when
     enabled at compilation.

BUGS

     Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website: http://libewf.sourceforge.net/

AUTHOR

     These man pages were written by Kees Mastwijk.

     Alterations for distribution have been made by Joachim Metz.

COPYRIGHT

     Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors.

     This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR
     PURPOSE.

SEE ALSO

     ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfverify(1)

libewf								 October 17, 2009							    libewf