Page MenuHomePhabricator
Files F7687409

ChangeLog
No OneTemporary
Actions

Size
102 KB
Referenced Files
None
Subscribers
None

ChangeLog
View Options

Roadmap:
* support missing segment files (chunks)
* multiple platform device handle
* libbfio API extensions (partial)
* low and high level API
- to allow low level access to sections etc. (for recovery)
* lvf support
- add support for interaction with data in ltree section
- use libpff like item approach?
* xsignature section to sign xhash and/or hash
* library/tools enhancements
- getoptlong
* internationalisation
- Unicode support (added)
- locale support (partial)
- multi language string support (gettext)
* enhance thread safety
- protect writing to internal data structures
- protect reading when writing to internal data structures
- thread safe functions
- check for race conditions especially on change of data elements
Further analysis of the EWF format:
* password hash
* volume/disk section (EWF-E01)
- do EnCase 5 or earlier versions support 64-bit amount of sectors?
- unknowns
* hash section (EWF-E01)
- 16 byte unknown
* values in EnCase5/6 header2 (+/-)
* values in ltree strings (EWF-L01 LVF)
* values in session section (+/-)
* amount of sectors in volume/data section has changed to a 64-bit value
but what about error2/sessions ?
* does newer linen6 has sha1 support?
Features
* resume write support for ENCASE1/SMART table sections ?
* support missing segment files (chunks)
* implement low memory usage option
- trade off IO versus memory use
Recovery and analysis:
* imaging: detect disk full and ask for new segment file location?
- have libewf allow to set the segment file path during write (done)
- like alternative segment file path in EnCase
however EnCase seems to fully test if the segment file upfront by
allocating the necessary disk space
* recovering corrupt EWF files (missing segment file, corrupt sections, etc.)
- can the values in data be used to correct a corrupted volume ?
Additional (integrity) checks:
* read: check if successive headers match first header
* read: add check for next and done segment
- really the last segment in the file
- offset pointing at themselves
- correct size
Possible performance improvements:
* create a offset table per segment file
- create it on demand
- map offset table start entry from segment table as a pointer or index number ?
* fill offset table while reading ?
- only read first and last segment file for index build?
- add offsets of other segment files when needed
* tune read and write buffer sizes
- read/write block size seems to have little effect for dd on average
- buffered bfio ?
* reduce alloc, realloc and free (this reduces breaks) use strace to analyze
- pass values as parameters or use of handle
- what allocation causes the break in strace of ewfacquire with compression libewf? zlib?
* optimize empty block test
* optimize string functions
- pass length/size as much as possible
* pass zero byte empty block compressed data cache as a pointer
do not copy data to compressed chunk cache
Error handling/tollerance
* what about a function that translates error into an equivalent errno?
* have wchar error messages for WINAPI?
* improve offset table correction
- if not correctable skip chunk while reading and mark as crc error
or try to determine offset/size of chunk somehow
Python bindings
* rewrite pyewf to match libewf API
- library module functions
- handle object
- keep file object for legacy support ?
* implement error backtrace support in v2 API version
* keep certain Python function names as alias
* use Unicode strings
API changes
* add wide character functions definitions by default?
* libbfio API extension
- add means to set pools open handle limit in libewf (partial completed)
- add means to obtain libbfio handle of media data in ewf
- add means to set narrow string codepage
- export libewf_glob_file_io_handle
refactor glob functions to use libbfio handle input and return libbfio pool?
think about libewf_glob_file_io_handle and abstration of file io handle get/set name
* low level API
- add function to retrieve the segment file names and amount?
- add function to retrieve EWFX xml header/hash directly
* LVF
- libewf_add/remove_file for LVF
* file structure API extension (idea)
device handle
* add Windows support for accessing memory device
* detect removable disk
* detect optical disk
* determine optical disk sessions
* detect floppy
* move fstat to file_io ?
* improve error detection and output (refactor error string like libbfio)
* detect bus type
* determine USB serial number
ewftools:
* add getoptlong support
* log handle
- implement libpff log handle
* make compilation resilient for missing crypto library
- compile on system without libcrypto
- remove the cryptographic options if crypto library is missing
* have failed on open return a more sensible error (extract from error)
* ewfacquire
- restrict error granularity and amount per sectors to > encase5 and > linen5 format ?
no, although not set in EWF file, the granualarity is still used in handling read errors
- warn if values exceed maximum segment count
- adjust error granularity if error granularity < process buffer size
- move ewfacquire_read_buffer to device_handle, list read errors
- warn if media does not fit using chunk size or APIv1
a (32-bit) chunks size of ( 64 * 512 ) will allow up to 128 TiB
- for EnCase 6 format request serial number and model if not set ?
* ewfacquirestream
- what about wipe on error - does this do anything? (remove if not used)
- add parameter to set sector size?
- allow user to set bytes per sector for raw file conversion
* stream handle
- implement
* ewfalter
- allow to set maximum delta file size default 4 GiB?
* ewfexport
- implement more ewfacquire acquiry parameters?
- handle different input and ouput chunk sizes in low level functions build
- allow different input and output header codepages?
- handle ewf/raw like in smioexport
- creates write only raw export file with msvscpp compilation
* ewfdebug
- create a tool to analyse a single segment file
- implement low and high level api separation
* ewfrecover
- create a tool recover ewf files
Windows build
* windows port
- some of the Windows functions are MVC 2005 or later specific
- figure out a way to warn about the compiler used
* add WIN32_LEAN_AND_MEAN or VC_EXTRALEAN to msvscpp
* locale support
- print output convert to system string
- reduce string conversions, use as much as possible the system string type in the tools
* ewftools check char/wchar in/output
Testing
* add export unattended to automated tests
* add encase 6.12 sha1 support to test
Deployment
* debian package
- implement non local libuna and libbfio support like in spec file
* configure
- remove enable-v1-api after testing?
Known issues:
* error acquiring USB floppy with bad blocks under FreeBSD - no problem with internal floppy drive
virtualisation could be part of the problem
* check chunk size for > 2 GiB table offsets
the current assumption is that these chunks only can be uncompressed
because the MSB is normally used to mark if the chunk is compressed
This actually is a bug in EnCase 6.7.1 the behavior is gone in EnCase 6.8
* MS Visual Studio C++ does not allow pre compiler macro in macro definitions
Work in progress:
* check sprintf use
- liberror -> liberror_error_vsnprintf
- libewf -> libewf_hash_values, libewf_header_values
- ewftools -> byte_size_string, guid
* what about header values parsing with preservation of timestamps?
- change localtime to gmtime in libewf_date_time_values_copy_to_string ?
- force set header value to require string formatted in the date format ?
* check TODO
* ewfexport: fix different input and output chunk sizes for low level functions
* test: read/write of EnCase 6.12 SHA1
Beta after next stable release
* remove DISABLED in ewfexport
* move manuals/ewfexport.1.backup to manuals/ewfexport.1
* check into resume write error for 32-bit compile
* check make distclean
20100226
* fix for ewfacquire the -g and -b options got swapped
20100126
* worked on solution for Debian 4.0 posix_fadvise break
20100119
* re-applied 20091224 fixes
* correction of return value of several ree functions
* applied multi header patch
20100110
* fixed ewfacquire manpage
* removed use of base offset for linen6 format
* worked fix for restriction on large segment file and chunk
* made ewfacquire more tollerant for missing device information
* added digest section support for linen6 format
20091114
* moved codepage definitions to libewf_codepage.h
* updated libbfio
* updated MacOS-X package project file
* removed ewfalter and ewfdebug from stable
20091109
* fix for borland c compilation
* update to MSVSCPP project files
20091108
* fix for MSVSCPP compilation
* fixed incorrect return value in libsystem_glob
* fix for print of program name
20091031
* fix for local use of libewf
20091030
* changed endian.h into byte_stream.h
* updated libuna, libbfio
* updated behavior of unmanaged file io handle
20091024
* add falign in device handle, small performance improvement
20091020
* fixed overflow of chunks_section_number in write io handle
20091018
* worked on aligned empty block test
* fixed error in help output of ewfacquirestream
* fixed error in ewfacquirestream regarding missing strings
* worked on cached zero byte emtpy block based on idea by Bas Kloet
20091017
* preperation for stable release
* removed All rights reserved because it has no additional legal value what so ever
20091003
* several fixes for Debian integration based on patches by Cristian Greco
* corrected license in list and array type and several of the pfftool handles
* updated libuna, libbfio
* updated several manpages
* changes to autoconf/make scripts to not link libcrypto and libuuid to libewf
* renamed debian to dpkg
* remove ZLIB_WINAPI from msvscpp configuration
* several fixes to configure scripts
20091001
* small changes in common
* made libewf a little more tollerant in allowing the data section not
to contain values, the values must be 0 otherwise libewf still enforces
validity checks
20090929
* worked on CodeGear project files
- disabled creation of pre compiled headers
20090928
* small changes
20090927
* worked on secondary image output
* added open resume signal handling in ewfacquire
* worked on CodeGear project files
* several minor fixes
* updated libbfio for fix of CodeGear _sopen issue
which results in files being created using libbfio_file_exists check
* ewfacquire now provides default media type based on device information
* updated list type
20090926
* worked on initialization issue
- set sectors per chunk is now read protected
- fixed bug in legacy wrapper set bytes per sector
* small fix in verbose output
* worked on secondary image output
* small cross platform fixes in ewfacquire and ewfacquirestream
* moved session handling from imaging handle to ewfacquire
20090911
* updated libsystem
20090905
* updated ewfinput codepage detection with libuna version
20090904
* updated codpage definitions
20090901
* worked on Borland C++ compiler support
* updated common/file_stream.h
20090829
* updated msvscpp libbfio project
20090828
* updated libuna, libbfio
* the parsing of the header and hash values is now handled by the library
the corresponding parse functions were removed from API v2
* all header and hash sections are now parsed for additional values
* updated libbfio detection
* worked on libbfio API extensions
20090824
* adjustments in ewftools io access
20090823
* minor adjustments
20090822
* updated common: narrow_string, memory
* updated libnotify
* bug fix in libewf_values_table
20090821
* small adjustments
* fixed handling 0 entries in libewf_values_table_initialize
20090820
* worked msvscpp solution files
* worked codegear project files
* small corrections in include/libewf/types.h.in
* fixed libsystem_file_io open mode
20090819
* updated libbfio
* updated libsystem_file
* moved libuna include from ewftools to libsystem
* fixed some small memory leaks in ewftools
* moved ewfsignal to libsystem_signal
20090817
* worked on common system library for ewftools
* updated msvscpp solution files
* updated libewf_date_time
* updated include/libewf/codepage.h
* updated libbfio
20090816
* worked on common system library for ewftools
20090815
* worked on common system library for ewftools
* rewrote ewftools date and time functions
* rewrote ewftools error string functions
* refactored ewftools to work with libsystem
20090811
* worked on Borland C++ Builder compiler support
* updated libbfio, liberror and libuna
* added m4 directory support to autoconf/make files for libtool
* updated list type
* fixed define error in libewf_libuna.h and libewf_libbfio.h
* updated libewf_notify
* updated ewftools: date_time, file_io, file_stream_io, glob
20090629
* worked on implementing Borland compiler patches
* updated msvscpp for libnotify
20090628
* updated libbfio
* updated liberror
* updated libnotify
* fixed Windows 64-bit ssize_t definition issue (pointerd out by Xavier Roche)
* worked on implementing Borland compiler patches by Peter Van Hove of IsoBuster
- added liberror sprint functions
20090624
* updated libbfio
* added allow shared read to device handle CreateFile
* fixed double string conversion in device handle for WINAPI build
* removed system string trim copy function
* added debug output to libewf_sessions
* added support for handling empty last session
* added libnotify
20090614
* small fix in libewf_glob_free
* worked on stable testing
20090609
* added libewf_glob_free to v2 API
* disabled chunk size option in ewfexport
20090606
* fixed missing code for correctly handling acquiry and system date header
values (Thanks to David Loveall)
* started working on improved version of pyewf
* fixed error in info_handle
* fixed issue regarding date time string must required to be at least 32 bytes
should be at least 20 or 25
20090528
* fixed error in marco libewf_get_header_value_case_number (thanks to Guy Voncken)
* updated libbfio, implemented support for track changes function
* implemented generation of common/types.h by autoconf
20090512
* updated liberror, libuna and libbfio
* worked fix for ewfexport for different input and output chunk sizes for low level functions
* checked use of uninitialized ->chunk_size ini ewftools handles
* fixed error in ewfacquire for write resume with low level functions
* fixed error in prepare write chunk for resume write
20090511
* bug fix in ewfacquire error handling code
* commented out some unused code
* bug fix in libewf handle open regarding base name
20090510
* updated libbfio
* added libewf_get_flags_write_resume
* fixed small memory leak in verification and export handles
20090509
* worked on support for missing segment files (chunks)
* applied patch by aozsyn for compilation errors of API v1 with low level functions and
python bindings
* corrected pyewf compiler warnings
* worked on detecting device removal, write finalize no longer closes segment
files if the media size was known and not entirely written
* ewfacquire now adds model and serial to header values
* ewfacquirestream implemented -B as write size upper boundary
* ewfacquirestream implemented -o as skip of an amount of bytes
* ewfacquire: added support for acquiry resume offset alignment, for non block boundary offsets
* fixed crc buffer alignment error in write
* removed get version and flags for local usage of libewf
* fixed pyewf API v2 support
* fixed small memory leak in ewfinfo
20090506
* fixed unsupported codepage 0 on NetBSD, system string too strict
20090504
* fixed error in device read error handling
* added Darwin uuid/uuid.h support
* removed check for caseless string compare from configure
* added error to file_io updated system string accordingly
* added 32-bit amount of sectors for MacOS-X
* refactored guid generate from ewfcommon to guid
* fixes for winapi
* added Cygwin uuid/uuid.h support
* changed ewftools dll import for Cygwin
* added libewf_is_dll to libewf.c, this function is not exported
20090503
* worked on usb disk support
* limited EWF/ENCASE1/SMART format to max 2 TiB acquire size
* encase6 format is now default
* library and tools pass automated tests
* fixed error in device handle seek offset not correctly returning the current offset
* fixed error in device read error handling
20090502
* worked on bus type support
* worked on optical disk support
* worked on usb disk support
* worked on Tableau support
20090501
* implemented 64-bit sector support for add crc and acquiry error and sessions in APIv2
* worked on refactoring volume type into media flags in ewftools
* added set media flags function to APIv1
20090429
* update for new findings regarding volume/data section
* changed APIv2 function handle_get_amount_of_sectors to have a 64-bit parameter
instead of 32-bit
* worked on EnCase Fastbloc write blocker support
20090427
* updated libuna
* worked on EnCase 6.13 Tableau write blocker support
* remove volume type functions/definitions in APIv2 and changed it to media flags
20090426
* worked on device information
* updated libbfio
20090425
* worked on libbfio exists handle function update
* updated libbfio
* worked on GUID support for windows build
* extents header value is now formatted in more table like manner
* fixed hash value identifier size issue in info and verification handle
* rename libewf_format to ewf_format in ewftools
* worked on device information
20090424
* updated libbfio - exist handle function update
20090422
* updated configure.ac
* worked on local use support
* implement codepage header file like in libpff
* moved typedef from handle.h to type.h include header file
* worked on automatic testing of write resume
20090421
* fixes for MSVSCPP build
* moved segment file size from write io handle to segment table
* segment file size is now set on read
20090420
* moved write finalize function to write io handle
* refactored sections correction out of write finalize function into separate functions
* removed \n from error strings in libewf and ewftools
* moved write initialize and resume functions to write io handle
* refactored chunk offset correction for last filled/compared offset
20090419
* worked on date and time strings
* changed crc_buffer from uint8_t * to void *
* libewf now tracks if pool was created inside library
* worked on acquiry resume
* updated libbfio
* added get segment file size functions to API
20090418
* changes for local use of libewf in libsmio
* updated process_status to use liberror
* worked on glob to use liberror
* updated libuna
* worked on adding set_header_codepage to ewftools
* worked on error tollerance
* worked on preservation of timestamps in header values
* fixed error in libewf_set_header_codepage
* EWFX date values now contain +/- UTC/GMT difference
20090415
* fixed == in configure.ac
20090414
* added to do to ewfexport
20090412
* refactored order of functions handles: open, close, read, write, seek
* corrected LIBEWF_DLL_EXPORT in ewftools to LIBEWF_DLL_IMPORT
* worked on imaging handle and ewfacquire
* fixed double free in verification and export handle
* updated libbfio
20090411
* fixed misplaces #endif in libewf header file
* fixed smart string length in ewfinput
* changed compress empty block into compression flags in ewftools
20090410
* small adjustments
20090405
* small adjustments
20090404
* implemented chunk and crc buffer alignment
* fixed crc mismatch in read delta chunk
* added support for delta chunks in libewf_handle_prepare_write_chunk
* added chunk size restriction in libewf_write_io_handle_write_existing_chunk
* updated libbfio
* added APIv2 function to retrieve current segment filename
* refactored file_io out of device_handle
* ewfexport, ewfverify now show which files contain CRC errors when compiled with APIv2 support
* worked on header codepage support in ewftools
20090403
* added configure option for static executables
* change raw-access configure option to low-level-functions
* fixed on raw access in ewfalter
* fixed read/write write beyond file size corruption
20090402
* Worked on pyewf
* Removed EWFCOMMON_BUFFER_SIZE from tests
20090401
* Fixed some small errors in API version 1 legacy support
* changed compress_emtpy_block into a compression flag
* changed empty block compression behavior for all compression levels
* add whence SEEK_SET, SEEK_END with 0 offset support to seek_offset
* refactored libewf_write to libewf_write_io_handle
* added support for Cygwin US-ASCII character set to system string
20090330
* Updated caseless compare functions with WINAPI support
20090329
* removed libbfio_file_io.[ch]
* worked on adding system error string support to libbfio error messages
* fixed multiple errors
* cleaned end of lines in error in libbfio
* worked on Windows PhysicalDrive device access
20090328
* updated narrow and wide string definitions
* removed HAVE_WIDE_CHARACTER_SUPPORT_FUNCTIONS
* change LIBBFIO_WIDE_SYSTEM_CHARACTER_TYPE into LIBBFIO_WIDE_SYSTEM_CHARACTER_T
and implemented WINAPI UNICODE system string detection
* worked on removing libbfio_file_io.[ch]
20090326
* updated type.h with corrected printf format specifiers for Windows
20090325
* updated windows config
20090324
* worked on native WINAPI file access in libbfio and device_handle
* fixed SetFilePointerEx offset correction for SEEK_CUR
20090323
* updated make dist for missing libbfio msvscpp files
* fixes for msvscpp build
* updated config_windows.h
* worked on native WINAPI file access in libbfio and device_handle
20090316
* worked on refactorin libewf_write
20090315
* worked on implementig v2 api in ewftools
* moved fgets to file stream IO
* renamed v2 api raw read/write functions
* refactored libewf_read into libewf_handle and libewf_read_io_handle
* refactored libewf_write into libewf_handle and libewf_write_io_handle
* worked on libewf_handle_open_pool
* removed libewf_internal_handle_create_header_values, default header values are now empty
20090314
* added verion 1 api disable functionality to configure.ac for testing purposes
* worked on signal handler for ewftools handles
20090313
* worked on unifying header/hash value functions ini the ewftools
* worked on alteration handle
20090312
* added support for separate libbfio
* updated glob.[ch]
20090310
* added segment file name size functions
* changed program to system string
20090309
* added values table get identifier and value size functions
20090308
* worked on libbfio support
- created libbfio_pool
- refactor libbfio_handle initialization out of libbfio_pool
- implemented SEEK_END in libbfio_file and libbfio_handle
* implemented libbfio_pool in libewf
* worked on v2 api
* changed libewf_character_t into uint8_t in libewf_values_table
* implemented libbfio_file_exists
20090307
* worked on libbfio support
* worked on v2 api
20090304
* worked on v2 api
20090303
* worked on raw access in verification handle
* worked on raw access in export handle
20090302
* worked on raw access in export handle
* updated manuals
20090301
* fixed regarding additional space in date value in libewf_convert_date_xheader_value
* worked on export handle
* fixed empty chunk issue in libewf_read_process_chunk_data
* worked on info handle
* fixed offset correction error in libewf_file_io_handle_seek_offset
* fixed memory leak in libewf_open introduced by legacy change
* removed ewflibewf
* fixed wide character type support compilation
20090228
* worked on simplifying read input function for ewfacquire(stream)
* worked on device handle - moved device code in ewfacquire to device handle
* added support for missing units in byte size string (defaults to mebibytes)
* fixed byte size string increment for no factor definition
* ewfacquire added -P option to set bytes per sector
* updated manuals
* added support for optical disk and memory media type in ewfacquire(stream)
* if removable or optical media type are chosen ewfacquire now defaults volume type to logical
* worked on info handle
* worked on export handle
20090227
* worked on imaging handle - refactored read input function
* worked on simplifying read input function for ewfacquire(stream)
* fixed missing verbose output
* worked on detection of sector size
20090225
* worked on imaging handle raw access support
* worked on v2 api
* fixed delcaration error in libewf_error.h
* moved error functions to libewf_error.c
* moved remaining function in libewf_file to libewf_support
* removed libewf_file
* added description of functionality of tools in usage information
* renamed libewf_interface into libewf_metadata
* implemented imaging handle in ewfacquirestream
20090224
* worked on imaging handle
* worked on v2 api
* MD5 and SHA1 digest are now set by libewf_set_hash_value function
20090223
* worked on imaging handle
20090222
* worked on locale support
* worked on imaging handle
* worked on v2 api
20090219
* fixed rogue free of filenames in verification handle in amount_of_files check
* fixed v2 api support in verification_handle_open
20090209
* worked on support for EnCase 6.12 SHA1 hash
* fixed error in unknown section debug output
* added support for process identifier and extents header2 values
* fixed NULL free in ewfverify
20090125
* worked on ewfverify and verification handle
* fixed missing libewf memwatch flags
20090124
* fixed missing quoted in configure.ac
20090118
* Updated headers
* Updated configure.ac to conform to cache value naming schema
* Updated autoconf/make to use flags and library definitions
* Fixed missing notify_dump_data in for debug output
* debug output is only provided on verbose output
* worked on ewfverify and verification handle
* Merged changes for EnCase 6.11 winen file format and memory image from 20080609 beta branch
* Removed byte swap from ewfverify not needed
20081207
* fix for printing GUID
20081019
* Updated liberror
* Added splint make option
* Worked on verification handle
20081018
* Minor adjustments
* Updated liberror_definitions with encryption error definitions
20081015
* Minor adjustments
20081013
* Fixed APIv2 of libewf_check_file_signature
20081012
* Worked on UTF character suppport
20081011
* changed ewfguid into guid
* removed string duplicate functions
* Worked on MSVSCPP build
* Worked on UTF character suppport
20081007
* small adjustments to support
20081005
* small adjustments to file io
20080928
* worked on making ewftools code more gereneric
* worked on making UTF-8 strings for internal use (not for filenames)
20080927
* small adjustment in makefiles
20080922
* fixed typo in definitions and internal definitions
20080921
* updated libuna
* updated configure and Makefiles
* implemented liberror
* renamed doc into documents
* removed date_time and notify from common
* changed HAVE_WINDOWS_API into WINAPI
20080917
* Small change in configure.ac
20080916
* Fixed issue in error
* Updated libuna
20080915
* worked on experimental version 2 API currently requires additional configure flag
- made libewf_handle_initialize and libewf_handle_free available
- rewrote open and close in correspondence with handle_initialize and handle_free
20080914
* worked on separation of narrow and wide character string functions
20080913
* worked on separation of narrow and wide character string functions
20080912
* worked on improved error handling
* removed error tollerance setting the code will be error tollerant if it is
able to compensate or certain a value is valid
* fixed issue regarding write finalize did not set data sections correctly
for streamed writes due to data section cache
* changed chunk offset compressed value to flags to also contain corrupted
* worked on improved method of handling corrupted offset tables
20080911
* worked on improved error handling
20080910
* worked on libuna
* worked on improved error handling
* implemted new version of notify dump data
* fixed check of libewf_string_snprintf should also check for > size
* removed explicit set end of string after snprintf
* worked on clean up of common
20080909
* replaced libuca with libuna
* worked on improved error handling based on libuna version
20080908
* minor changes to configure.ac
20080907
* worked on refactoring functions in ewfinput, too large input is now flushed
* refactored ewfcommon_determine_operating_system
* ewftools: added process buffer size option
- this allows performance testing using different buffer sizes
* ewftools: added missing in usage information
* ewfexport: added -l option
* ewfexport: added calculation of MD5 adn SHA1 hash of exported data
* ewfexport: fixed bug exporting with SHA1 hash
* ewftools: updated manuals
* ewfacquirestream: fixed issue not being able to terminate by CTRL+C due to
block by reading from stding - stdin is now forced to close in the signal handler
* file io pool now allows to be initialize with 0 file io handles
* fixed memory leak due to section list rewrite
* ewfacquire: worked on non interactive mode
* fixed error in byte size calculation for values with 2 digits after the separator
* added acquire unattended to automated tests (separate test cycle)
* added export sha1 to automated tests (part of alter test cycle)
* fixed issue where last segment file contained next section when acquired
with ewfacquirestream
* ewfverify: print additional available hashes
20080906
* refactored section list to use list type
* refactored libewf_values_table
* parse hash values will now handle MD5 hash to MD5 hash value conversion
* get MD5 hash will now handle MD5 hash value to MD5 hash conversion
* set MD5 hash will now handle MD5 hash to MD5 hash value conversion
* get MD5 hash value will now handle MD5 hash to MD5 hash value conversion
* set MD5 hash value will now handle MD5 hash value to MD5 hash conversion
20080905
* worked on refactoring code
* rewrote _alloc() functions into _initialize() functions with corresponding _free() functions
* worked on file io pooling
* improved way to determine if a segment file has been closed after write
20080904
* worked on refactoring functions in ewfinput
* combined empty block compression and other compressions in ewftools
* change empty_block to empty-block the former remains to work
* fixed error in UTF-8 handling (libuca)
* updated MacOS-X package changed project website
* updated MSVSCPP project files
* fixed multiple ewfglob issues
* removed secondary offset table from handle
libewf now checks and corrects differences with primary offset table
* integrated check for ctime in autoconf CTIME check
* created libewf_handle_initialize and libewf_handle_free functions
not available for api yet
20080903
* worked on integrating libuca and replacing string conversion routines
* fixed missing split lines issue in libewf_header_values_parse_header_string
* fixed underflow issue in libewf_string_split
20080902
* refactored process status
* code clean up in ewftools
* implemented ewfguid
* refactored character string split to return int
* changed project website
* worked on integrating libuca and replacing string conversion routines
* removed ewf_char.h and ewf_string.h
20080901
* refactored ewfglob
20080831
* added libewf_extern.h
* Improved configure.ac
20080830
* removed errno.h include from ewftools where not used
* Improved common and configure.ac
* Renamed _char_t functions to _system_character functions in ewftools
20080821
* ewfalter now support single segment file as argument
20080820
* ewfverify, ewfinfo and ewfexport now support single segment file as argument
* fixed bug in libewf_glob function in automatic detection of ewf type
20080810
* fixes to the python bindings based on patch by David Collett
20080809
* Synchronised branches
* Fixed seek end of file based on patch by David Collett
* Fixed return at wrong location in libewf_date_time_gmtime
* Implemented libewf_get_offset API function
* relicensed to LGPL
* implement features.h
* updated common with libpff 20080808 version
* changed libewf_notify_set_values in libewf_file.c to notify_set_values
* implemented python bindings based on patch by David Collett
20080705
* added ewfouput_error_fprint
20080704
* added fopen and fclose to configure
20080511
* minor changes
20080505
* Consistency update in API for get and set media and volume type functions
* Updated configure.ac
20080501
* Fixed the package config file (.pc) (Nicolas (kwizart))
* Fixed the debian package files (Guy Voncke)n
* Fixed minor issue in the manual (Guy Vonckens)
* Fixed make lib (Christophe Grenier)
20080430
* Fixed in configuration for MSVCPP wide character compilation
* Fixed small memory leak
20080426
* Minor changes
20080416
* Minor changes
20080412
* Fixed issue (introduced by RW fixes) in libewf_glob
* Uncommented dh_makeshlibs in debian/rules
20080405
* Moved basename from segment table entry 0 to segment table
* The segment filename can now be overwritten during acquiry this allows
alternative segment filename paths
* updated manuals
* improved ewfalter test scenarios
20080403
* Fixed macosx installation path
20080330
* Fixed multiple bugs in read write mode, delta files were initiallity opened without read access
* Worked on ewfalter to handle more complex RW scenarios
* Changed libewf_read_chunk_data no longer to copy to buffer if buffer is the chunk cache data
* Fixed unnecessary reopen of delta segement file in libewf_segment_table_create_segment_file
20080329
* Fixed wrong license in MacOS-X package
20080323
* Moved functions in libewf_file to libewf_interface and libewf_support
* Renamed libewf_internal_handle to libewf_handle
20080322
* implemented endian conversion macros
* fixed minor issue in libewf_debug_header_print
20080320
* performance testing
* fix for %jd and %zd detection for gcc-2.95 on Debian 3.1
* fix for openssl evp and gcc-2.95 on Debian 3.1
* fixed sha.h detection error in autoconf/make scripts
* updated manuals
* fix for %jd and %zd detection for OpenBSD
because gcc throws a warning if %jd has no parameter but fails to print the parameter
* implement usage of LIBEWF_WIDE_CHARACTER_TYPE instead of HAVE_WIDE_CHARACTER_TYPE in header and source files
except in common code
20080319
* refactored test write functions
* refactored the conversion from offset table to table offsets from section to
segment file this reduces multiple unnecessary conversion
20080318
* removed overflow from write - this seems to be a bug in EnCase 6.7.1
behavior is no longer present in EnCase 6.8, read still support overflow
this will allow to convert faulty EnCase 6.7.1 EWF files
20080317
* fixed typo in configure.ac
* libewf EnCase 6 >2GB segment files not compatible with EnCase 6.8
offset table overflow is no longer written by libewf
* added LIBEWF_CD_SUPPORT for testing purposes
- no way to detect amount of sessions yet, will default to 1 section with
start sector 1
* changed trailing bytes warning into verbose print
20080315
* corrected dist clean in Makefile.am
* corrections for MSVCPP project
* fixed binary stdout for WINDOWS version of ewfexport
* fixed binary stdin for WINDOWS version of ewfacquirestream
20080314
* Fix for verbose output
20080313
* tested session section R/W functionality
* made package ready for stable test
20080312
* Code clean up
* ewftools implicitly link libcommon
* fixed memory leak in header values for export to ewf
20080309
* Code clean up
* fixed ewfcommon_determine_operating_system
* fixed overflow on compression read error, buffer is no longer passed for
compressed chunks
* fixed raw access parameter mix up
20080308
* Code clean up
* worked on seperating common code
* fixed issue with byte size string and more than 1 digit after the seperator
will now handle 2 digits and skip remaining
* fixed issue with minimum segement file size in ewf tools also lowered values to 1.0 MiB
* implemented determining session size
* fixed MSVCPP project
* fiexde signal handling for Windows
20080306
* Code clean up
* worked on seperating common code
20080305
* Code clean up
* worked on signal handling
* fixed issues with date string in header
* fixes for missing printf "%jd" and "%zd" under Cygwin and WIN32
* worked on seperating common code
20080304
* Code clean up
* worked on signal handling
* fixed error due to fclose( NULL ) in ewftools
20080303
* Code clean up
* added byte size string to ewfinfo
* updated manuals of ewfinfo
* worked on signal handling
20080302
* Code clean up
* worked on session support
* ewfinfo will now output session information if present part of media information
* worked on byte size string
* added byte size string to ewfacquire, ewfacquirestream and ewfexport
segment file size, not to acquiry size due to possible rounding errors
* updated manuals of ewfacquire, ewfacquirestream and ewfexport
20080301
* Code clean up
* Refactored hash and header value functions
* fixed writing incorrect linen6 header
20080229
* Code clean up
* safe guarded libewf set functions for read/write
* made header parse more fault tollerant
* rewrote UTF16 conversion routine also handle wide character strings
solves issues with mbsrtowcs (handling characters like back space)
20080228
* Worked on not finalizing on error
* Refactored libewf_header_values_parse_header and libewf_header_values_parse_header2
* Removed dirty value from offset table entry, reduces memory usage
* worked on export to EWF
* worked on handling not empty chunk cache in write existing data
data in chunck cache is ignored for now, write existing is not called
without a read handle
* fixed logical error in write existing data
20080227
* refactored ewfdigest_hash
* changed LIBEWF_VERSION into LIBEWF_VERSION_STRING and added numeric LIBEWF_VERSION
* added LIBEWF_WIDE_CHARACTER_TYPE definition
* Worked on not finalizing on error
* Code clean up
20080225
* Worked on not finalizing on error
20080224
* Added error output to the log
* refactored ewfinfo
20080223
* worked on logging of digest hashes to log file
* refactored ewfacquire, ewfacquirestream, ewfexport, ewfverify
* updated manuals
* moved libewf_internal_handle_determine_format to header_sections
20080221
* fixed logical error in libewf_write_test_chunks_section_full
changed section_amount_of_chunks > maximum_section_amount_of_chunks to >=
solves >16375 chunks offset table issue
20080220
* Worked on refactoring chunk dirty to segment file type
20080219
* removed corruption detection test in libewf_segment_file_write_chunks_data
no longer needed
* code cleanup
* refactored use internal handle in libewf_write
20080217
* added corruption detection test in libewf_segment_file_write_chunks_data
needed for test
20080214
* worked on abort
* worked on low memory usage
* code cleanup
* removed libewf_filename_get and libewf_filename_set
20080212
* fixed ewfverify the EWF file can be verified without the integrity hash
as pointed out by David Loveall
* fixed incorrect default segment file size in ewfacquirestream
as pointed out by Dennis Schreiber
* fixed missing ewfinfo -e option
20080202
* code cleanup
20080129
* small adjustment in libewf_get_format function
20080127
* corrected comment in libewf.h.in
20080126
* code clean up
* implemented libewf_glob function
* worked on signal abort function
* fixed incorrect return value in raw read
20080119
* worked on basic multi threaded safety
20080115
* worked on refactoring write initialize
* added initialize function for format specific write values
* added initialize function for media values specific write values
20080114
* removed initialize write in libewf_raw_write_prepare_buffer
messes up multi threaded compression aproach
* removed write initialize from libewf_get_chunk_size
chunk_size is calculated on set of sectors_per_chunk and bytes_per_sector
* removed libewf_internal_handle_read_initialize
* worked on refactoring write initialize
20080112
* removed errno from library
* fixed error regarding hours in ewfoutput_timestamp_fprint
20080107
* added more verbose output for raw write
* added check for read sub handle in libewf_write_buffer and
libewf_raw_write_buffer
20080106
* worked on removing type definition
20080105
* Used memwatch to analyze allocation issues
* Fixed memory leakage due to insufficient error clean up in
libewf_segment_table_read_open
* ewfacquire user input now defaults on error instead of bailing out
20080103
* Used memwatch to analyze allocation issues
* Fixed memory leakage in values list and in internal handle with
sector table
* Fixed missing libewf_common_alloc in ewfalter
* Added NULL pointer free protection against non NULL protected
libewf_common_free replacements
20080102
* Updated package config file
20071230
* adjustments to summary message to configure.ac
* worked on MacOS-X package
20071229
* added summary message to configure.ac
* small changed to debian package files and Makefile.am
20071228
* removed libewf_error_sector_table.h
* type definition consistency changes in read input function in ewftools
* updated year in copyright
* changed LIBEWF_SECTOR_TABLE to libewf_sector_table_t
* changed LIBEWF_CHAR and EWF_CHAR into libewf_char_t and ewf_char_t
* changed EWF_SESSION and EWF_SESSION_ENTRY to ewf_session_t and ewf_session_entry_t
20071227
* moved hash string length from libewf definitions to ewfstring
20071222
* changed CDROM media type into CD media type
20071209
* minor changes to debian package files
* fixes for the MS Visual C++ build
* added ewfalter to MSVCpp build
20071208
* pkgconfig added to spec file
20071205
* minor change in defaults
20071201
* worked on refactoring code
* API changes to get and set functions
20071130
* worked on refactoring code
20071129
* worked on refactoring code
* fixed error in delta chunk size
20071128
* worked on refactoring code
20071126
* minor changes
20071124
* worked on refactoring code
* made buffer passthrough default behavior
* ewfexport added sha1 calculation support
* fixed error writing segment files > 2 Gib
* reduced multiple successive crc error entries to a single
* reduced multiple successive acquiry error (error2) entries to a single
* ewfcommon_export_ewf added raw access write support
* change string to (u)int64 conversion routines to use long long equivalents
* ewfacquirestream and ewfexport added > 2 GiB segment file support
* libewf_filename_create now takes string and length as parameters
* ewfalter added functionality to set delta segment file path/basename
20071123
* worked on refactoring code
* moved libewf_offset_table_compare after the full index build
in libewf_segment_file_read_open
* added chunk size to delta chunk for redundancy
* removed internal handle from most functions in section
* ewfexport added argument set detection for interactive mode
* section read count is returned instead of section size when possible
* fixed win32 support solution file and ewfglob
* added section type length to section list entry
* added length filename in segment file struct
* fixed error in error2 section regarding debug
* worked on session section
* added CD-ROM media type
20071121
* worked on refactoring code
* libewf no longer allows to raw read/write a chunk of 0 bytes
20071120
* worked on refactoring code
20071119
* worked on refactoring to use segment file struct in section
* changed stored delta segment number to 1 ... x count instead of 0 ... x count
20071118
* refactored segment table to a table of segment file **
* refactored offset table chunk offset segment_number and file_descriptor to reference of segment file
* worked on refactoring to use segment file struct in section
20071117
* changed MB to MiB, etc.
* worked on refactoring offset table to table of chunk offsets
* worked on IO pool
* removed common alloc/realloc cleared functions
* libewf_segment_file_write_open is now used by libewf_open
* removed libewf_offset_table_set_values
* implemented libewf_filename to reduce code duplication for wide character type
* worked on refactoring the offset table to use the segment file struct
20071114
* worked on refactoring segment files functions
20071113
* worked on refactoring segment table to table of segment files
* fixed error in libewf_raw_read_chunk regarding use of the right segment table
* worked on refactoring offset table to table of chunnk offsets
20071112
* change default segment file size to 1500 MB (^10)
about 1400 MB in (^2), 3x segment files should fit on a DVD
* worked on refactoring segment table to table of segment files
* removed segment number in table check from libewf_segment_file_read_sections()
20071111
* changed default wipe behavior for ewfacquire(stream)
default behavior is that only remainder of the chunk is wiped instead of the entire chunk
* Updated manual pages
20071110
* updated MSVSC++ project files
* commented out io pool
* automated delta file testing
* added libewf_convert_date_xheader_value
* added ctime date format to ewfinfo which is now default
refactored header values dat conversion functions
* ewfacquire wipes remainder of chunk on acquiry error if wipe chunk is not set
* fixed error in reading error2 section
20071107
* worked on delta file
20071106
* worked on delta file
delta chunk header data is now 'protected' by a CRC
* ewfacquire(stream) added check if last segment file is closed
before telling acquiry was completed, by moving close
handle before complete notification
20071105
* refactored raw access support in ewfexport
20071104
* refactored write functions
* refactored read functions
* worked on raw access support for ewfexport
* small fixes in ewfexport
* fixed write of duplicate table(s) in finalize, introduced by MD5 move
* checked usage of stderr and stdout in ewfexport
* worked on raw access support in ewfexport
20071103
* refactored write functions
20071030
* fixed input handling of format in ewfexport wide string support
* fixed handling problems with raw read and size returned
20071028
* fixed error in write finalize for ewfacquirestream, due to restrictive check
* fixed error for handling wide character delta segment filenames
* worked on read wipe chunk on error
* fixed miscalculation for CRC error in last chunk in read
* added function to API to add CRC errors
* fixed wrong function calls in ewfoutput_crc_errors_fprint
20071027
* Worked on cleaning up ewf struct read and write functions
* Cleanup of set/get functions in internal handle
* Added libewf_get_amount_of_acquiry_errors
* Wrote API functions to rid ewfcommon of internal_handle for acquiry and
CRC errors, header and hash values
* Moved duplicate code for handling header and hash values into libewf_values_table
* Removed internal_handle from ewftools
* ewftools no longer create human readable byte string if size <= 1024
* changed int8_t return values into int return values
* changed libewf_get and libewf_set functions for API consistency
* moved several get and set functions from internal handle to file
* fixed error in windows retrieving digest hashes
20071016
* Worked on cleaning up ewf struct read and write functions
20071015
* Worked on file io handler
* Worked on cleaning up ewf struct read and write functions
* change section start to static definition in libewf_section_last_write and libewf_section_start_write
20071009
* Worked on file io handler
20070919
* Worked on implementing raw read in ewftools
20070918
* Worked on implementing raw read in ewftools
20070916
* Fixed bug in libewf_section_hash_read introduced by MD5 calculation removal
* Worked on implementing raw read in ewftools
- moved the string functions from ewfcommon to ewfstring
- moved the user input functions from ewfcommon to ewfinput
- moved the user output functions from ewfcommon to ewfoutput
- updated MSVCPP project files
- seperated read and crc/uncompression functions
20070915
* Worked on deb based package
- added distclean make directive
* Adjusted rpm based package
* fixed for rogue next sections in delta segment file section list during RW
* fixed libewf_debug_read_section to handle a size of size64_t
- still limited to SSIZE_MAX
20070912
* fixed on error in delta file accouting for multiple rewrites
* removed libewf_write_chunk, libewf_internal_handle_read_is_initialized
and libewf_internal_handle_write_is_initialized
* fixed write finalize after R or RW open
* clean up of small to do's
20070910
* worked to allow to set the delta file path
* fixed error in delta file header offset handing
* worked on error regarding delta file end
20070908
* worked on remove of MD5 calculation from library
- implemented MD5 calculation in ewfcommon for ewfacquire and ewfacquirestream
- removed libewf_set_media_values, calculated_md5_hash and libewf_raw_update_md5 from API
- removed digest context and MD5 from library
- removed calculated MD5 hash and MD5 context from internal handle
- added macros libewf_get_hash_value_md5 and libewf_get_hash_value_sha1 to API
- added macros libewf_set_hash_value_md5 and libewf_set_hash_value_sha1 to API
- removed libewf_get_md5_hash from API
- removed several libewf_internal_handle_get_ and libewf_internal_handle_set_ functions
* worked on write support for > 2 GiB segment file for EnCase 6.7
* added check to libewf_close to enforce libewf_write_finalize
* worked on having compound reallocation functions return an integer as result
- removed libewf_internal_handle_chunk_cache_realloc
* worked on moving byte swap out library into ewftools
- removed libewf_set_swap_byte_pairs from API
20070905
* worked on remove of MD5 calculation from library
- removed MD5 calculation from read
- implemented MD5 calculation in ewfcommon for ewfverify
- removed hashed flags in offset table
- removed libewf_calculate_md5_hash from API
* worked on read support for > 2 GiB segment file for EnCase 6.7
20070830
* changed use of stdout and stderr in ewfacquirestream, ewfinfo, ewfalter
* removed program: error output in ewfacquire, ewfverify
* fixed duplicate write of delta chunks
20070829
* worked on read support for > 2 GiB segment file for EnCase 6.7
* worked on write support for > 2 GiB segment file for EnCase 6.7
* worked on session section support
* changed use of stdout and stderr in ewfverify
* added errno == 0 check in ewftools after libewf open to prevent
the following output
"Unable to open EWF file(s) with failure: Success."
20070828
* worked on read support for > 2 GiB segment file for EnCase 6.7
* changed off_t to off64_t for Windows > 2 GiB segment file support
* worked on write support for > 2 GiB segment file for EnCase 6.7
* changed use of stdout and stderr in ewfacquire
20070827
* removed libewf_common_string_copy and libewf_common_wide_string_copy
using memcpy instead
* changed some int8_t return values into int return values
* worked on changing libewf_get functions for API consistency
* removed unused macros from internal handle
* replaced libewf_set_media_values by libewf_set_sectors_per_chunk
and libewf_set_bytes_per_sector
20070822
* worked on allowing the internal MD5 calculation to be disabled
* changed some int8_t return values to int
20070821
* worked on ewfexport exporting ewf formatted data for delta merge
* print a more detailed error in ewftools for open errors
* fixed amount of bytes to acquire in ewfacquire
20070819
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
* change libewf_offset_table_realloc to return integer value
because function does not change pointer of offset table itself
the same for libewf_fill_offset_table and libewf_offset_table_read
* completed reading dirty chunks from delta segment files
* fixed spelling error in unsuported => unsupported in ewftools
* rewritten #ifdef to #if defined() and #ifndef to #if !defined()
* refactored user input handling code from ewftools to ewfcommon
* worked on ewfexport exporting ewf formatted data for delta merge
ewfexport no longer exports to stdout
specify '-t -' to write to stdout only for continuous raw output
* added libewf_get_flags_ function for use of libewf in Phyton with ctypes
20070818
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
* completed refactoring of PRINT( "libewf and PRINT( "ewf
function names
* changed warning strings with 2^ values to value exceeds maximum
* write optimalisation:
- the data section is cached for multiple writes
- refactored libewf_get_chunk_size out of ewfcommon_read_input
* removed libewf_write_process_chunk_data no longer needed
20070816
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
* removed internal handle passing from libewf_section_start_read,
libewf_section_start_write
* changed section start allocation in libewf_section_start_read from
dynamic to static
20070815
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
20070814
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
* made macros of libewf_date_string_set_month,
libewf_date_string_set_day_of_month, etc. in header values
20070813
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
20070812
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
* moved gmtime function from libewf_common to ewfcommon
* removed error string from libewf_write_finalize
* moved strerror functions from libewf_common to ewfcommon
* removed chunk cache passthrough
20070811
* removed external char
* removed error string from libewf_check_file_signature,
libewf_segment_file_read_open, libewf_segment_file_write_open
* merged common code in wide and narrow functions
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
* removed segment_table_build
20070809
* fixed weird progress indiction, changed localtime into gmtime
* fixed error in libewf_close comment regarding return value
20070807
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
20070806
* worked on restructuring to improve internal structure
* worked on improved rewrite using delta segment files
20070728
* worked on restructuring to improve internal structure
20070725
* worked on restructuring to improve internal structure
20070723
* worked on allowing to read raw buffers as chunks
* worked on restructuring to improve internal structure
20070722
* worked on allowing to write raw buffers as chunks
20070721
* worked on allowing to write raw buffers as chunks
* removed is_dll function no need
* adjusted seek offset function
* added libewf_segment_file to give library improved structure
20070718
* worked on allowing to write raw buffers as chunks
20070717
* worked on allowing to write raw buffers as chunks
* refactored function names into static char *
* ewfacquire stream made physical default instead of logical just like in ewfacquire
* fixed configuration error in MSVS C++ libewf_dll project file
wrong DLL compilation mode /MT
* added fix for off_t being 32 it in MSVS C++
20070716
* worked on allowing to write raw buffers as chunks
* refactored function names into static char *
20070715
* worked on libtool DLL support
* worked on allowing to write raw buffers as chunks
* fixed reallocation bug in libewf_internal_handle_add_crc_error_chunk
* refactored function names into static char *
20070714
* worked on libtool DLL support
* worked on allowing to write raw buffers as chunks
* refactored function names into static char *
20070713
* worked on libtool DLL support
- changed macros in libewf_extern.h into LIBEWF_DLL_EXPORT and _IMPORT without the S
* made libcrypto EVP interface default, use MD5 and SHA1 as fallback
* refactored function names into static char *
20070710
* refactored function names into static char *
* removed type from configure.ac
20070708
* worked on space in directory issue
* added DLL support to configure.ac
20070707
* added fix for missing type definition u64 in linux/fs.h on some platforms
* worked on issue with progress indicator, removed usage of difftime
time_t B - time_t A should equal difftime without conversion to double
20070526
* removed the advertisement clause from the license
20070512
* changed default order of physical and logical in ewfacquire - makes more sense this way
* updated manuals
* fixed error in example of ewfacquire manual page
20070407
* minor corrections for Win32 port
* fixed error in passing error retry value in ewftools
* fixed memory corruption in libewf_internal_handle_set_acquiry_error_sector
20070406
* worked on next stable release
* added status print to ewfacquirestream
* change to print of type in notify
20070317
* worked on next stable release
* changed libcrypto back to the MD5_ and SHA1_ interface still allows for EVP and Windows Crypto API
20070304
* minor type adjustments
20070303
* fixed bug regarding growth of segment file beyond maximum size
20070225
* fixed typo in libewf_handle.h
* fixed cause of segmentation error in libcrypto
20070218
* added include of libewf_types to libewf_handle.h
20070210
* worked on changing size and offset types
20070208
* worked on changing size and offset types
- fixed some errors while testing
20070207
* worked on changing size and offset types
20070206
* worked on changing size and offset types
- updated libewf.3
20070205
* worked on changing size and offset types
- fixed issue in section list after adjustments
- reduces storage size and fixed issue in fill table
20070204
* worked on changing size and offset types
20070203
* worked on changing size and offset types
- changed ewf_string_length, ewf_string_copy and ewf_string_compare into macro's
- fixed memory leak in ewf_string_write_compressed
* worked on code clean up
- rewrote libewf_common_alloc and _realloc to macro's
- rewrote libewf_common_read, _lseek, _write and _close to macro's
- rewrote ewf_x alloc funtions to macro's
- removed ewf_type specific alloc and free macro's
- removed ewf_error2_sectors_realloc, was not used and resizing should be handled by libewf_common_realloc
- removed ewf_table_offsets_realloc, was not used and resizing should be handled by libewf_common_realloc
- removed ewf_string_realloc replaced by libewf_common_realloc
- removed ewf_string_wipe replaced by libewf_common_memset
- removed libewf_error_sector.c
20070131
* worked on changing size and offset types
20070130
* worked on changing size and offset types
- file header now allocated statically
- rewrote section type tests functions to macro's
20070129
* worked on changing size and offset types
- added sys/types.h to libewf_types.h
20070128
* worked on seperate config header files for library and ewftools to fix installable header issue
- removed LIBEWF_CHAR from API, wide functions were added
* remove quick refences in header values
- breaks compatibility with 0.2.1 version of libmodewf.c - was already broken due to new API design
* moved non portable headers back to library path
20070127
* worked on seperate config header files for library and ewftools to fix installable header issue
- changed functions containing CHAR_T in library to separate small and wide character functions (for trace-ability)
- moved error_string print out of common function
- removed open_read and open_write
- moved copy from and to char_t functions out of the library into ewfcommon
- CHAR_T now removed from library
* implemented internal_handle to hide handle representation from outside code
- added serveral API functions
* renamed handle where used as internal handle to internal_handle
20070125
* worked on seperate config header files for library and ewftools to fix installable header issue
20070120
* now using openssl EVP interface instead of directly accessing MD5 functions
* worked on implementation of xhash section
- added hash values to handle
- added get and set funtions for hash values
- updated libewf.3 manual page
* created a more generic digest_context and EWF digest hash to support SHA1
- replaces MD5 context and hash by digest context and hash
* an option was added to allow for SHA1 calculation from ewfacquire and ewfacquirestream
- updated manuals
* added print of additional hashes to ewfinfo
* added verification of SHA1 hash to ewfverify
* seperate generic definitions from libewf_config.h
20070118
* worked on reducing the usage of header values quick references in libewf and ewftools
* using equal definitions for CHAR_T as for LIBEWF_CHAR
* worked on implementation of xhash section
* fixed issue EWXF format not setting GUID in data section
20070117
* worked on reducing the usage of header values quick references in libewf and ewftools
20070116
* added new header values functions to libewf.3 manual
* added reverse string search function
* changed forward string search to macro
* corrected error in split string due to new string search
* changed string length function to macro
* changed string compare function to macro (return type change)
* changed string copy function to macro (return type change)
- make sure the string is \0 terminated after copy
* now using reverse search in parse xheader function for close tag
* fixed error regarding the examiner_name parameter for ewfacquirestream
20070115
* adjusted creation of xheader string
* added function to add user defined header value
* added acquiry_software xheader value to ewfacquire and ewfacquirestream
* changes to spec file to include ewfacquirestream
* added function to parse xheader
* added random GUID to EWFX
* ewfinfo will now print extended header values
* xheader: give acquiry date human readable timestamp with time zone
* ewfinfo change Software used into Software version used
20070114
* worked on redesign of header values
* fixed missing data issue in ewfacquirestream for large block sizes in combination with chunk cache passthrough
* added manual for ewfacquirestrema and updated manuals
* header values now uses a dynamic array
- old pointers left in for compatibility at the moment
20070113
* changed free functions for basic types to macro's allows for optimization
* made adjustments due to splint warnings
- fixed error regarding buffer_size of ewf_crc_calculated being a signed interger while it should be an unsigned one
- fixed error regarding parameter validation due to optimalizations in ewf_string_copy
- fixed possible integer overflow in ewf_volume_calculate_chunk_size and ewf_volume_smart_calculate_chunk_size
- fixed not checking the return value of close in libewf_common_close
- adjusted compression level in header values from uint8_t to int8_t (for consistency)
* changed API of libewf_close to return a status value
- adjusted ewftools accordingly
- most functions return -1 on error (for consistency)
* removed STREAMED_WRITE sections
* updated manuals
20070111
* fixed issue with unrestricting amount of offsets
* media flags are written to volume and data section
20070110
* changed libewf_set_write_media_type to set volume type
* added option to set volume type in ewfacquire and ewfacquirestream
* fixed error in new header types, two value lines do not contain additional tabs
20070109
* added information about unknown_md and _sn
* added libewf_header_value for more generic approach to handling header values
* the volume media type in EnCase uses 0x00 for a floppy image and 0x01 for a hard disk image
* adjusted library for fixed/removable media type
* added error granularity to read and write
* added function to set and get error granularity
* adjusted ewfinfo and ewfacquire to handle error granularity
- not needed in ewfacquirestream cannot compensate errors in streams
20070108
* Fixed error in EWFX format header section should be xheader section
* Removed setting value of unknown3 in data section
20070107
* worked on linen6 support
* added EnCase6 and linen6 to automated test
* added get_version function
* fixed errors for handing a write of less data than chunk size
* fixed error in EnCase6/linen6 header string creation
* added 8192, 16384 or 32768 sectors per block size options
* removed signature from hash section
* fixed error in strerror for strerror fallback missing return statement
* fixed error in test statement in configure.ac
20070104
* worked on automated acquirestream test
* fixed error in ewfcommon_read_input for handing a write of less data than chunk size
20070103
* adjusted copyright notice
* worked on EnCase6 support
* corrected error in writing original EWF, EnCase1 and SMART format
20061231
* Fix for ctime_r detection not allowing for ctime fallback in configure script
* Fix for incorrect handling of user provided strings in ewfacquirestream
* Added missing sprintf function check and several precompiler definition changes by Christophe Grenier
* configure and code now handles ctime_r 3rd argument under Solaris
20061230
* Fix for precompiler handling for gcc 2.95 in header_values
* Moved GUID and operating software determination to ewfcommon
* Changed autoconf detection of operating software fallback string
* Added some options to ewfacquirestream
* Fixed error in configure.ac regarding libuuid check
* Added macros for tol and toul, with atol fallback support
20061229
* worked on read and write mode
* removed chunk size buffer restriction from ewfcommon_read_chunk renamed it to ewfcommon_read_input
* removed chunk cache wipe
* several platforms tested
20061228
* added write remaining chunk data for streamed write to libewf_write_finalize
* worked on read and write mode
- added amount_of_chunks to segment table, contains the amount of chunks of a segment file
- removed segment_file_offset in handle write, overlap with file_offset in segment table
- fill offset table while writing - removed handle->write->offset and ->amount_of_offsets
- removed handle->write->create_segment_file
20061227
* added pkg-config file (still expirimental)
* added a check to libewf_close to enforce libewf_write_finalize
* moved libewf header files to include/libewf - should fix missing header problem
* worked on read and write mode
- added seek_offset
- added read_buffer - added it to API and libewf man page
- added ewfalter (expirimental)
- rewrote read_chunk not to do its own offset checking
- added write_random
20061226
* worked on read and write mode
- added seek_chunk
20061225
* worked on read and write correction regarding new insight into table sections
* added macro for sprintf fallback
* added configure.ac check for Solaris ctime_r
* rewrite of ewf_string to calculate the byte size for all lengths
* rewrite of common wrapper functions to macro's (memset, memcpy, memcmp, free)
- allow for compiler optimization for functions free, memset, memcpy, memcmp
* worked on streamed write
- added libewf_write_finalize (still expirimental)
- created ewfacquirestream
- added type to section_list_entry
- have write functions set section_list_entries
- basic streamed write mode now working - still needs more testing requiring options set by ewfacquirestream
* corrected error in comment libewf_write_buffer in libewf.h
20061223
* test: full read & write on multiple platforms
* test: different sized buffers for read and write
* check into small segment files for a DVD image - more file handles than allowed will add support for this in the future
* added make lib/library for libewf compilation only
* removed multiple (same) -l<library> from configure
* added check for snprintf (djgpp seems to be missing this function) - will add fallback support to snprintf in the future
* corrected file rights on source files
* added libewf.spec to source package to allow rpmbuild -ta <libewf>
* fixed bug in reading header string 1 byte too little
* libewf now warns if file exceeds the maximimum amount of offsets in a table section
* worked on read and write correction regarding new insight into table sections
* added support for the original EWF format
20061219
* Added have config defaulting to libewf.h required for library include
* several adjustments thanks to Christophe Grenier
- manual/libewf.3
- libewf.spec.in
- fix for 4 GiB support for native Windows compilation _lseek => _lseeki64
20061218
* added sys/types for Solaris signal.h include
20061217
* worked on testing for stable release
* fix for NetBSD using zlib 1.1.4 missing compressBound function
* moved factor 2 buffer size enlargement from ewf_string_uncompress into ewf_uncompress this matches behaviour of ewf_compress
* added support for missing ctime_r, localtime_r and strerror_r fallback to ctime, localtime, strerror
* manually added INT64_MAX definition - for platforms missing LLONG_MAX definition
20061216
* worked on testing for stable release
* fixed bug for buffer passthrough exceeding the buffer boundary for compressed chunks
* fixed bug for chunk cache passthrough
* fixed reallocation of chunk cache for chunk cache passthrough
* disabled -Wextra compiler flag for OpenBSD compilation
* removed wcsftime and strftime for platform compatibility - now using snprintf based solution
* fixed EnCase1 format error - contains only 1 header section
* fixed handling of EnCase1 format in strict error mode
* automatic generation of SPEC file thanks to Christophe Grenier
20061213
* worked on testing for stable release
* fixed bug regarding too small copy of date strings
* fixed bug regarding over correcting uncompressed string length
20061212
* Worked on Windows wide character support
* adjusted string copy from/to char to char_t
* finished first version of manpage libewf.3
20061211
* fixed typo in ewfacquire man page acquiry -> acquire
* removed AC_FUNC_MALLOC and AC_FUN_REALLOC from configure.ac
* fixed typo in libewf_includes.h HAVES_ -> HAVE_
* adjusted code for warnings in Windows port
* changed segment number to 16 bit value in read and segment table
* fixed issue with ewfgetopt
* moved utf16 to/from ascii converion functions from ewf_string to libewf_string
* added intermediate macros for wide character support under Windows
* adjusted static string concats
- MVC first executes the macro, after which it tries static string concat
- gcc seems to do this in oposite order
20061209
* added stdint.h support to libewf_includes.h
* changed $build to $target in configure.ac
* added libewf.spec file
* libewf version numbers will not contain a release number any more - no additional value other than for development
* fixed bug in \r detection in parse_header_string - when string length is 0
* adjusted option order in ewfacquire help function - should be alphabetical
* worked on man pages using input provided by Kees Mastwijk
* corrected some small output inconsistencies
20061208
* worked on ewfinfo man page using input provided by Kees Mastwijk
20061207
* worked on calculating a GUID for write
* added GUID get and set functions to libewf
* added GUID check for data section
* added GUID write for encase5 and linen5 format
* ewfacquire now adds random GUID (uuid) for encase5 and time based GUID for linen5 - only if libuuid is present
* ewfacquire added test for block or character device before determining device size
* ewfcommon created generic version function - added library version information
* changed version() to ewfcommon_copyright_fprint()
* worked on ewfacquire man page using input provided by Kees Mastwijk
20061206
* added hypens to GUID output in ewfinfo
* worked on calculating a GUID for write
20061204
* changed configure.in to configure.ac
* moved CFLAGS to configure.ac
* system dection code is now only used to determine the fallback string for ewfacquire
- detection of available functions is now based on header detection
* moved library code to ./libewf and code for the ewftools to ./ewftools and libewf.h to ./include
* removed LIBEWF_H_USED_IN_PACKAGE
* added defines to ewfcommon for different buffer size testing
20061201
* added optimalization definitions - for testing
* implemented chunk cache passthrough
* added configuration parameters for buffer passthrough and chunk cache passthrough
- buffer passthrough does not seem to enhance the performance significantly
- chunk cache passthrough does not seem to enhance the performance significantly
* ewfacquire: ask or determine media type (fixed and removable)
* added EWFX format (expirimental)
- (basically EWF-E01 based format)
- allows for section xheader, which contains header information in XML and is stored in an compressed string
20061130
* problem with media size calculation due to change
- note: uint32_t * uint32_t = uint32_t and will not upscale to uint64_t
* ewf_string: better solution for size*16 in ewf_string_uncompress
- the length starts out with a factor 2 and keeps increasing by a factor 2 until string can be decompressed
* moved process status and summary functions to ewfcommon
* added process summary to ewfexport
* read: will uncompress chunk directly to chunk sized buffers for non compressed chunks
* are both the segment table and section list file descriptor value needed - can this be a single value?
- the file descriptor in the section list was used as safe guard only - removed
* Only use the chunk cache when the input buffer size does not suffice for reading or writing an entire chunk
- the chunk cache actually reduces performance for sequential reads due to additional memcpy - completed
* ewfverify: show status indicator
* ewfverify: when done show time and Mb/s
20061129
* Media size is calculated when not set
* Added -Wextra compile flag for addition warning values
* fixed: weird floating point exception after recompilation of working versions in callback functions
- this was actualy a division by zero in the callback function
* read: added improved support for EnCase linen 5 format
- adjusted libewf_header_values for more flexible header creation
* write: removed the CRC after the offset table for the SMART format
* write: added linen5 support
* header values: removed trailing \r from last header value
* write: fixed error regarding buffer passthrough
* read: will read chunk directly to chunk sized buffers for non compressed chunks
20061128
* worked on performance enhancements
* lseek is now only used if section data needs to be skipped
- in libewf_sections_read_segment
- in libewf_read_chunk - added segment number to offset table and file offset to segment table
for basic offset tracking
* found issues in documentation
- EnCase1 (EWF-E01) format stores its chunks in the table sections not in the sectors section
it uses an EWF-S01 alike layout
- SMART in FTK Imager has a CRC at the end of the offset table
* fixed read and write regarding issues in documentation
* read: fixed error in recognizing FTK imager format
20061127
* worked on performance enhancements
* changed ewf_crc_calculate to make use of zlib's adler32 function instead of algorithm derived of CRC algorithm by Andrew Rosen
- this improves the performance significantly ;-)
* changed libewf_endian functions for improved error handling
* removed memcpy from chunk cache read to data for non compressed data in libewf_read_random
20061126
* worked on performance enhancements
* changed iterator to 32 bit in ewf_crc_calculate saves conversion on a 32-bit platform
20061125
* worked on string and char types
* changed ewf_sectors.[ch] into ewf_chunk.[ch] - chunks do not only reside in sectors sections therefore the name change
* removed ewf_chunk.c - now uses ewf_string functions, moved necessary functions to libewf_string.[ch]
* worked on performance enhancements
* reduced CRC (de)allocations
20061124
* worked on performance enhancements
* added buffer size option to ewfacquire
20061123
* worked on string and char types
* added macros for static char or wchar_t type strings
* note: fgets and fgetws cannot be used on the same stream after one and other
* string: wide character support (wchar support)
- Windows also provides tchar, tchar is a wrapper for both char and wchar_t
* change char* to EWF_CHAR* or LIBEWF_CHAR*
- allow for char and w_char interfacing with library
- use LIBEWF_CHAR for char/w_char wrapping and EWF_CHAR for byte strings in EWF file format, CHAR_T required for wchar_t support in basic functions
- make internal EWF related strings byte strings (EWF_CHAR) - make string functions safe to be char or uint8_t
- use string.x for string functions
* string: added length to libewf_string_search
* string: added length to libewf_string_split
* ewfacquire: added wchar_t support for utsname_buffer.sysname
* ltree: changed ewf_tree_data_read
* ewfinfo: added stored MD5 hash
* ewfacquire: added print read errors on exit
* all: in read and write functions add file_descriptor test - not necessary libewf_common functions do check this
20061122
* worked on string and char types
* windows has: wmain for wide character arguments
* moved getopt code to ewfgetopt for wmain support
* moved glob code to ewfglob
* changed libewf_open to match main and getopt type arguments
* fixed check enable...=no validation - $withval needed to be $enableval
* added CHAR_T and INT_T for wrapping character type of support functions like (w)open
20061121
* worked on string and char types
* fixed: missing ewf_char.h, ewf_string.h and libewf_config_windows.h in package
* changed COPYING and AUTHORS due to license issue
* removed: libewf_common_string_to_uint64 and libewf_common_string_to_int64
* fixed: several compilation errors for wide character type support
* added: strchr to ewfcommon for getopt support
20061119
* worked on string and char types
* changed %s and %c where necessary to PRIs and PRIc
20061118
* worked on string and char types
* string: removed LIBEWF_STRING type definition
* string: removed string_copy_from/to_char functions
* string: added wrapper PRIc for c, lc and PRIs for s, ls
* common: removed strdup - no longer needed - libewf_string_duplicate takes care of this functionality
* common: removed strchr - no longer needed - libewf_string_search takes care of this functionality
* common: removed strncmp - no longer needed - libewf_string_compare takes care of this functionality
* fixed: inconsistency in libewf.h and libewf_file.h
* common: removed strlen - no longer needed - libewf_string_length takes care of this functionality
20061115
* worked on string and char types
* implement libewf_string_copy_(from/to)_header functions
* changed utf16/ascii convert to copy functions
* libewf_string: allow to set multibyte strings from header values - still need to test this
20061114
* worked on string and char types
* implemented non compressed read and write in ewf_string - for ltree tree data
* fixed bug in compression buffer reallocation in ewf_string
- reallocation pointer was not provided backwards
* delay header and header2 conversion to parse function
* moved basic ewf_header2 functions to ewf_char - ewf_header2 has become a type wrapper
* string: make a more generic ewf_string (use this in ewf_header, ewf_header2, ewf_ltree) also move ASCII and UTF
20061113
* worked on string and char types
* ewf_string removed several functions
* moved basic ewf_header functions to ewf_char - ewf_header has become a type wrapper
20061112
* worked on string and char types
* header_values: rewrite libewf_header_values_set_value to return integer with status code
* moved md5hash to string function to libewf_string
* moved ewf_section_fprint and ewf_header_fprint to libewf_debug
20061111
* ewfexport: added time estimate
* moved byte print function to ewfcommon
* added API functions to retrieve header values
* string: add string copy
* string: add string copy to char/w_char types
20061110
* Fixed strerror_r char * return type on Ubuntu
20061109
* Fixed several logical bugs in write_buffer
- incorrect check of chunk cache passthrough
- incorrect handling of buffer sizes
- incorrect handling of last buffer write
* Fixed bug in ewfexport adding 128 bytes
- due to print output to stdout
* Fixed output write libewf_write_test_segment_file_full
* ewfacquire: added time estimate
* libewf_common_open: added check for return values _sopen_s
20061029
* Worked on clean up of includes in libewf.h
* Created API functions to get and set the header values - this moves the header values dependency out of the ewftools
* Moved verbose into library, also added notify stream
- windows port: allow error output stream redirection (libewf_notify) requires Visual C/C++ /MD compilation flag
* Fixed a memory leak in ewf_header_read - the compressed header was not freed
* Added alternative compile time method for platform determination when uname() is missing
* Fixed error in handling if AES crypt provider is not available
* Moved the error handling values out of the library - no longer contains read chunk function
* Added basic globbing code for windows port - should suffice
* Fixed memory leak of last section in libewf_read_build_index
* Fixed memory leak in ewfacquire bytes_string was never freed
20061028
* Merged the libewf win32 port by George Garner with current working verion
- signal handling and memory debug was added to ewfsignal
- added libewf.c for MainDLL function
20061026
* moved header_values_fprint to ewfcommon
* created libewf_parse_header_values
* moved from_ and to_file_descriptor functions out of the library and into ewfcommon
* rewrite of from_ and to_file_descriptor functions in ewfcommon and related library functions
* moved swap byte pair functions back into library
* fixed header value creation is date strings are missing
* added function to set media type in handle
20061025
* made one type (error sector) for crc and acquiry read error sectors
* Worked on Win32 native port
- fix for file open - not using the right parameters for Windows
- fix for crypto API calls for MD5 context
- rewrote some API functions to pass buffers from the application to the library
so allocation and de-allocation is handled within the same program space
20061024
* minor alterations for BSD licensed getopt
* added a libewf version of getopt to ewfcommon - it is basically a rewrite of the version
by The Regents of the University of California - it should suffice for platforms without getopt
* prefixed functions in ewfcommon with ewfcommon - this distinguishes them from the libewf functions
* created acquiry_error to move error2 and endian conversion in ewfcommon into library
* fixed missing read error retry reset after sector skip
* fixed 1024 kb human readable size will now become 1.0 Mb
* default amount of read error retries is now 2 (will result in 3 read attempts)
* fixed error regarding read error retry one off
20061023
* Reduced input_file_size and input_write_size to 1 parameter: input_write_size
* Renamed ewf_file_size to segment_file_size
* Looked at generic character/string wrapper - for wide char support
20061022
* Fixed media type mismatch in data section in EWF file from ewfacquire for EWF-E01 format
* Fixed empty section start size in EnCase (EWF-E01) format for read and write - FTK Imager
* Fixed error in read with byte swap, the MD5 hash must be calculated over the non swapped data
* Clean up in libewf.h
* Worked on Win32 native port
- added LIBEWF_EXTERN macro for DLL import/export
- changed ctime to libewf_common function using the thread safe variant
* Added libewf_set_write_input_size function
* libewf and tools are now compilable natively on Windows
20061021
* Worked on Win32 native port
- changed libewf_common_strncmp return to signed as it should be
- changed strerror to libewf_common function using the thread safe variant
- changed localtime to libewf_common function using the thread safe variant
- requires some type casts from unsigned to signed - the libewf_common read and write function do the check if the size
value exceeds INT32_MAX
- rewrote ewf_md5hash_to_string() not to use snprintf
- rewrote libewf_md5 to wrap multiple implementations is now libewf_md5_context
- added Windows Crypto API support to libewf_md5_context
* Reduced maximum amount in offset table to 32-bit value
* Reduced segment values to a 16-bit value
* Changed libewf_notify to use autoconf/make header check
20061020
* Worked on rewriting libewf_write
- when header values are empty a default is created
- better fill EWF-S01 segment file - recalculate the chunks per segment after the table section is written
20061019
* Block is only required to be wiped when offset is 0
* Worked on rewriting libewf_write
- moved header values set and create to libewf_handle
- removed set_parameter function
* Fixed mismatch in segment size and chunks section size calculation for the EWF-S01 format
* Fixed invalid amount of chunks per segment for 2 GiB segment file for the EWF-S01 and EWF-E01 format
* Added maximum input size check
* Added a generic set function for enabling byte swap
* Completed redesign write and parameter functions to fallback to a default
20061018
* fixed error catching negative remaining segment size
* worked on: redesign write and parameter functions to fallback to a default
* Worked on rewriting libewf_write
20061017
* fixed error handling multiple segment files - the write_buffer loop now leaves the segment file in a state
of an open chunks section
* changed space left function into test full functions
* implemented compressBound() for determing the required size a too small compression buffer
* allow for a variable buffer size in write_buffer by using a chunk cache size and offset
* ewf_header_compress: is there a better way to determine the size of the compressed buffer - compressBound fixes this
* done: redesign handle, refactor certain aspects to sub structs like chunk_cache
* worked on: redesign write and parameter functions to fallback to a default
* Worked on rewriting libewf_write
20061016
* at last done rewritting libewf_write_from_file_descriptor to use new function libewf_write_buffer
* changed handle->write->chunks_per_segment and handle->write->maximum_chunks_per_segment
* progressive method of amount of chunks per section/segment is required for EWF-E01 fill method
* calculative method of amount of chunks per section/segment is required for EWF-S01 pre-write offset table size determination
* Worked on rewriting libewf_write
20061015
* corrected typo in src/Makefile.am
* fixed libewf.h to be used from within the libewf package and outside
* fixed maximum ewf file size in ewfacquire was 1 byte too large - due to new restriction in libewf
* Worked on rewriting libewf_write
* fixed remainder > 9 issue - using a naive solution but adequate
20061014
* ewfinfo: move error2 list print code into library - to ewfcommon
* ewfverify: move crc list print code into library - to ewfcommon
* write: fixed incorrect implementation of EnCase1 header
* ewfinfo: move format detection code into library - basic file format detection is now in library
a small part still in ewfinfo, this because EnCase2 and EnCase3 format look a lot each other
* added function to create original header format
* rewritten function to create headers to 3 more generic functions - for header2 not needed yet
* Worked on rewriting libewf_handle
* Worked on rewriting libewf_write
* Added API get function for certain information
* Renamed sector_count => amount_of_sectors
* Renamed chunk_count => amount_of_chunks
* Renamed error_count => amount_of_errors
* fixed textual error in ewf_sectors_chunk_compress
20061012
* moved EWF definitions to ewf_definitions.h
* moved PRIx fixes to libewf_includes.h
20061011
* ewfinfo: add date format in ewfinfo to month in text - no interpretation differences possible
ISO8601 date string support added - based on patches/adjustments by Rob Meijer
* Rewritten part of header_values for new date format
* Added date format support to ewfinfo
* fixed a space in configure output
* Worked on rewriting libewf_write
* Worked on rewriting libewf_handle - introduced new read and write specific subhandles
* removed compression_used from handle - no longer needed
* added error_granularity_bytes to write subhandle
20061010
* Worked on rewriting includes to use libewf_includes.h
* Removed __attribute__((packed)) from structs for Win32 port - they do not seem neccessary anymore
* Added the header file installation - based on patches/adjustments by Rob Meijer
* read: warn when maximum offsets in table of S01 format is exceeded
* Worked on rewriting libewf_write
20061009
* Added libtool support - based on patches/adjustments by Rob Meijer
* Changed config.h to src/libewf_config.h
* Added libewf_includes.h to wrap libewf_config.h for beter autoconf/automake integration
* Worked on rewriting includes to use libewf_includes.h
20061008
* Changed program banner and version information
* Version released
20061007
* Fix for missing header definitions for OpenBSD
* Fix for missing INTx_MAX definitions for OpenBSD
* Fix for compilation warnings for SunOS - moved libewf_common.h to be first include
* Bug in reallocating chunk cache - initial reallocation was removed by rewrite
* change chunk cache allocated_size to 32 bit value - also chunk size in read function
20061004
* Tested ewfacquire with disk with 0 sector error - success
* Bug in MacOS-X reading a floppy with bad block - read with -1 could alter current file offset (determined by lseek)
Added lseek check to check and correct for offset drift
20061003
* fixed one-too-many read error retry
* fixed bug not correcting bytes_to_read in read error handling - this surfaced on MacOS-X (Linux read behavior is different)
* ewfacquire: minor adjustment in output - removed dot
20061002
* fixed error in libewf_section.h - this surfaced on MacOS X
20061001
* disabled lvf support
* fixed error in read error handling in write functionality - this surfaced under FreeBSD
20060929
* did some refactoring of write function
20060928
* did some refactoring of write function
* ewfacquire: print MD5 hash when completed - added
removed index build check from libewf_data_md5hash function - this function checks if hash is set ananyway
20060927
* minor adjustment to verbose logging configure options - fixed error with variable names containing '-'
* all: human readable size add .0 for single digit values - implemented
* fixed bug with missing config.h for sleuthkit integration
* fixed some formatting issues
* did some refactoring of write function
* defaulted handle values to unknowns
* added function to determine header length instead of strlen - this is more appropiate
20060926
* minor adjustment to verbose logging configure options
* added program version to output
* did some refactoring of write function - added more checks for write_count returns
* write: warn before hand if segment file amount exceeds limit - implemented
* all: human readable size add .[1-9] for single digit values - implemented
20060922
* worked on ltree
* fixed error in verbose output CRC value libewf_read_random - checked if bug resides in other CRC output - could not find any
* changed values in volume definition
20060916
* worked on code clean up and improved error handling
* ewf_verify now generates CRC error list for sectors (also for compressed chunks)
* verbose and debug prints are now optional (defaults are off)
20060912
* worked on code clean up and improved error handling
* worked on skip beyond media size in write
20060911
* worked on code clean up and improved error handling
* changed hardcoded max values to predifined macros
20060910
* worked on code clean up and improved error handling
* renamed file_read and file_write to read and write
* ewfaquire: add offset and size question
* write: add offset and size support in write function
* added lseek to common, removed off_t from code
* ewfacquire: added nice byte print for status
* ewfexport: added nice byte print for status
20060908
* worked on code clean up and improved error handling
* worked on ltree implementation
* added simple byte order detection to UTF16 to ASCII conversion
* added offset and size question to ewfexport
* added size and offset to read to and write from file descriptor functions
* read: look at libewf_section_volume_read: volume chunk count is 0 - compensating
- check removed no longer required due to LVF support
20060906
* worked on code clean up and improved error handling
* ewf tooling returns the error status no exit
* worked on improving automated test scripts
* corrected user input inconsistency in ewfacquire
* fixed free bug with zlib_crc and calculated_crc in write
* fixed pointer bug with zlib_crc in write
20060905
* worked on code clean up and improved error handling
* added large file support to configure.in for converting raw images > 4 GiB to EWF files
* ewfacquire added total acquire time and bytes/second
20060904
* worked on code clean up and improved error handling
* fixed bug regarding setting chunk size in handle from volume - this got somehow removed due to clean up
* ewfacquire: add start and finish time
20060903
* worked on code clean up and improved error handling
* moved section reading and writing code to libewf_section
* fixed bug in libewf_read_random when offset is too large
* wraped basic library calls in preperation of thread safety of library calls
* added prefix to functions in libewf_common with common_
* enhanced error handling - no program exit but a nice return
* using typedefs instead of defines
* due to 20060505 fix, gave all value definitions a default value
* removed a large amount of unrequired includes
20060902
* worked on code clean up and improved error handling
* libewf_handle_cache_realloc removed from read volume section function
* endian functions are prepended with libewf_endian_
* the secondairy offset table in handle for S01 format will no longer be allocated for read
* started on error tollerance levels for recovery
* moved file descriptor check in last_offset calculation to do one check per section list
- section list was altered to be used for a single segment file only - reduces memory requirements
20060831
* worked on code clean up and improved error handling
* created seperate structure for chunk cache
20060830
* worked on code clean up and improved error handling
* allow to set clean value in libewf_(re)alloc_cleared functions
20060829
* worked on code clean up and improved error handling
* worked on libewf_string - moved split code to it
20060828
* worked on code clean up and improved error handling
* introduced and fixed new bug - reminder do not free result from localtime()
20060826
* worked on code clean up and improved error handling
* fixed realloc calculation bug in file_read
* moved definitions from .h files
* changed headers in all files
20060824
* worked on code clean up and improved error handling
* move crc check from file_read into different EWF read methods?
no embedding this check in the segment types makes it more difficult
to generate an CRC error list for ewfinfo
20060823
* no need for fatal warnings if code becomes re-entrant after error
* added a wrapper of basic library calls
* worked on code clean up and improved error handling
* renamed notify.* to libewf_notify.* prevents name clashes
* ewf_crc function now use a dynamic allocated CRC - this helps with error propagation
* added big endian support to ascii to utf16 routine
20060822
* added byte swap (equivalent of dd conv=swab) functionality in both read and write
* changed sys/types.h to inttypes.h
all: check if sys/types definitions still needed in ewf_*.h files ? - not under linux will do a cross platform test anyway
* started with implementing improved error handling and re-entry after error,
combined with code clean up, better error control, revision of header to allow for one place to maintain acknowledgements
20060821
* read: added basic support for L01 files, which are basically EWF files
* renamed ewf_file_signature to evf_file_signature - closer to the truth
* ewfacquire: compensate for maximum S01 file size in ewf file size question - determine maximum
- not relevant because there is a maximum of chunks within the file but the
other data could grow to the 2 GiB
20060820
* ewfacquire: small change to confirmation
20060819
* lifted the 255 segment file limit on write, however it uses an (horrible) increment based naming scheme much like EnCase
write: allow more than 255 segment files - completed
* write: worked on SMART (EWF-S01) support
* write: SMART (EWF-S01) - build in support for table2
* all: add SMART support - complete
* worked on - all: due to 20060505 fix give all value definitions a default value - looks nicer
* due to changes to the read and write logic the library was retested
* read: error in percentage in libewf_read_random - works on FC5
* table size limitation does not seem present in EWF-E01 only in EWF-S01
* use autoconf/automake cross compilation parameters for platform determination - completed
20060818
* read: worked on SMART (EWF-S01) support
* alternative read method was removed, the assumption it was based on is no longer valid
read: remove alternative read method the assumption behind is fails for the SMART format - completed
* renamed alternative write method to wipe block on read error
write: rename the alternative write method to wipe_block_on_error (or something) - completed
* read random: chunk based size check now is a buffer based size check
* removed handle->chunk_crc no longer needed
* for the EWF-S01 format the entries in table2 are appended to the offset table - have yet to test a file with a table2 section
* write: worked on SMART (EWF-S01) support
20060817
* read: worked on SMART (EWF-S01) support
20060816
* ewfacquire: add overview to confirm user input, otherwise restart input query - completed
* ewfacquire: make encase5 file option default - completed
* fixed incorrect order for values in header2 on write - also in documentation
20060812
* made the amount of read error retries flexible and user adjustable through ewfacquire
* correction of "int result" in file_write to be C89 code compliant
* new file size algorithm to fill up closer to max file size when compressing
write: change algorithm to fill files upto file size - completed
* added empty block compression
write: always compress empty chunks - completed as an option
20060809
* fixed size bug for large images on Cygwin - fix of 20060610 not sufficient for Cygwin
* fixed invalid value in printf volume read verbose messages
* added autoconf/automake structure
20060708
* renamed endian.h to libewf_endian.h for compatibility issues
20060617
* put conditions around debug code in eqfacquire
20060611
* fixed - one off bug in header value end of string
20060610
* ewfacquire test on multiple platforms
* added support for SMART format volume section - equals the original EWF volume section definition
* fixed - type casting error in data size
* fixed - missing header for encase1 format in write
* fixed - bug in writing encase4 and encase5 header2 in write - error in ascii to utf16 routine
* fixed - bug in writing encase4 and enacse5 header in write - logical formatting error
* write: timestamp is now generated only once
* write: fixed incorrect free in header values
* write: fixed memory corruption bug in ewfacquire - required explicit zero of string
20060605
* fix of data corruption bug - one off
* ewfacquire: sanitize input provided by user
* ewfinfo/eqwfacquire ? 1970 date when no case data is provided - bug in split function regarding first empty value
* removed file cache - no longer required
20060527
* started analysis of a data corruption bug
20060526
* fixed write bug when read is successful after error with small error granualirity
* fixed write bug with error granularity 1
* ewfacquire: add chunk size input possibility
* ewfacquire: add error granularity size input possibility
* ewfacquire: memory corruption bug in user input - repaced some code - looks OK now - but hard to reproduce
* fixed write bug with block size 128 error granularity 16 in test
* write: improve reading of bad sectors and writing a error2 section to file for encase5 file option
20060520
* fixed media size bug - old method of calculation was still in there :-(
* worked on ewfacquire read on error
* added alternative write method to test acquired images against existing tooling
* ewfaquire: able to produce exact media data as linen
* write: what if read error is in last chunk and it is smaller than chunk size !?
20060517
* removed duplicate include from notify.c
20060516
* added media size to ewfinfo
* worked on ewfacquire read on error
20060513
* minor adjustment in libewf.h - ewf_close renamed to libewf_close
20060505
* Fix for older compilers like gcc 2.95 - rewrite to older C statements
20060424
* added warning macro to allow overriding some fatal errors
* allow overriding invalid CRC's
* refactored crc check in ewf_section to file_read - for scope of handle and uniformity within the code
* further analysis of unknown values in hash section - also found difference in signature value Encase4 and Encase5
20060423
* Fix for Solaris in definitions.h
20060422
* Fixed missing PRI definitions on OpenBSD - now defines in definitions.h
* changed sprintf to snprintf
* added device size determination for OpenBSD
* fixed bug in header values parsing for empty first value empty
* added compression level definition
* ewfinfo: add compression media information in ewfinfo - Encase5 format only
* write: moved compression type functionality from ewfacquire into library
20060419
* Adjusted write method - to fix filesize problem
* Correction of verbose print of last chunk number
* the write function works only when a data section is at the start of the file - why ? not a bug in write
but in read the first offset in the segment table was filled with 0 instead of 13 which is the size
of the file header
20060418
* Tested on FreeBSD 6.0 needed to add include header in ewf_sectors.h
* Adjusted Make to be more generic and to work on FreeBSD 6.0
20060415
* changed u_int to uint
* removed LIBEWF_ types
* zlib uses a long which varies per 32 and 64 bit architecture using an intermediate variable
fixes not able to read compressed images on a x86_64 architecure
* Memory corruption bug in segment table filename fixed
20060414
* Fixed previous offset size
* removed memcpy assignments
* type fixed malloc assignments
* removed (void *) from memset
* reduced the amount of int definions
* changed printf formaters
* added status indication to ewfexport using callback function in read_from_file_descriptor
* added quiet option to ewfexport and ewfacquire
* removed dependency on libiconv - created a naive utf16 to ascii conversion
* moved header string generation code to header_values
* added time string generation code to header_values
* added acquire options for compression and file type to ewfacquire
* code now partially fixed for x86_64 systems fixed malloc statement, printf sizes, and some type definitions
* additional changes to memcpy statements made
* Use header_values for write
* ewfacquire fix error print on correct fixed value
* ewfacquire fix for empty input values
* ewfacquire fix strange image file rights
* ewfacquire fix image filename weird characters - one byte off allocation problem in ewfacquire
* ewfacquire allow for a default value - for fixed values
* ewfacquire can now acquire devices on works on Mac OS-X/Darwin
* fix write crc error in chunk on mac os x
* ewfacquire add EWF file size input possibility - check upper bound 2 GiB, lower bound 1440k
* fix write bug with small file size 1440k - for floppy image - this has to do if
both the filesize and the ewf size are the same - write will adjust with one additional segment file
20060413
* Used LIBEWF_VERSION in executables
* Added file signature function to library for integration in The SleuthKit
* Added md5.h for allowing to do with different MD5 calculation code bases
like the one integrated in the The SleuthKit
20060412
* Created separate file for header value logic - moved code from ewfinfo
20060411
* Nearing release of first version, so started logging relevant changes
* Removed memory leak with duplicate header assignment to handle
* Renamed ewfmd5sum to ewfverify - still have to enhance functionality
* Renamed ewfcat to ewfexport - still have to enhance functionality
* Added time parsing functionality to ewfinfo - date format is currently fixed in MM/DD/YYYY
* Enhanced password and compression header value output in ewfinfo

File Metadata

Mime Type
text/plain
Expires
Wed, Oct 29, 11:54 AM (13 h, 46 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1347018
Default Alt Text
ChangeLog (102 KB)

Event Timeline