Page MenuHomePhabricator
Files F5158262

ewfacquire.1
No OneTemporary
Actions

Size
5 KB
Referenced Files
None
Subscribers
None

ewfacquire.1
View Options

.Dd May 12, 2007
.Dt ewfacquire
.Os libewf
.Sh NAME
.Nm ewfacquire
.Nd acquires data in the EWF format
.Sh SYNOPSIS
.Nm ewfacquire
.Op Fl d Ar digest_type
.Op Fl -hqsvV
.Va Ar source
.Sh DESCRIPTION
.Nm ewfacquire
is a utility to acquire media data from a
.Ar source
and store it in EWF format (Expert Witness Format).
.Nm ewfacquire
acquires media data in a format equivalent to EnCase and FTK imager, including meta data.
Under Linux, FreeBSD, NetBSD, OpenBSD, MacOS\-X/Darwin
.Nm ewfacquire
supports reading directly from device files.
On other platforms
.Nm ewfacquire
can convert a raw (dd) image into the EWF format.
.Pp
.Nm ewfacquire
is part of the
.Nm libewf
package.
.Nm libewf
is a library to support the Expert Witness Compression Format (EWF).
.Nm libewf
supports both the SMART format (EWF-S01) and the EnCase format (EWF-E01).
.Nm libewf
currently does not support the Logical Volume format (EWF-L01).
EWF-X is an expirimental format intended for testing purposes to enhance the EWF format.
.Nm libewf
allows you to read and write media data in the EWF format.
.Pp
.Ar source
is the source or device file to acquire data from.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl d Ar digest_type
calculate additional digest (hash) types besides md5, options: sha1
.It Fl h
shows this help
.It Fl q
quiet shows no status information
.It Fl s
swap byte pairs of the media data (from AB to BA)
(use this for big to little endian conversion and vice versa)
.It Fl v
verbose output to stderr
.It Fl V
print version
.El
.Pp
.Nm ewfacquire
will read from a file or device until it encounters a read error.
On read error it will retry the amount of retries specified.
If
.Nm ewfacquire
still is unable to read and, if specified, it will zero (wipe) the amount of sectors specified as error granularity.
.Pp
Empty block compression detects blocks of sectors with entirely the same byte data and compresses them using the default compression level.
.Sh ENVIRONMENT
None
.Sh FILES
None
.Sh EXAMPLES
.Nm ewfacquire
will ask the information it needs.
.Bd -literal
# ewfacquire /dev/fd0
ewfacquire 20070512 (libewf 20070512, zlib 1.2.3, libcrypto 0.9.8, libuuid)
Information about acquiry required, please provide the necessary input
Image path and filename without extension: floppy
Case number: 1
Description: Floppy
Evidence number: 1.1
Examiner name: John D.
Notes: Just a floppy in my system
Media type (fixed, removable) [fixed]: removable
Volume type (logical, physical) [physical]: physical
Use compression (none, fast, best) [none]:
Compress empty blocks (yes, no) [no]:
Use EWF file format (smart, ftk, encase1, encase2, encase3, encase4, encase5, encase6, linen5, linen6, ewfx) [encase5]:
Start to acquire at offset (0 >= value >= 1474560) [0]:
Amount of bytes to acquire (0 >= value >= 1474560) [1474560]:
Evidence segment file size in kbytes (2^10) (1440 >= value >= 2097152) [665600]:
The amount of sectors to read at once (64, 128, 256, 512, 1024, 2048, 4096) [64]:
The amount of sectors to be used as error granularity (1 >= value >= 64) [64]:
The amount of retries when a read error occurs (0 >= value >= 255) [2]:
Wipe sectors on read error (mimic EnCase like behavior) (yes, no) [yes]:
The following information was provided:
Image path and filename: floppy.E01
Case number: 1
Description: Floppy
Evidence number: 1.1
Examiner name: John D.
Notes: Just a floppy in my system
Media type: removable
Volume type: physical
Compression used: none
Compress empty blocks: no
EWF file format: Encase 5
Acquiry start offet: 0
Amount of bytes to acquire: 1474560
Evidence segment file size: 665600 kbytes
Block size: 64 sectors
Error granularity: 64 sectors
Retries on read error: 2
Wipe sectors on read error: yes
Continue acquiry with these values (yes, no) [yes]:
Acquiry started at: Sat May 12 11:32:41 2007
This could take a while.
Status: at 2%.
acquired 32 kB (32768 bytes) of total 1.4 MB (1474560 bytes).
.Dl ...
Status: at 100%.
acquired 1.4 MB (1474560 bytes) of total 1.4 MB (1474560 bytes).
completion in 1 second(s) with 1 MB/s (1474560 bytes/second).
Acquiry started at: Sat May 12 11:32:42 2007
Written: 1.4 MB (1474560 bytes) in 1 second(s) with 1 MB/s (1474560 bytes/second).
MD5 hash calculated over data: ae1ce8f5ac079d3ee93f97fe3792bda3
.Ed
.Sh DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output \-v is enabled.
Verbose and debug output are only printed when enabled at compilation.
.Sh BUGS
Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website:
https://libewf.uitwisselplatform.nl/
.Sh AUTHOR
These man pages were written by Kees Mastwijk.
Alterations for distribution have been made by Joachim Metz.
.Sh COPYRIGHT
Copyright 2006-2007 Kees Mastwijk, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
.Sh SEE ALSO
.Xr ewfacquirestream 1 ,
.Xr ewfexport 1 ,
.Xr ewfinfo 1 ,
.Xr ewfverify 1

File Metadata

Mime Type
text/troff
Expires
Thu, Jun 26, 5:56 AM (16 h, 9 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
1282115
Default Alt Text
ewfacquire.1 (5 KB)

Event Timeline