ewfinfo

NAME
ewfinfo - show meta data stored in EWF files

SYNOPSIS
ewfinfo [-A codepage] [-B bodyfile] [-d date_format] [-f format] [-F file_entry] [-ehHimvV] ewf_files

DESCRIPTION
ewfinfo is a utility to show meta data stored in EWF files.

ewfinfo is part of the libewf package. libewf is a library to access the Expert Witness Compression Format (EWF).

ewf_files the first or the entire set of EWF segment files

The options are as follows:

-A codepage
    the codepage of header section, options: ascii (default), windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258

-B bodyfile
    output logical files information as a bodyfile

-d date_format
    the date format, options: ctime (default), dm (day/month), md (month/day), iso8601

-e  only show EWF read error information

-f format
    specify the output format, options: text (default), dfxml

-F file_entry
    show information about a specific file entry path

-h  shows this help

-H  shows the logical files hierarchy

-i  only show EWF acquiry information

-m  only show EWF media information

-v  verbose output to stderr

-V  print version

ENVIRONMENT
None

FILES
None

EXAMPLES

    # ewfinfo -d dm floppy.E01
    ewfinfo 20120805

    Acquiry information:
            Case number:            1
            Description:            Floppy
            Examiner name:          John D.
            Evidence number:        1.1
            Notes:                  Just a floppy in my system
            Acquiry date:           09/12/2006 10:00:12
            System date:            09/12/2006 10:00:12
            Operating system used:  Linux
            Software version used:  20061209
            Password:               N/A

    EWF information:
    	File format:		EnCase 5
    	Sectors per chunk:	64
    	Error granularity:	64
    	Compression method:	deflate
    	Compression level:	no compression
    	Set identifier:		869910fc-e143-4908-9328-afedf4a7be1e

    Media information:
            Media type:             removable disk
            Is physical:		no
            Bytes per sector:       512
            Number of sectors:      2880
            Media size:             1.4 MiB (1474560 bytes)
    Digest hash information:
            MD5:                    ae1ce8f5ac079d3ee93f97fe3792bda3

DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

BUGS
Please report bugs of any kind to <joachim.metz@gmail.com> or on the project website: https://github.com/libyal/libewf/

AUTHOR

These man pages were written by Kees Mastwijk.

Alterations for distribution have been made by Joachim Metz.

COPYRIGHT

Copyright (C) 2006-2023, Joachim Metz <joachim.metz@gmail.com>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

SEE ALSO
ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfmount(1), ewfrecover(1), ewfverify(1)