ewfinfo.1

sleuthit-2.09 一个磁盘的工具集

.Dd May 12, 2007
.Dt ewfinfo
.Os libewf
.Sh NAME
.Nm ewfinfo
.Nd show meta data stored in EWF files
.Sh SYNOPSIS
.Nm ewfinfo
.Op Fl d Ar date_format
.Op Fl himvV
.Va Ar ewf_files
.Sh DESCRIPTION
.Nm ewfinfo
is a utility to show meta data stored in EWF files.
.Pp
.Nm ewfinfo
is part of the
.Nm libewf
package.
.Nm libewf
is a library to support the Expert Witness Compression Format (EWF).
.Nm libewf
supports both the SMART format (EWF-S01) and the EnCase format (EWF-E01).
.Nm libewf
currently does not support the Logical Volume format (EWF-L01).
EWF-X is an expirimental format intended for testing purposes to enhance the EWF format.
.Nm libewf
allows you to read and write media data in the EWF format.
.Pp
.Ar ewf_files
are the EWF file(s) to read the meta data from.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl d Ar date_format
specify a date format, options: dm (day/month is default), md (month/day), iso8601
.It Fl h
shows this help
.It Fl i
only show EWF acquiry information
.It Fl m
only show EWF media information
.It Fl v
verbose output to stderr
.It Fl V
print version
.El
.Sh ENVIRONMENT
None
.Sh FILES
None
.Sh EXAMPLES
.Bd -literal
# ewfinfo floppy.E01
ewfinfo 20070512 (libewf 20070512, zlib 1.2.3, libcrypto 0.9.8, libuuid)

Acquiry information
        Case number:            1
        Description:            Floppy
        Examiner name:          John D.
        Evidence number:        1.1
        Notes:                  Just a floppy in my system
        Acquiry date:           09/12/2006 10:00:12
        System date:            09/12/2006 10:00:12
        Operating system used:  Linux
        Software version used:  20061209
        Password:               N/A

Media information
        Media type:             removable disk
        Media is physical:      no
        Amount of sectors:      2880
        Bytes per sector:       512
        Media size:             1474560
        Compression type:       best compression
        GUID:                   c1450a26-2737-eb43-a2c3-448ae3f05a51
        MD5 hash in file:       ae1ce8f5ac079d3ee93f97fe3792bda3
.Ed
.Sh DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output \-v is enabled.
Verbose and debug output are only printed when enabled at compilation.
.Sh BUGS
Please report bugs of any kind to <[e-mail]> or on the project website:
https://libewf.uitwisselplatform.nl/
.Sh AUTHOR
These man pages were written by Kees Mastwijk.
Alterations for distribution have been made by Joachim Metz.
.Sh COPYRIGHT
Copyright 2006-2007 Kees Mastwijk, Hoffmann Investigations <[e-mail]> and contributors.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
.Sh SEE ALSO
.Xr ewfacquire 1 ,
.Xr ewfacquirestream 1 ,
.Xr ewfexport 1 ,
.Xr ewfverify 1