libewf.3

来自「sleuthit-2.09 一个磁盘的工具集」· 3 代码 · 共 288 行

.Dd May 12, 2007
.Dt libewf 3
.Os libewf
.Sh NAME
.Nm libewf.h
.Nd Library to read from and write to the Expert Witness Compression Format (EWF) file format
.Sh LIBRARY
.Lb libewf
.Sh SYNOPSIS
.In libewf.h
.Ft int8_t
.Fn libewf_check_file_signature "const char *filename"
.Ft LIBEWF_HANDLE *
.Fn libewf_open "char * const filenames[], uint16_t file_amount, uint8_t flags"
.Ft off_t
.Fn libewf_seek_offset "LIBEWF_HANDLE *handle, off_t offset"
.Ft ssize_t
.Fn libewf_read_buffer "LIBEWF_HANDLE *handle, void *buffer, size_t size"
.Ft ssize_t
.Fn libewf_read_random "LIBEWF_HANDLE *handle, void *buffer, size_t size, off_t offset"
.Ft ssize_t
.Fn libewf_write_buffer "LIBEWF_HANDLE *handle, void *buffer, size_t size"
.Ft ssize_t
.Fn libewf_write_random "LIBEWF_HANDLE *handle, void *buffer, size_t size, off_t offset"
.Ft ssize_t
.Fn libewf_write_finalize "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_close "LIBEWF_HANDLE *handle"
.Ft int32_t
.Fn libewf_get_bytes_per_sector "LIBEWF_HANDLE *handle"
.Ft int32_t
.Fn libewf_get_amount_of_sectors "LIBEWF_HANDLE *handle"
.Ft int32_t
.Fn libewf_get_chunk_size "LIBEWF_HANDLE *handle"
.Ft int32_t
.Fn libewf_get_error_granularity "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_get_compression_level "LIBEWF_HANDLE *handle"
.Ft int64_t
.Fn libewf_get_media_size "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_get_media_type "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_get_media_flags "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_get_volume_type "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_get_format "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_get_guid "LIBEWF_HANDLE *handle, uint8_t *guid, size_t size"
.Ft int64_t
.Fn libewf_get_write_amount_of_chunks "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_set_media_values "LIBEWF_HANDLE *handle, uint32_t sectors_per_chunk, uint32_t bytes_per_sector"
.Ft int8_t
.Fn libewf_set_guid "LIBEWF_HANDLE *handle, uint8_t *guid, size_t size"
.Ft int8_t
.Fn libewf_set_write_segment_file_size "LIBEWF_HANDLE *handle, uint32_t segment_file_size"
.Ft int8_t
.Fn libewf_set_write_compression_values "LIBEWF_HANDLE *handle, int8_t compression_level, uint8_t compress_empty_block"
.Ft int8_t
.Fn libewf_set_write_media_type "LIBEWF_HANDLE *handle, uint8_t media_type, uint8_t volume_type"
.Ft int8_t
.Fn libewf_set_write_format "LIBEWF_HANDLE *handle, uint8_t format"
.Ft int8_t
.Fn libewf_set_write_input_size "LIBEWF_HANDLE *handle, uint64_t input_write_size"
.Ft int8_t
.Fn libewf_set_swap_byte_pairs "LIBEWF_HANDLE *handle, uint8_t swap_byte_pairs"
.Ft int8_t
.Fn libewf_parse_header_values "LIBEWF_HANDLE *handle, uint8_t date_format"
.Ft int8_t
.Fn libewf_parse_hash_values "LIBEWF_HANDLE *handle"
.Ft int8_t
.Fn libewf_add_acquiry_error "LIBEWF_HANDLE *handle, uint64_t sector, uint32_t amount_of_sectors"
.Ft void
.Fn libewf_set_notify_values "FILE *stream, uint8_t verbose"
.Pp
When the library was compiled with narrow character support (default) the following functions are available
.Ft const char *
.Fn libewf_get_version "void"
.Ft int8_t
.Fn libewf_get_header_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_case_number "LIBEWF_HANDLE *handle, char *case_number, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_description "LIBEWF_HANDLE *handle, char *description, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_examiner_name "LIBEWF_HANDLE *handle, char *examiner_name, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_evidence_number "LIBEWF_HANDLE *handle, char *evidence_number, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_notes "LIBEWF_HANDLE *handle, char *notes, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_acquiry_date "LIBEWF_HANDLE *handle, char *acquiry_date, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_system_date "LIBEWF_HANDLE *handle, char *system_date, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, char *acquiry_operating_system, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, char *acquiry_software_version, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_password "LIBEWF_HANDLE *handle, char *password, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_compression_type "LIBEWF_HANDLE *handle, char *compression_type, size_t length"
.Ft int8_t
.Fn libewf_get_hash_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length"
.Ft int8_t
.Fn libewf_set_header_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_case_number "LIBEWF_HANDLE *handle, char *case_number, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_description "LIBEWF_HANDLE *handle, char *description, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_examiner_name "LIBEWF_HANDLE *handle, char *examiner_name, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_evidence_number "LIBEWF_HANDLE *handle, char *evidence_number, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_notes "LIBEWF_HANDLE *handle, char *notes, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_acquiry_date "LIBEWF_HANDLE *handle, char *acquiry_date, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_system_date "LIBEWF_HANDLE *handle, char *system_date, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, char *acquiry_operating_system, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, char *acquiry_software_version, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_password "LIBEWF_HANDLE *handle, char *password, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_compression_type "LIBEWF_HANDLE *handle, char *compression_type, size_t length"
.Ft int8_t
.Fn libewf_set_hash_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length"
.Ft int8_t
.Fn libewf_calculate_md5_hash "LIBEWF_HANDLE *handle, char *string, size_t length"
.Ft int8_t
.Fn libewf_get_stored_md5_hash "LIBEWF_HANDLE *handle, char *string, size_t length"
.Ft int8_t
.Fn libewf_get_calculated_md5_hash "LIBEWF_HANDLE *handle, char *string, size_t length"
.Pp
When the library was compiled with wide character support the following functions are available instead of the narrow character functions
.Ft const wchar_t *
.Fn libewf_get_version "void"
.Ft int8_t
.Fn libewf_get_header_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_case_number "LIBEWF_HANDLE *handle, wchar_t *case_number, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_description "LIBEWF_HANDLE *handle, wchar_t *description, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_examiner_name "LIBEWF_HANDLE *handle, wchar_t *examiner_name, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_evidence_number "LIBEWF_HANDLE *handle, wchar_t *evidence_number, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_notes "LIBEWF_HANDLE *handle, wchar_t *notes, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_acquiry_date "LIBEWF_HANDLE *handle, wchar_t *acquiry_date, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_system_date "LIBEWF_HANDLE *handle, wchar_t *system_date, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, wchar_t *acquiry_operating_system, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, wchar_t *acquiry_software_version, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_password "LIBEWF_HANDLE *handle, wchar_t *password, size_t length"
.Ft int8_t
.Fn libewf_get_header_value_compression_type "LIBEWF_HANDLE *handle, wchar_t *compression_type, size_t length"
.Ft int8_t
.Fn libewf_get_hash_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length"
.Ft int8_t
.Fn libewf_set_header_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_case_number "LIBEWF_HANDLE *handle, wchar_t *case_number, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_description "LIBEWF_HANDLE *handle, wchar_t *description, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_examiner_name "LIBEWF_HANDLE *handle, wchar_t *examiner_name, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_evidence_number "LIBEWF_HANDLE *handle, wchar_t *evidence_number, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_notes "LIBEWF_HANDLE *handle, wchar_t *notes, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_acquiry_date "LIBEWF_HANDLE *handle, wchar_t *acquiry_date, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_system_date "LIBEWF_HANDLE *handle, wchar_t *system_date, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, wchar_t *acquiry_operating_system, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, wchar_t *acquiry_software_version, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_password "LIBEWF_HANDLE *handle, wchar_t *password, size_t length"
.Ft int8_t
.Fn libewf_set_header_value_compression_type "LIBEWF_HANDLE *handle, wchar_t *compression_type, size_t length"
.Ft int8_t
.Fn libewf_set_hash_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length"
.Ft int8_t
.Fn libewf_calculate_md5_hash "LIBEWF_HANDLE *handle, wchar_t *string, size_t length"
.Ft int8_t
.Fn libewf_get_stored_md5_hash "LIBEWF_HANDLE *handle, wchar_t *string, size_t length"
.Ft int8_t
.Fn libewf_get_calculated_md5_hash "LIBEWF_HANDLE *handle, wchar_t *string, size_t length"
.Pp
When wide character support functions like wmain and wopen are present and libewf is compiled with
.Ar HAVE_WIDE_CHARACTER_SUPPORT_FUNCTIONS
the following functions will replace their narrow character functions.
.Ft int8_t
.Fn libewf_check_file_signature "const wchar_t *filename"
.Ft LIBEWF_HANDLE *
.Fn libewf_open "wchar_t * const filenames[], uint16_t file_amount, uint8_t flags"
.Sh DESCRIPTION
The
.Fn libewf_get_version
function is used to retrieve the library version.
.Pp
The
.Fn libewf_check_file_signature
function is used to test if the EWF file signature is present within a certain
.Ar filename.
.Pp
The
.Fn libewf_open ,
.Fn libewf_seek_offset ,
.Fn libewf_read_buffer ,
.Fn libewf_read_random ,
.Fn libewf_write_buffer ,
.Fn libewf_write_random ,
.Fn libewf_close
functions can be used to open, seek in, read from, write to and close a set of EWF files.
.Pp
The
.Fn libewf_write_finalize
function needs to be called after writing a set of EWF files without knowing the input size upfront, e.g. reading from a pipe.
.Fn libewf_write_finalize
will the necessary correction to the set of EWF files.
Note that certain information like the calculated MD5 has is not available if
.Fn libewf_write_finalize
has not been issued.
.Pp
The
.Fn libewf_get_*
functions can be used to retrieve information from the
.Ar handle.
This information is read from a set of EWF files when
.Fn libewf_open
is used. The
.Fn libewf_parse_header_values,
.Fn libewf_parse_hash_values
functions need to be called before retrieving header or hash values.
.Pp
The
.Fn libewf_set_*
functions can be used to set information in the
.Ar handle.
This information is written to a set of EWF files when
.Fn libewf_write_buffer
is used.
.Pp
The
.Fn libewf_parse_header_values
function can be used to parse the values in the header strings within a set of EWF files.
.Pp
The
.Fn libewf_parse_hash_values
function can be used to parse the values in the hash string within a set of EWF files. The hash string is currently only present in the EWF-X format.
.Pp
The
.Fn libewf_add_acquiry_error
function can be used to add an acquiry error (a read error during acquiry) to be written into a set of EWF files.
.Pp
The
.Fn libewf_set_notify_values
function can be used to direct the warning, verbose and debug output from the library.
.Sh RETURN VALUES
Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values refer to libewf.h
.Sh ENVIRONMENT
None
.Sh FILES
None
.Sh BUGS
Please report bugs of any kind to <[e-mail]> or on the project website:
https://libewf.uitwisselplatform.nl/
.Sh AUTHOR
These man pages were written by Joachim Metz.
.Sh COPYRIGHT
Copyright 2006-2007 Joachim Metz, Hoffmann Investigations <[e-mail]> and contributors.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
.Sh SEE ALSO
the libewf.h include file