ewfverify

NAME
ewfverify - verifies media data stored in EWF files

SYNOPSIS
ewfverify [-A codepage] [-d digest_type] [-l log_filename] [-p process_buffer_size] [-hqvVw] ewf_files

DESCRIPTION
ewfverify is a utility to verify media data stored in EWF files.

ewfverify is part of the libewf package. libewf is a library to support the Expert Witness Compression Format (EWF). libewf supports both the SMART format (EWF-S01) and the EnCase format (EWF-E01). libewf currently does not support the Logical Volume format (EWF-L01). EWF-X is an expirimental format intended for testing purposes to enhance the EWF format. libewf allows you to read and write media data in the EWF format.

ewf_files the first or the entire set of EWF segment files

The options are as follows:

-A codepage
    the codepage of header section, options: ascii (default), windows-874, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257, windows-1258

-d digest_type
    calculate additional digest (hash) types besides md5, options: sha1

-h  shows this help

-l log_filename
    logs verification errors and the digest (hash) to the log filename

-p process_buffer_size
    the process buffer size (default is the chunk size)

-q  quiet shows no status information

-v  verbose output to stderr

-V  print version

-w  wipe sectors on CRC error (mimic EnCase like behavior)

ENVIRONMENT
None

FILES
None

EXAMPLES

    # ewfverify floppy.E01
    ewfverify 20090229 (libewf 20090229, libuna 20090124, zlib 1.2.3, libcrypto 0.9.8g, libuuid)
    Verify started at: Sat Feb 28 19:21:51 2009
    This could take a while.
    Status: at 2%.
            verified 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes).
        ...
    Status: at 100%.
            verified 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes).
            completion in 1 second(s) with 1 MiB/s (1474560 bytes/second).
    Verify completed at: Sat Feb 28 19:21:52 2009
    Read: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).
    MD5 hash stored in file:        ae1ce8f5ac079d3ee93f97fe3792bda3
    MD5 hash calculated over data:  ae1ce8f5ac079d3ee93f97fe3792bda3
    ewfverify: SUCCESS

DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

BUGS
Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website: http://libewf.sourceforge.net/

AUTHOR

These man pages were written by Kees Mastwijk.

Alterations for distribution have been made by Joachim Metz.

COPYRIGHT

Copyright 2006-2009 Kees Mastwijk, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

SEE ALSO
ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfinfo(1)