Skip to main content

Crate ewf

Crate ewf 

Source
Expand description

Pure Rust reader for Expert Witness Format (E01/EWF) forensic disk images.

Provides a Read + Seek interface over E01 images, supporting:

  • EWF v1 format (.E01 files produced by EnCase, FTK Imager, etc.)
  • Multi-segment images (.E01, .E02, …, .E99, .EAA, …, .EZZ)
  • zlib-compressed chunks with LRU caching
  • O(1) seeking via flat chunk index

Structs§

EwfFileHeader
Parsed EWF v1 file header. Present at offset 0 of every segment file.
EwfReader
A reader for Expert Witness Format (E01/EWF) forensic disk images.
EwfVolume
Image geometry extracted from the EWF volume section.
SectionDescriptor
Parsed EWF v1 section descriptor. Forms a linked list within each segment.
TableEntry
A single table entry: 4-byte bitfield where bit 31 = compressed, bits 0-30 = offset.

Enums§

EwfError

Constants§

EVF_SIGNATURE
EWF v1 magic signature: "EVF\x09\x0d\x0a\xff\x00" (8 bytes).

Type Aliases§

Result