Crate ewf 

Pure Rust reader for Expert Witness Format (E01/EWF) forensic disk images.

Provides a Read + Seek interface over E01 images, supporting:

• EWF v1 format (.E01 files produced by EnCase, FTK Imager, etc.)
• EWF v2 format (.Ex01/.Lx01 from EnCase 7+) with auto-detection
• L01 logical evidence files
• Multi-segment images (.E01-.EZZ for v1, .Ex01-.EzZZ for v2)
• zlib-compressed chunks with LRU caching
• O(1) seeking via flat chunk index
• Hash verification (verify()) with MD5 and SHA-1
• Case metadata, stored hashes, and acquisition error parsing

Re-exports

pub use sections::EwfFileHeader;

pub use sections::EwfVolume;

pub use sections::SectionDescriptor;

pub use sections::TableEntry;

pub use sections::TableHeader;

pub use sections::EVF_SIGNATURE;

pub use sections::FILE_HEADER_SIZE;

pub use sections::SECTION_DESCRIPTOR_SIZE;

pub use sections::TABLE_HEADER_SIZE;

Modules

sections

EWF v1 on-disk structural primitives: signatures, descriptor / volume / table-header / table-entry layout, their stored adler-32 CRCs, and the shared sections::adler32 entry point. This is the single source of truth for the EWF v1 layout — consumers (e.g. an integrity auditor) parse and CRC-check against these instead of re-deriving offsets.

Structs

AcquisitionError

A range of sectors that had read errors during acquisition.

EwfMetadata

Case and acquisition metadata extracted from EWF header sections.

EwfReader

A reader for Expert Witness Format (E01/EWF) forensic disk images.

StoredHashes

Integrity hashes stored within the EWF image by the acquisition tool.

VerifyResult

Result of verifying the EWF image integrity by recomputing media hashes.

Enums

EwfError

SegmentSource

A positioned, cursor-free reader over one EWF segment’s bytes.

Traits

SegmentBacking

A positioned-read backing for a SegmentSource::Backing segment.

Functions

parse_error2_data

Parse EWF error2 section data into acquisition error entries.

Type Aliases

Result