Crate ewf_image

Expand description

Rust library for reading and writing Expert Witness Format forensic images.

ewf_image provides direct Rust APIs for working with Expert Witness Format images. It can open physical, logical, SMART, and EWF2 segment families, expose metadata and stored hashes, read the logical media stream, walk logical single-file catalogs, and create EWF output. CLI and mount layers are not currently implemented.

§Terminology

Logical media size is the decoded byte length exposed by Image::media_size and ImageInfo::logical_size. Segment set size is the total byte length of the opened EWF container files, as reported by Image::segment_set_size. Chunks are the stored allocation units used by EWF tables. Logical EWF images can also contain a single-file catalog, where each entry describes a file-like object stored inside the image.

§Supported container families

EWF1 physical .E01 / EVF images.
EWF1 logical .L01 / LVF images.
EWF1 SMART .S01 images.
EWF2 physical .Ex01 images.
EWF2 logical .Lx01 images.

§Reading

use std::io::Read;

fn main() -> ewf_image::Result<()> {
    let image = ewf_image::Image::open("case.E01")?;
    let info = image.info();

    println!("{:?}: {} bytes", info.format, info.logical_size);
    println!("segments: {}", image.number_of_segments());

    let mut sector = vec![0; 512];
    image.cursor().read_exact(&mut sector)?;

    let mut later_sector = vec![0; 512];
    image.read_at(&mut later_sector, 4096)?;

    Ok(())
}

§Metadata and hashes

fn main() -> ewf_image::Result<()> {
    let image = ewf_image::Image::open("case.E01")?;

    if let Some(case_number) = image.header_value("case_number") {
        println!("case: {case_number}");
    }

    if let Some(md5) = image.hash_value("MD5") {
        println!("stored MD5: {md5}");
    }

    #[cfg(feature = "verify")]
    {
        let verification = image.verify()?;
        println!("MD5 match: {:?}", verification.md5_match);
        println!("SHA1 match: {:?}", verification.sha1_match);
    }

    Ok(())
}

§Writing

use std::fs::File;

fn main() -> ewf_image::Result<()> {
    let mut input = File::open("disk.raw")?;

    let mut options = ewf_image::WriteOptions::default();
    options.format = ewf_image::WriteFormat::Ewf2Physical;
    options.compression = ewf_image::WriteCompression::Zlib;
    options.metadata.set_header_value("case_number", "CASE-001");

    let mut writer = ewf_image::EwfWriter::create("case.Ex01", options)?;
    std::io::copy(&mut input, &mut writer)?;
    writer.finish()?;

    Ok(())
}

§Feature flags

verify is enabled by default and adds Image::verify() plus VerifyResult for streamed MD5/SHA1 verification. Stored hash parsing, EWF2 section integrity checks, and writer hash support are available without this feature.
external-fixtures enables ignored integration tests that require local EWF corpora and external EWF tools. It does not change library behavior.

§Limitations

Encrypted EWF2 images are detected and rejected, but decryption and encrypted writing are not implemented. Secondary/shadow target mirroring is supported by the file-backed writer. Base-plus-overlay delta/shadow images are not implemented.

Structs§

AcquisitionError: Acquisition error range recorded in image metadata.
CompressionFlags: Compression flags recorded in EWF metadata.
CompressionValues: Compression level and flags recorded together.
DataChunk: Decoded logical data chunk.
EncodedDataChunk: Encoded data chunk as stored in an EWF segment.
EwfMetadata: Parsed case and acquisition metadata.
EwfWriter: Incremental EWF writer.
Image: Opened EWF image and logical media reader.
ImageCursor: Seekable cursor over an Image logical media stream.
ImageInfo: Parsed summary of an opened EWF image.
MediaFlags: Media flags recorded for an image.
MediaInfo: Parsed media geometry and storage metadata.
MemoryExtent: Memory acquisition extent recorded in pages.
OpenOptions: Options that control how an image is opened and read.
ReaderCacheInfo: Configured and observed payload bytes for one shared EWF reader cache set.
ReaderStatistics: Cumulative performance counters for one shared EWF image reader.
SectorRange: Inclusive start plus count sector range.
SegmentFileVersion: EWF2 segment file version.
SingleFileAttribute: Extended attribute for a logical single-file entry.
SingleFileCursor: Seekable cursor over one logical single-file catalog entry.
SingleFileEntry: Entry in a logical single-file catalog.
SingleFileExtent: Data extent for a logical single-file entry.
SingleFilePermission: Access-control entry for a logical single-file entry.
SingleFilePermissionGroup: Access-control group for logical single-file entries.
SingleFileSource: Source record for logical single-file metadata.
SingleFileSubject: Subject record for logical single-file metadata.
SingleFilesAuxTables: Preserved auxiliary EWF2 single-file tables.
SingleFilesInfo: Logical single-file catalog metadata.
StoredHashes: Stored hash values parsed from an image.
VerifyResult: Result of streamed logical media hash verification.
WriteCompressionValues: Compression settings for writer output.
WriteHashes: Hash values configured for writer output.
WriteMediaProfile: Media type and acquisition flags configured for writer output.
WriteOptions: Configuration used to create an EwfWriter.
WriteResult: Result returned after finalizing writer output.

Enums§

ChunkCacheCapacity: Capacity policy for the decoded-chunk cache.
CompressionLevel: Compression level recorded in EWF metadata.
CompressionMethod: Compression method recorded for stored chunks.
DataChunkEncoding: Encoding used for a data chunk payload.
EwfError: Error type used by EWF readers, writers, and probe helpers.
Format: Top-level EWF container generation.
FormatProfile: Producer/profile inferred from EWF metadata and section layout.
HeaderCodepage: Codepage used for EWF1 textual header values.
HeaderDateFormat: Formatting applied when returning parsed EWF header date values.
MediaType: Media type recorded for an image.
OpenStrictness: Strictness used while opening an image.
SingleFileEntryType: Type of a logical single-file catalog entry.
WriteCompression: Compression method for writer output.
WriteCompressionLevel: Compression level for writer output.
WriteFormat: Output EWF format selected for writing.

Constants§

SINGLE_FILE_PATH_SEPARATOR: Path separator used by EWF2 logical single-file catalogs.

Traits§

SegmentReader: Reader type accepted by Image::open_readers.

Functions§

check_file_corruption: Returns whether a single segment appears corrupt based on structural checks.
check_file_encryption: Returns whether a file appears to be an encrypted EWF2 segment.
check_file_signature: Returns whether a file starts with a recognized EWF segment signature.
check_segment_files_corruption: Returns whether a segment set appears corrupt based on structural checks.
check_segment_files_encryption: Returns whether any segment in a segment set appears to be encrypted.

Type Aliases§

Result: Result type returned by fallible ewf_image APIs.

Crate ewf_image

Crate ewf_image Copy item path

§Terminology

§Supported container families

§Reading

§Metadata and hashes

§Writing

§Feature flags

§Limitations

Structs§

Enums§

Constants§

Traits§

Functions§

Type Aliases§

Crate ewf_image