Expand description
Pure Rust reader for Expert Witness Format (E01/EWF) forensic disk images.
Provides a Read + Seek interface over E01 images, supporting:
- EWF v1 format (
.E01files produced by EnCase, FTK Imager, etc.) - Multi-segment images (
.E01,.E02, …,.E99,.EAA, …,.EZZ) - zlib-compressed chunks with LRU caching
- O(1) seeking via flat chunk index
Structs§
- EwfFile
Header - Parsed EWF v1 file header. Present at offset 0 of every segment file.
- EwfReader
- A reader for Expert Witness Format (E01/EWF) forensic disk images.
- EwfVolume
- Image geometry extracted from the EWF volume section.
- Section
Descriptor - Parsed EWF v1 section descriptor. Forms a linked list within each segment.
- Table
Entry - A single table entry: 4-byte bitfield where bit 31 = compressed, bits 0-30 = offset.
Enums§
Constants§
- EVF_
SIGNATURE - EWF v1 magic signature:
"EVF\x09\x0d\x0a\xff\x00"(8 bytes).