Struct EwfReader 

pub struct EwfReader { /* private fields */ }

A reader for Expert Witness Format (E01/EWF) forensic disk images.

Implements Read and Seek over the logical disk image stored across one or more .E01/.E02/… segment files.

Example

use std::io::Read;
let mut reader = ewf::EwfReader::open("disk.E01").unwrap();
let mut buf = [0u8; 512];
reader.read_exact(&mut buf).unwrap(); // read first sector

Implementations

impl EwfReader

pub fn open<P: AsRef<Path>>(path: P) -> Result<Self>

Open an EWF image from a path to the first segment file (e.g. image.E01).

Automatically discovers and opens all additional segment files.

pub fn open_with_cache_size<P: AsRef<Path>>( path: P, cache_size: usize, ) -> Result<Self>

Open an EWF image with a custom LRU cache size.

cache_size is the number of decompressed chunks to keep in memory. Each chunk is typically 32 KB, so 100 chunks ≈ 3.2 MB, 1000 ≈ 32 MB.

pub fn open_segments(paths: &[PathBuf]) -> Result<Self>

Open an EWF image from explicit segment file paths (must be in order).

pub fn open_segments_with_cache_size( paths: &[PathBuf], cache_size: usize, ) -> Result<Self>

Open from explicit segment paths with a custom LRU cache size.

pub fn total_size(&self) -> u64

Total logical size of the disk image in bytes.

pub fn chunk_size(&self) -> u64

Chunk size in bytes (typically 32768).

pub fn chunk_count(&self) -> usize

Number of chunks in the image.

Trait Implementations

impl Read for EwfReader

fn read(&mut self, buf: &mut [u8]) -> Result<usize>

Pull some bytes from this source into the specified buffer, returning how many bytes were read.

fn read_vectored(&mut self, bufs: &mut [IoSliceMut<'_>]) -> Result<usize, Error>

Like read, except that it reads into a slice of buffers.

fn is_read_vectored(&self) -> bool

🔬This is a nightly-only experimental API. (can_vector)

Determines if this Reader has an efficient read_vectored implementation.

fn read_to_end(&mut self, buf: &mut Vec<u8>) -> Result<usize, Error>

Reads all bytes until EOF in this source, placing them into buf.

fn read_to_string(&mut self, buf: &mut String) -> Result<usize, Error>

Reads all bytes until EOF in this source, appending them to buf.

fn read_exact(&mut self, buf: &mut [u8]) -> Result<(), Error>

Reads the exact number of bytes required to fill buf.

fn read_buf(&mut self, buf: BorrowedCursor<'_>) -> Result<(), Error>

🔬This is a nightly-only experimental API. (read_buf)

Pull some bytes from this source into the specified buffer.

fn read_buf_exact(&mut self, cursor: BorrowedCursor<'_>) -> Result<(), Error>

🔬This is a nightly-only experimental API. (read_buf)

Reads the exact number of bytes required to fill cursor.

fn by_ref(&mut self) -> &mut Self

where Self: Sized,

Creates a “by reference” adapter for this instance of Read.

fn bytes(self) -> Bytes<Self>

where Self: Sized,

Transforms this Read instance to an Iterator over its bytes.

fn chain<R>(self, next: R) -> Chain<Self, R>

where R: Read, Self: Sized,

Creates an adapter which will chain this stream with another.

fn take(self, limit: u64) -> Take<Self>

where Self: Sized,

Creates an adapter which will read at most limit bytes from it.

fn read_array<const N: usize>(&mut self) -> Result<[u8; N], Error>

where Self: Sized,

🔬This is a nightly-only experimental API. (read_array)

Read and return a fixed array of bytes from this source.

impl Seek for EwfReader

fn seek(&mut self, pos: SeekFrom) -> Result<u64>

Seek to an offset, in bytes, in a stream.

fn rewind(&mut self) -> Result<(), Error>

Rewind to the beginning of a stream.

fn stream_len(&mut self) -> Result<u64, Error>

🔬This is a nightly-only experimental API. (seek_stream_len)

Returns the length of this stream (in bytes).

fn stream_position(&mut self) -> Result<u64, Error>

Returns the current seek position from the start of the stream.

fn seek_relative(&mut self, offset: i64) -> Result<(), Error>

Seeks relative to the current position.