Linux Certif

Toute la documentation sur la certification Linux LPI

libewf

BSD mandoc
libewf

NAME

libewf.h - Library to read from and write to the Expert Witness Compression Format (EWF) file format

LIBRARY

Lb libewf

SYNOPSIS

In libewf.h

Support functions Ft const char * Fn libewf_get_version void Ft uint8_t Fn libewf_get_flags_read Ft uint8_t Fn libewf_get_flags_read_write Ft uint8_t Fn libewf_get_flags_write Ft uint8_t Fn libewf_get_flags_write_resume Ft int Fn libewf_check_file_signature const char *filename Ft int Fn libewf_glob const char *filename, size_t filename_length, uint8_t format, char ** filenames[]

Available when compiled with wide character string support: Ft int Fn libewf_check_file_signature_wide const wchar_t *filename Ft int Fn libewf_glob_wide const wchar_t *filename, size_t filename_length, uint8_t format, wchar_t ** filenames[]

Support functions (APIv2) Ft int Fn libewf_check_file_signature const char *filename, libewf_error_t **error Ft int Fn libewf_glob const char *filename, size_t filename_length, uint8_t format, char **filenames[], int *amount_of_filenames, libewf_error_t **error Ft int Fn libewf_glob_free char *filenames[], int amount_of_filenames, libewf_error_t **error

Available when compiled with wide character string support: Ft int Fn libewf_check_file_signature_wide const wchar_t *filename, libewf_error_t **error Ft int Fn libewf_glob_wide const wchar_t *filename, size_t filename_length, uint8_t format, wchar_t **filenames[], int *amount_of_filenames, libewf_error_t **error Ft int Fn libewf_glob_free_wide wchar_t *filenames[], int amount_of_filenames, libewf_error_t **error

Available when compiled with libbfio support: Ft int Fn libewf_check_file_signature_file_io_handle libbfio_handle_t *file_io_handle, libewf_error_t **error

Notify functions (APIv1) Ft void Fn libewf_set_notify_values FILE *stream, uint8_t verbose

Notify functions (APIv2) Ft void Fn libewf_notify_set_verbose int verbose Ft int Fn libewf_notify_set_stream FILE *stream, libewf_error_t **error Ft int Fn libewf_notify_stream_open const char *filename, libewf_error_t **error Ft int Fn libewf_notify_stream_close libewf_error_t **error

Error functions (APIv2) Ft void Fn libewf_error_free libewf_error_t **error Ft int Fn libewf_error_fprint libewf_error_t *error, FILE *stream Ft int Fn libewf_error_sprint libewf_error_t *error, char *string, size_t size Ft int Fn libewf_error_backtrace_fprint libewf_error_t *error, FILE *stream Ft int Fn libewf_error_backtrace_sprint libewf_error_t *error, char *string, size_t size

File/Handle functions (APIv1) Ft int Fn libewf_signal_abort libewf_handle_t *handle Ft libewf_handle_t * Fn libewf_open char * const filenames[], int amount_of_filenames, uint8_t flags Ft int Fn libewf_close libewf_handle_t *handle Ft off64_t Fn libewf_seek_offset libewf_handle_t *handle, off64_t offset Ft off64_t Fn libewf_get_offset libewf_handle_t *handle Ft ssize_t Fn libewf_raw_read_prepare_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size, void *uncompressed_buffer, size_t *uncompressed_buffer_size, int8_t is_compressed, EWF_CRC chunk_crc, int8_t read_crc Ft ssize_t Fn libewf_raw_read_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size, int8_t *is_compressed, uint32_t *chunk_crc, int8_t *read_crc Ft ssize_t Fn libewf_read_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size Ft ssize_t Fn libewf_read_random libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset Ft ssize_t Fn libewf_raw_write_prepare_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size, void *compressed_buffer, size_t *compressed_buffer_size, int8_t *is_compressed, uint32_t *chunk_crc, int8_t *write_crc Ft ssize_t Fn libewf_raw_write_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size, size_t data_size, int8_t is_compressed, uint32_t chunk_crc, int8_t write_crc Ft ssize_t Fn libewf_write_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size Ft ssize_t Fn libewf_write_random libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset Ft ssize_t Fn libewf_write_finalize libewf_handle_t *handle Ft int Fn libewf_get_segment_filename libewf_handle_t *handle, char *filename, size_t filename_size Ft int Fn libewf_set_segment_filename libewf_handle_t *handle, const char *filename, size_t filename_length Ft int Fn libewf_get_segment_file_size libewf_handle_t *handle, size64_t *segment_file_size Ft int Fn libewf_set_segment_file_size libewf_handle_t *handle, size64_t segment_file_size Ft int Fn libewf_get_delta_segment_filename libewf_handle_t *handle, char *filename, size_t filename_size Ft int Fn libewf_set_delta_segment_filename libewf_handle_t *handle, const char *filename, size_t filename_length Ft int Fn libewf_get_delta_segment_file_size libewf_handle_t *handle, size64_t *delta_segment_file_size Ft int Fn libewf_set_delta_segment_file_size libewf_handle_t *handle, size64_t delta_segment_file_size

Available when compiled with wide character string support: Ft libewf_handle_t * Fn libewf_open_wide wchar_t * const filenames[], int amount_of_filenames, uint8_t flags Ft int Fn libewf_get_segment_filename_wide libewf_handle_t *handle, wchar_t *filename, size_t filename_size Ft int Fn libewf_set_segment_filename_wide libewf_handle_t *handle, const wchar_t *filename, size_t filename_length Ft int Fn libewf_get_delta_segment_filename_wide libewf_handle_t *handle, wchar_t *filename, size_t filename_size Ft int Fn libewf_set_delta_segment_filename_wide libewf_handle_t *handle, const wchar_t *filename, size_t filename_length

File/Handle functions (APIv2) Ft int Fn libewf_handle_signal_abort libewf_handle_t *handle, libewf_error_t **error Ft int Fn libewf_handle_initialize libewf_handle_t **handle, libewf_error_t **error Ft int Fn libewf_handle_free libewf_handle_t **handle, libewf_error_t **error Ft int Fn libewf_handle_open libewf_handle_t *handle, char * const filenames[], int amount_of_filenames, uint8_t flags, libewf_error_t **error Ft int Fn libewf_handle_close libewf_handle_t *handle, libewf_error_t **error Ft off64_t Fn libewf_handle_seek_offset libewf_handle_t *handle, off64_t offset, int whence, libewf_error_t **error Ft off64_t Fn libewf_handle_get_offset libewf_handle_t *handle, libewf_error_t **error Ft ssize_t Fn libewf_handle_prepare_read_chunk libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, void *uncompressed_buffer, size_t *uncompressed_buffer_size, int8_t is_compressed, EWF_CRC chunk_crc, int8_t read_crc, libewf_error_t **error Ft ssize_t Fn libewf_handle_read_chunk libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, int8_t *is_compressed, void *crc_buffer, uint32_t *chunk_crc, int8_t *read_crc, libewf_error_t **error Ft ssize_t Fn libewf_handle_read_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size, libewf_error_t **error Ft ssize_t Fn libewf_handle_read_random libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset, libewf_error_t **error Ft ssize_t Fn libewf_handle_prepare_write_chunk libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, void *compressed_buffer, size_t *compressed_buffer_size, int8_t *is_compressed, uint32_t *chunk_crc, int8_t *write_crc, libewf_error_t **error Ft ssize_t Fn libewf_handle_write_chunk libewf_handle_t *handle, void *chunk_buffer, size_t chunk_buffer_size, size_t data_size, int8_t is_compressed, void *crc_buffer, uint32_t chunk_crc, int8_t write_crc, libewf_error_t **error Ft ssize_t Fn libewf_handle_write_buffer libewf_handle_t *handle, void *buffer, size_t buffer_size, libewf_error_t **error Ft ssize_t Fn libewf_handle_write_random libewf_handle_t *handle, void *buffer, size_t buffer_size, off64_t offset, libewf_error_t **error Ft ssize_t Fn libewf_handle_write_finalize libewf_handle_t *handle, libewf_error_t **error Ft int Fn libewf_handle_get_segment_filename_size libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error Ft int Fn libewf_handle_get_segment_filename libewf_handle_t *handle, char *filename, size_t filename_size, libewf_error_t **error Ft int Fn libewf_handle_set_segment_filename libewf_handle_t *handle, const char *filename, size_t filename_length, libewf_error_t **error Ft int Fn libewf_handle_get_segment_file_size libewf_handle_t *handle, size64_t *segment_file_size, libewf_error_t **error Ft int Fn libewf_handle_set_segment_file_size libewf_handle_t *handle, size64_t segment_file_size, libewf_error_t **error Ft int Fn libewf_handle_get_delta_segment_filename_size libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error Ft int Fn libewf_handle_get_delta_segment_filename libewf_handle_t *handle, char *filename, size_t filename_size, libewf_error_t **error Ft int Fn libewf_handle_set_delta_segment_filename libewf_handle_t *handle, const char *filename, size_t filename_length, libewf_error_t **error Ft int Fn libewf_handle_get_delta_segment_file_size libewf_handle_t *handle, size64_t *delta_segment_file_size, libewf_error_t **error Ft int Fn libewf_handle_set_delta_segment_file_size libewf_handle_t *handle, size64_t delta_segment_file_size, libewf_error_t **error Ft int Fn libewf_handle_get_filename_size libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error Ft int Fn libewf_handle_get_filename libewf_handle_t *handle, char *filename, size_t filename_size, libewf_error_t **error

Available when compiled with wide character string support: Ft int Fn libewf_handle_open_wide libewf_handle_t *handle, wchar_t * const filenames[], int amount_of_filenames, uint8_t flags Ft int Fn libewf_handle_get_segment_filename_size_wide libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error Ft int Fn libewf_handle_get_segment_filename_wide libewf_handle_t *handle, wchar_t *filename, size_t filename_size, libewf_error_t **error Ft int Fn libewf_handle_set_segment_filename_wide libewf_handle_t *handle, const wchar_t *filename, size_t filename_length, libewf_error_t **error Ft int Fn libewf_handle_get_delta_segment_filename_size_wide libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error Ft int Fn libewf_handle_get_delta_segment_filename_wide libewf_handle_t *handle, wchar_t *filename, size_t filename_size, libewf_error_t **error Ft int Fn libewf_handle_set_delta_segment_filename_wide libewf_handle_t *handle, const wchar_t *filename, size_t filename_length, libewf_error_t **error Ft int Fn libewf_handle_get_filename_size_wide libewf_handle_t *handle, size_t *filename_size, libewf_error_t **error Ft int Fn libewf_handle_get_filename_wide libewf_handle_t *handle, wchar_t *filename, size_t filename_size, libewf_error_t **error

Available when compiled with libbfio support: Ft int Fn libewf_handle_open_file_io_pool libewf_handle_t *handle, libbfio_pool_t *file_io_pool, uint8_t flags, libewf_error_t **error Ft int Fn libewf_handle_get_file_io_handle libewf_handle_t *handle, libbfio_handle_t **file_io_handle, libewf_error_t **error

Meta data functions (APIv1) Ft int Fn libewf_get_sectors_per_chunk libewf_handle_t *handle, uint32_t *sectors_per_chunk Ft int Fn libewf_set_sectors_per_chunk libewf_handle_t *handle, uint32_t sectors_per_chunk Ft int Fn libewf_get_bytes_per_sector libewf_handle_t *handle, uint32_t *bytes_per_sector Ft int Fn libewf_set_bytes_per_sector libewf_handle_t *handle, uint32_t bytes_per_sector Ft int Fn libewf_get_amount_of_sectors libewf_handle_t *handle, uint32_t *amount_of_sectors Ft int Fn libewf_get_chunk_size libewf_handle_t *handle, size32_t *chunk_size Ft int Fn libewf_get_error_granularity libewf_handle_t *handle, uint32_t *error_granularity Ft int Fn libewf_set_error_granularity libewf_handle_t *handle, uint32_t error_granularity Ft int Fn libewf_get_compression_values libewf_handle_t *handle, int8_t *compression_level, uint8_t *compress_empty_block Ft int Fn libewf_set_compression_values libewf_handle_t *handle, int8_t compression_level, uint8_t compress_empty_block Ft int Fn libewf_get_media_size libewf_handle_t *handle, size64_t *media_size Ft int Fn libewf_set_media_size libewf_handle_t *handle, size64_t media_size Ft int Fn libewf_get_media_type libewf_handle_t *handle, uint8_t *media_type Ft int Fn libewf_set_media_type libewf_handle_t *handle, uint8_t media_type Ft int Fn libewf_get_media_flags libewf_handle_t *handle, uint8_t *media_flags Ft int Fn libewf_set_media_flags libewf_handle_t *handle, uint8_t media_flags Ft int Fn libewf_get_volume_type libewf_handle_t *handle, uint8_t *volume_type Ft int Fn libewf_set_volume_type libewf_handle_t *handle, uint8_t volume_type Ft int Fn libewf_get_format libewf_handle_t *handle, uint8_t* format Ft int Fn libewf_set_format libewf_handle_t *handle, uint8_t format Ft int Fn libewf_get_guid libewf_handle_t *handle, uint8_t *guid, size_t size Ft int Fn libewf_set_guid libewf_handle_t *handle, uint8_t *guid, size_t size Ft int Fn libewf_get_md5_hash libewf_handle_t *handle, uint8_t *md5_hash, size_t size Ft int Fn libewf_set_md5_hash libewf_handle_t *handle, uint8_t *md5_hash, size_t size Ft int Fn libewf_get_sha1_hash libewf_handle_t *handle, uint8_t *sha1_hash, size_t size Ft int Fn libewf_set_sha1_hash libewf_handle_t *handle, uint8_t *sha1_hash, size_t size Ft int Fn libewf_get_write_amount_of_chunks libewf_handle_t *handle, uint32_t *amount_of_chunks Ft int Fn libewf_set_read_wipe_chunk_on_error libewf_handle_t *handle, uint8_t wipe_on_error Ft int Fn libewf_copy_media_values libewf_handle_t *destination_handle, libewf_handle_t *source_handle Ft int Fn libewf_get_amount_of_acquiry_errors libewf_handle_t *handle, uint32_t *amount_of_errors Ft int Fn libewf_get_acquiry_error libewf_handle_t *handle, uint32_t index, off64_t *first_sector, uint32_t *amount_of_sectors Ft int Fn libewf_add_acquiry_error libewf_handle_t *handle, off64_t first_sector, uint32_t amount_of_sectors Ft int Fn libewf_get_amount_of_crc_errors libewf_handle_t *handle, uint32_t *amount_of_errors Ft int Fn libewf_get_crc_error libewf_handle_t *handle, uint32_t index, off64_t *first_sector, uint32_t *amount_of_sectors Ft int Fn libewf_add_crc_error libewf_handle_t *handle, off64_t first_sector, uint32_t amount_of_sectors Ft int Fn libewf_get_amount_of_sessions libewf_handle_t *handle, uint32_t *amount_of_sessions Ft int Fn libewf_get_session libewf_handle_t *handle, uint32_t index, off64_t *first_sector, uint32_t *amount_of_sectors Ft int Fn libewf_add_session libewf_handle_t *handle, off64_t first_sector, uint32_t amount_of_sectors Ft int Fn libewf_get_header_codepage libewf_handle_t *handle, int *codepage Ft int Fn libewf_set_header_codepage libewf_handle_t *handle, int codepage Ft int Fn libewf_get_amount_of_header_values libewf_handle_t *handle, uint32_t *amount_of_values Ft int Fn libewf_get_header_value_identifier_size libewf_handle_t *handle, uint32_t index, size_t *identifier_size Ft int Fn libewf_get_header_value_identifier libewf_handle_t *handle, uint32_t index, char *identifier, size_t identifier_size Ft int Fn libewf_get_header_value_size libewf_handle_t *handle, const char *identifier, size_t *value_size Ft int Fn libewf_get_header_value libewf_handle_t *handle, const char *identifier, char *value, size_t value_size Ft int Fn libewf_get_header_value_case_number libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_description libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_examiner_name libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_evidence_number libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_notes libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_acquiry_date libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_system_date libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_acquiry_operating_system libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_acquiry_software_version libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_password libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_header_value_compression_type libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_set_header_value libewf_handle_t *handle, const char *identifier, const char *value, size_t value_length Ft int Fn libewf_set_header_value_case_number libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_description libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_examiner_name libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_evidence_number libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_notes libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_acquiry_date libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_system_date libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_acquiry_operating_system libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_acquiry_software_version libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_password libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_compression_type libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_model libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_header_value_serial_number libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_parse_header_values libewf_handle_t *handle, uint8_t date_format Ft int Fn libewf_copy_header_values libewf_handle_t *destination_handle, libewf_handle_t *source_handle Ft int Fn libewf_get_amount_of_hash_values libewf_handle_t *handle, uint32_t *amount_of_values Ft int Fn libewf_get_hash_value_identifier_size libewf_handle_t *handle, uint32_t index, size_t *identifier_size Ft int Fn libewf_get_hash_value_identifier libewf_handle_t *handle, uint32_t index, char *identifier, size_t identifier_size Ft int Fn libewf_get_hash_value_size libewf_handle_t *handle, const char *identifier, size_t *value_size Ft int Fn libewf_get_hash_value libewf_handle_t *handle, const char *identifier, char *value, size_t value_size Ft int Fn libewf_get_hash_value_md5 libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_get_hash_value_sha1 libewf_handle_t *handle, char *value, size_t value_size Ft int Fn libewf_set_hash_value libewf_handle_t *handle, const char *identifier, const char *value, size_t value_length Ft int Fn libewf_set_hash_value_md5 libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_set_hash_value_sha1 libewf_handle_t *handle, const char *value, size_t value_length Ft int Fn libewf_parse_hash_values libewf_handle_t *handle

Meta data functions (APIv2) Ft int Fn libewf_handle_get_sectors_per_chunk libewf_handle_t *handle, uint32_t *sectors_per_chunk, libewf_error_t **error Ft int Fn libewf_handle_set_sectors_per_chunk libewf_handle_t *handle, uint32_t sectors_per_chunk, libewf_error_t **error Ft int Fn libewf_handle_get_bytes_per_sector libewf_handle_t *handle, uint32_t *bytes_per_sector, libewf_error_t **error Ft int Fn libewf_handle_set_bytes_per_sector libewf_handle_t *handle, uint32_t bytes_per_sector, libewf_error_t **error Ft int Fn libewf_handle_get_amount_of_sectors libewf_handle_t *handle, uint64_t *amount_of_sectors, libewf_error_t **error Ft int Fn libewf_handle_get_chunk_size libewf_handle_t *handle, size32_t *chunk_size, libewf_error_t **error, libewf_error_t **error Ft int Fn libewf_handle_get_error_granularity libewf_handle_t *handle, uint32_t *error_granularity, libewf_error_t **error Ft int Fn libewf_handle_set_error_granularity libewf_handle_t *handle, uint32_t error_granularity, libewf_error_t **error Ft int Fn libewf_handle_get_compression_values libewf_handle_t *handle, int8_t *compression_level, uint8_t *compression_flags, libewf_error_t **error Ft int Fn libewf_handle_set_compression_values libewf_handle_t *handle, int8_t compression_level, uint8_t compression_flags, libewf_error_t **error Ft int Fn libewf_handle_get_media_size libewf_handle_t *handle, size64_t *media_size, libewf_error_t **error Ft int Fn libewf_handle_set_media_size libewf_handle_t *handle, size64_t media_size, libewf_error_t **error Ft int Fn libewf_handle_get_media_type libewf_handle_t *handle, uint8_t *media_type, libewf_error_t **error Ft int Fn libewf_handle_set_media_type libewf_handle_t *handle, uint8_t media_type, libewf_error_t **error Ft int Fn libewf_handle_get_media_flags libewf_handle_t *handle, uint8_t *media_flags, libewf_error_t **error Ft int Fn libewf_handle_set_media_flags libewf_handle_t *handle, uint8_t media_flags, libewf_error_t **error Ft int Fn libewf_handle_get_format libewf_handle_t *handle, uint8_t* format, libewf_error_t **error Ft int Fn libewf_handle_set_format libewf_handle_t *handle, uint8_t format, libewf_error_t **error Ft int Fn libewf_handle_get_guid libewf_handle_t *handle, uint8_t *guid, size_t size, libewf_error_t **error Ft int Fn libewf_handle_set_guid libewf_handle_t *handle, uint8_t *guid, size_t size, libewf_error_t **error Ft int Fn libewf_handle_get_md5_hash libewf_handle_t *handle, uint8_t *md5_hash, size_t size, libewf_error_t **error Ft int Fn libewf_handle_set_md5_hash libewf_handle_t *handle, uint8_t *md5_hash, size_t size, libewf_error_t **error Ft int Fn libewf_handle_get_sha1_hash libewf_handle_t *handle, uint8_t *sha1_hash, size_t size, libewf_error_t **error Ft int Fn libewf_handle_set_sha1_hash libewf_handle_t *handle, uint8_t *sha1_hash, size_t size, libewf_error_t **error Ft int Fn libewf_handle_get_write_amount_of_chunks libewf_handle_t *handle, uint32_t *amount_of_chunks, libewf_error_t **error Ft int Fn libewf_handle_set_read_wipe_chunk_on_error libewf_handle_t *handle, uint8_t wipe_on_error, libewf_error_t **error Ft int Fn libewf_handle_copy_media_values libewf_handle_t *destination_handle, libewf_handle_t *source_handle, libewf_error_t **error Ft int Fn libewf_handle_get_amount_of_acquiry_errors libewf_handle_t *handle, uint32_t *amount_of_errors, libewf_error_t **error Ft int Fn libewf_handle_get_acquiry_error libewf_handle_t *handle, uint32_t index, uint64_t *first_sector, uint64_t *amount_of_sectors, libewf_error_t **error Ft int Fn libewf_handle_add_acquiry_error libewf_handle_t *handle, uint64_t first_sector, uint64_t amount_of_sectors, libewf_error_t **error Ft int Fn libewf_handle_get_amount_of_crc_errors libewf_handle_t *handle, uint32_t *amount_of_errors, libewf_error_t **error Ft int Fn libewf_handle_get_crc_error libewf_handle_t *handle, uint32_t index, uint64_t *first_sector, uint64_t *amount_of_sectors, libewf_error_t **error Ft int Fn libewf_handle_add_crc_error libewf_handle_t *handle, uint64_t first_sector, uint64_t amount_of_sectors, libewf_error_t **error Ft int Fn libewf_handle_get_amount_of_sessions libewf_handle_t *handle, uint32_t *amount_of_sessions, libewf_error_t **error Ft int Fn libewf_handle_get_session libewf_handle_t *handle, uint32_t index, uint64_t *first_sector, uint64_t *amount_of_sectors, libewf_error_t **error Ft int Fn libewf_handle_add_session libewf_handle_t *handle, uint64_t first_sector, uint64_t amount_of_sectors, libewf_error_t **error Ft int Fn libewf_handle_get_header_codepage libewf_handle_t *handle, int *codepage, libewf_error_t **error Ft int Fn libewf_handle_set_header_codepage libewf_handle_t *handle, int codepage, libewf_error_t **error Ft int Fn libewf_handle_get_header_values_data_format libewf_handle_t *handle, int date_format, libewf_error_t **error Ft int Fn libewf_handle_set_header_values_data_format libewf_handle_t *handle, int date_format, libewf_error_t **error Ft int Fn libewf_handle_get_amount_of_header_values libewf_handle_t *handle, uint32_t *amount_of_values, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_identifier_size libewf_handle_t *handle, uint32_t index, size_t *identifier_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_identifier libewf_handle_t *handle, uint32_t index, uint8_t *identifier, size_t identifier_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_size libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, size_t *value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_case_number libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_description libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_examiner_name libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_evidence_number libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_notes libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_acquiry_date libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_system_date libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_acquiry_operating_system libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_acquiry_software_version libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_password libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_header_value_compression_type libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_set_header_value libewf_handle_t *handle, const uint8_t *identifier, const uint8_t *value, size_t value_length Ft int Fn libewf_handle_set_header_value_case_number libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_description libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_examiner_name libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_evidence_number libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_notes libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_acquiry_date libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_system_date libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_acquiry_operating_system libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_acquiry_software_version libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_password libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_compression_type libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_model libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_header_value_serial_number libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_copy_header_values libewf_handle_t *destination_handle, libewf_handle_t *source_handle, libewf_error_t **error Ft int Fn libewf_handle_get_amount_of_hash_values libewf_handle_t *handle, uint32_t *amount_of_values, libewf_error_t **error Ft int Fn libewf_handle_get_hash_value_identifier_size libewf_handle_t *handle, uint32_t index, size_t *identifier_size, libewf_error_t **error Ft int Fn libewf_handle_get_hash_value_identifier libewf_handle_t *handle, uint32_t index, uint8_t *identifier, size_t identifier_size, libewf_error_t **error Ft int Fn libewf_handle_get_hash_value_size libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, size_t *value_size, libewf_error_t **error Ft int Fn libewf_handle_get_hash_value libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_hash_value_md5 libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_get_hash_value_sha1 libewf_handle_t *handle, uint8_t *value, size_t value_size, libewf_error_t **error Ft int Fn libewf_handle_set_hash_value libewf_handle_t *handle, const uint8_t *identifier, size_t identifier_length, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_hash_value_md5 libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error Ft int Fn libewf_handle_set_hash_value_sha1 libewf_handle_t *handle, const uint8_t *value, size_t value_length, libewf_error_t **error

DESCRIPTION

The Fn libewf_get_version function is used to retrieve the library version.

The Fn libewf_get_flags_* functions are used to get the values of the flags for read and/or write.

The Fn libewf_check_file_signature and Fn libewf_check_file_signature_wide functions are used to test if the EWF file signature is present within a certain filename.

The Fn libewf_signal_abort function signals the handle to aborts it current activity.

The Fn libewf_glob and Fn libewf_glob_wide functions glob filenames using the filename and the format according to the EWF segment file naming schema. If the format is known the filename should contain the base of the filename otherwise the function will try to determine the format based on the extension.

The Fn libewf_open , Fn libewf_open_wide , Fn libewf_seek_offset , Fn libewf_read_buffer , Fn libewf_read_random , Fn libewf_write_buffer , Fn libewf_write_random , Fn libewf_close functions can be used to open, seek in, read from, write to and close a set of EWF files.

The Fn libewf_write_finalize function needs to be called after writing a set of EWF files without knowing the input size upfront, e.g. reading from a pipe. Fn libewf_write_finalize will the necessary correction to the set of EWF files.

The Fn libewf_raw_read_prepare_buffer , Fn libewf_raw_read_buffer functions can be used to read 'raw' chunks to a set of EWF files.

The Fn libewf_raw_write_prepare_buffer , Fn libewf_raw_write_buffer functions can be used to write 'raw' chunks to a set of EWF files.

The Fn libewf_get_* functions can be used to retrieve information from the handle. This information is read from a set of EWF files when Fn libewf_open or Fn libewf_open_wide is used. The Fn libewf_parse_header_values, Fn libewf_parse_hash_values functions need to be called before retrieving header or hash values.

The Fn libewf_set_* functions can be used to set information in the handle. This information is written to a set of EWF files when Fn libewf_write_buffer is used.

The Fn libewf_parse_header_values function can be used to parse the values in the header strings within a set of EWF files.

The Fn libewf_parse_hash_values function can be used to parse the values in the hash string within a set of EWF files. The hash string is currently only present in the EWF-X format.

The Fn libewf_add_acquiry_error function can be used to add an acquiry error (a read error during acquiry) to be written into a set of EWF files.

The Fn libewf_add_crc_error function can be used to add a CRC error (a validation error in a chunk in a set of EWF files) to be set in the handle.

The Fn libewf_add_session function can be used to add a sesssion to be written into a set of EWF files. Note that the only the start offset is stored in a set of EWF files. Libewf ignores the session amount of sectors on write and determines the session sizes using the available session and media information on read.

The Fn libewf_copy_* functions copy information from the source_handle to the destination_handle.

The Fn libewf_set_notify_values function can be used to direct the warning, verbose and debug output from the library.

RETURN VALUES

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values refer to libewf.h

ENVIRONMENT

None

FILES

None

NOTES

libewf allows to be compiled with wide character support. To compile libewf with wide character support use ./configure --enable-wide-character-type=yes or pass the definition HAVE_WIDE_CHARACTER_TYPE
 to the compiler (i.e. in case of Microsoft Visual Studio (MSVS) C++).

To have other code to determine if libewf was compiled with wide character support it defines LIBEWF_HAVE_WIDE_CHARACTER_TYPE
 in libewf/features.h.

As of version 20080903 libewf uses UTF-8 encoded strings except for filenames.

The Windows API has both ASCII and UTF16 functions and some functions have wrapper macros that hide the actual implementation. As of version 20090328 libewf detects the UNICODE or _UNICODE directives to compile either with or without wide system character support. The directive HAVE_WIDE_CHARACTER_SUPPORT_FUNCTIONS is no longer used.

The header in a set of EWF files contains an extended ASCII string using the codepage of the system it was created on. The function libewf_set_header_codepage
 allows to set the required codepage for reading and writing. The default codepage is ASCII and replaces all extended characters to the Unicode replacement character (U+fffd) when reading and the ASCII substitude character (0x1a) when writing. 

The header2 contains UTF-16 little endian stream and the xheader and xhash contain a UTF-8 stream without or with byte order mark (as of version 20080903).

libewf allows to be compiled with chained IO support using libbfio. libewf will automatically detect if a compatible version of libbfio is available.

To have other code to determine if libewf was compiled with libbfio support it defines LIBEWF_HAVE_BFIO
 in libewf/features.h.

BUGS

Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website: http://libewf.sourceforge.net/

AUTHOR

These man pages were written by Joachim Metz.

COPYRIGHT

Copyright 2006-2009 Joachim Metz, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

SEE ALSO

the libewf.h include file