EWFEXPORT(1)

💖 ewfexport — the libewf manual, bestie edition 💖

okay so this is a LOCAL manual page for ewfexport, part of the libewf package. libewf is the library that lets you access the Expert Witness Compression Format (EWF). iykyk 💅

---

✨ NAME ✨

ewfexport — exports media data stored in EWF files 🫶

---

🎀 SYNOPSIS 🎀

ewfexport [-A codepage] [-b number_of_sectors] [-B number_of_bytes]
          [-c compression_values] [-d digest_type] [-f format]
          [-l log_filename] [-o offset] [-p process_buffer_size]
          [-S segment_file_size] [-t target] [-hqsuvVwx] ewf_files

---

🌸 DESCRIPTION 🌸

ewfexport is a utility that exports media data stored in EWF files. literally its whole job. main character energy 💖

ewfexport is part of the libewf package. libewf is a library to access the Expert Witness Compression Format (EWF). no cap.

ewf_files — the first or the entire set of EWF segment files. so like, you can hand it just the first one and it figures out the rest, or you can give it the whole set. either way slay.

The options are as follows:

---

💅 OPTIONS 💅

• -A codepage — the codepage of header section. options:
  • ascii (default) 👑
  • windows-874
  • windows-932
  • windows-936
  • windows-949
  • windows-950
  • windows-1250
  • windows-1251
  • windows-1252
  • windows-1253
  • windows-1254
  • windows-1255
  • windows-1256
  • windows-1257
  • windows-1258
• -b number_of_sectors — the number of sectors to read at once (per chunk). options: 16, 32, 64 (default), 128, 256, 512, 1024, 2048, 4096, 8192, 16384 or 32768. the default is lowkey the vibe. ✨
• -B number_of_bytes — the number of bytes to export. tell it exactly how much you want and it stays in its lane.
• -c compression_values — specify the compression values as: level or method:level.
  • compression method options: deflate (default)
  • compression level options: none (default), empty-block, fast or best
• -d digest_type — calculate additional digest (hash) types besides md5. options: sha1 (not used for raw and files formats). so if you're going raw or files, sha1 is not invited to the party 🙈
• -f format — the output format to write to. options: raw (default), files (restricted to logical volume files), ewf, smart, ftk, encase1, encase2, encase3, encase4, encase5, encase6, encase7, encase7-v2, linen5, linen6, linen7, ewfx. that is a LOT of formats and honestly? obsessed. 🦋
• -h — shows this help. hi bestie 👋
• -l log_filename — logs export errors and the digest (hash) to the log filename. receipts. keep them. 🧾
• -o offset — the offset to start the export (default is 0).
• -p process_buffer_size — the process buffer size (default is the chunk size).
• -s — swap byte pairs of the media data (from AB to BA). use this for big to little endian conversion and vice versa. it's giving endianness swap 🔄
• -S segment_file_size — the segment file size in bytes (default is 1.4 GiB). minimum is 1.0 MiB, maximum is 7.9 EiB for raw, encase6 and encase7 format and 1.9 GiB for other formats. (not used for files format.) 👑
• -t target — the target file to export to. use - for stdout (default is export). stdout is only supported for the raw format. so don't try to pipe anything else to stdout, it's not gonna happen 💀
• -u — unattended mode (disables user interaction). no yapping, just exporting.
• -v — verbose output to stderr.
• -V — print version.
• -w — zero sectors on checksum error (mimic EnCase like behavior).
• -x — use the chunk data instead of the buffered read and write functions.

---

🌈 ENVIRONMENT 🌈

None. that's right, absolutely no environment variables. zero. nada. a clean slate ✨

---

🍓 FILES 🍓

None. also nothing here. we love a low-maintenance utility 🫶

---

💜 EXAMPLES 💜

ewfexport will ask the information it needs. it's very proactive like that.

# ewfexport floppy.E01
ewfexport 20120805

Information for export required, please provide the necessary input
Export to format (raw, files, ewf, smart, ftk, encase1, encase2, encase3, encase4, encase5, encase6, encase7, encase7-v2, linen5, linen6, linen7, ewfx) [raw]:
Target path and filename without extension or - for stdout: floppy
Evidence segment file size in bytes (1.0 MiB <= value <= 7.9 EiB) [1.4 GiB]:
Start export at offset (0 <= value <= 1474560) [0]:
Number of bytes to export (0 <= value <= 1474560) [1474560]:

Export started at: Sun Aug  5 19:19:40 2012

This could take a while.

Status: at 2%.
        exported 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes).

      ...

Status: at 100%.
        exported 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes).
        completion in 1 second(s) with 1 MiB/s (1474560 bytes/second).

Export completed at: Sun Aug  5 19:19:41 2012

Written: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).
MD5 hash calculated over data:          ae1ce8f5ac079d3ee93f97fe3792bda3

that MD5 hash calculated over data: ae1ce8f5ac079d3ee93f97fe3792bda3 line at the end?? chef's kiss 💖 it literally ate.

---

🦋 DIAGNOSTICS 🦋

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation. so if you compiled it without that, no debug tea for you 😭

---

😭 BUGS 😭

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libewf-legacy/issues

if you found a bug, say something!! they want to know!! fr fr 🫶

---

👑 AUTHOR 👑

These man pages were written by Kees Mastwijk.

Alterations for distribution have been made by Joachim Metz.

legends, both of them ✨

---

🌸 COPYRIGHT 🌸

Copyright 2006-2014, Joachim Metz <joachim.metz@gmail.com>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. read it and weep — no warranty, bestie, absolutely none 💀

---

🌟 SEE ALSO 🌟

ewfacquire(1), ewfacquirestream(1), ewfinfo(1), ewfmount(1), ewfrecover(1), ewfverify(1)

the whole squad 🫶 go read them too.

---

and that's the whole page!! this one is from the libewf package, dated January 14, 2023. mwah 💋✨🎀