EWFVERIFY(1)

✨ EWFVERIFY — verifies media data stored in EWF files ✨

okay bestie, pull up a chair, because this one is literally the vibe check for your forensic images 🫶 We're talking about ewfverify, a lil utility from the libewf package (which is the library that reads the Expert Witness Compression Format, aka EWF, iykyk). It does exactly what it says on the tin: it verifies the media data stored in your EWF files. No cap. 💅

---

🌸 SYNOPSIS 🌸

ewfverify [-A codepage] [-d digest_type] [-f format] [-l log_filename]
          [-p process_buffer_size] [-hqvVwx] ewf_files

---

💖 DESCRIPTION 💖

ewfverify is a utility to verify media data stored in EWF files. That's the whole gig. It's the "did my evidence survive the trip" bestie. 🧚

ewfverify is part of the libewf package. And libewf is a library to access the Expert Witness Compression Format (EWF), which, if you didn't know, is the format — so now you know. ⭐

ewf_files — the first or the entire set of EWF segment files. Like, you can hand it just the first one and it'll go find the rest of the squad, or you can give it the whole friend group. 👑

The options are as follows, and there are a lot of them, so let's get into it:

---

🎀 OPTIONS 🎀

• -A codepage — the codepage of the header section. Your choices are: ascii (default, the safe pick 💖), windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258. Pick your fighter. 🌈
• -d digest_type — calculate additional digest (hash) types besides md5. Options: sha1, sha256. Because one hash is cute but three is a statement. ✨
• -f format — specify the input format. Options: raw (default) or files (which is restricted to logical volume files, so don't go rogue). 🌸
• -h — shows this help. Your emergency "wait what was the flag again" button. 🙈
• -l log_filename — logs verification errors and the digest (hash) to the log filename. Receipts, bestie. Keep the receipts. 💅
• -p process_buffer_size — the process buffer size (default is the chunk size, so like, it already knows what to do). 🦋
• -q — quiet. Shows minimal status information. For when you're too cool for progress bars. 😌
• -v — verbose output to stderr. Give me ALL the details, I want the tea. ☕
• -V — print version. A lil "who are you" moment. 👑
• -w — zero sectors on checksum error (mimic EnCase like behavior). ⚠️ Heads up bestie, this one literally zeroes out sectors, so be very sure that's what you want.
• -x — use the chunk data instead of the buffered read and write functions. A whole different route through the code. 🛣️

---

🦋 ENVIRONMENT 🦋

None

Like, nothing. Zero. Empty. The void. 💀

---

🌈 FILES 🌈

None

Same energy. No files involved. 🫶

---

⭐ EXAMPLES ⭐

ewfverify can either verify the raw storage media data or logical file data stored in EWF file(s). Two paths, one icon. Let's see both.

💜 To verify the raw storage media data:

# ewfverify floppy.E01
ewfverify 20110801

Verify started at: Tue Jan 11 19:21:51 2011

This could take a while.

Status: at 2%.
        verified 32 kB (32768 bytes) of total 1.4 MiB (1474560 bytes).

      ...

Status: at 100%.
        verified 1.4 MiB (1474560 bytes) of total 1.4 MiB (1474560 bytes).
        completion in 1 second(s) with 1 MiB/s (1474560 bytes/second).

Verify completed at: Tue Jan 11 19:21:52 2011

Read: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).

MD5 hash stored in file:      ae1ce8f5ac079d3ee93f97fe3792bda3
MD5 hash calculated over data:          ae1ce8f5ac079d3ee93f97fe3792bda3

ewfverify: SUCCESS

Look at those two matching MD5 hashes. Chef's kiss. The data is intact, the vibes are immaculate. 😭💖

💜 To verify logical file data:

# ewfverify -f files logical.E01
ewfverify 20110111

Verify started at: Tue Jan 11 19:21:51 2011

Single file: file1.txt
MD5 hash stored in file:                6fef2a64afbf070a264366183698bb5e
MD5 hash calculated over data:          6fef2a64afbf070a264366183698bb5e

      ...

Verify completed at: Tue Jan 11 19:21:52 2011

ewfverify: SUCCESS

Per-file hashes matching, SUCCESS at the end — literally the group chat reaction when the verification comes back clean. 🎉

---

👑 DIAGNOSTICS 👑

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. But — and this is the fine print — verbose and debug output are only printed when enabled at compilation. So if you compiled it without them, no amount of -v is gonna manifest them for you. ✨

---

💀 BUGS 💀

Please report bugs of any kind on the project issue tracker:

https://github.com/libyal/libewf-legacy/issues

Not me telling you to file an issue, but like... do it, bestie. They want to know. 🫶

---

🌸 AUTHOR 🌸

These man pages were written by Kees Mastwijk.

Alterations for distribution have been made by Joachim Metz.

Legends. Both of them. 👑

---

🎀 COPYRIGHT 🎀

Copyright 2006-2014, Joachim Metz <joachim.metz@gmail.com>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

🚨 Read that again bestie. NO WARRANTY. Not even the implied ones. The software is free but the promises are not included. 😭

---

🦋 SEE ALSO 🦋

ewfacquire(1), ewfacquirestream(1), ewfexport(1), ewfinfo(1), ewfmount(1), ewfrecover(1)

The whole libewf cinematic universe. Go binge it. 🍓

---

and that's the whole page, bestie 💖 this came to you from the libewf era, dated January 19, 2014 — so it's giving vintage but it still ate. Now go verify something and have a beautiful day. periodt. 💅✨