.Dd May 12, 2007.Dt libewf 3.Os libewf.Sh NAME.Nm libewf.h.Nd Library to read from and write to the Expert Witness Compression Format (EWF) file format.Sh LIBRARY.Lb libewf.Sh SYNOPSIS.In libewf.h.Ft int8_t.Fn libewf_check_file_signature "const char *filename".Ft LIBEWF_HANDLE *.Fn libewf_open "char * const filenames[], uint16_t file_amount, uint8_t flags".Ft off_t.Fn libewf_seek_offset "LIBEWF_HANDLE *handle, off_t offset".Ft ssize_t.Fn libewf_read_buffer "LIBEWF_HANDLE *handle, void *buffer, size_t size".Ft ssize_t.Fn libewf_read_random "LIBEWF_HANDLE *handle, void *buffer, size_t size, off_t offset".Ft ssize_t.Fn libewf_write_buffer "LIBEWF_HANDLE *handle, void *buffer, size_t size".Ft ssize_t.Fn libewf_write_random "LIBEWF_HANDLE *handle, void *buffer, size_t size, off_t offset".Ft ssize_t.Fn libewf_write_finalize "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_close "LIBEWF_HANDLE *handle".Ft int32_t.Fn libewf_get_bytes_per_sector "LIBEWF_HANDLE *handle".Ft int32_t.Fn libewf_get_amount_of_sectors "LIBEWF_HANDLE *handle".Ft int32_t.Fn libewf_get_chunk_size "LIBEWF_HANDLE *handle".Ft int32_t.Fn libewf_get_error_granularity "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_get_compression_level "LIBEWF_HANDLE *handle".Ft int64_t.Fn libewf_get_media_size "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_get_media_type "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_get_media_flags "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_get_volume_type "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_get_format "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_get_guid "LIBEWF_HANDLE *handle, uint8_t *guid, size_t size".Ft int64_t.Fn libewf_get_write_amount_of_chunks "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_set_media_values "LIBEWF_HANDLE *handle, uint32_t sectors_per_chunk, uint32_t bytes_per_sector".Ft int8_t.Fn libewf_set_guid "LIBEWF_HANDLE *handle, uint8_t *guid, size_t size".Ft int8_t.Fn libewf_set_write_segment_file_size "LIBEWF_HANDLE *handle, uint32_t segment_file_size".Ft int8_t.Fn libewf_set_write_compression_values "LIBEWF_HANDLE *handle, int8_t compression_level, uint8_t compress_empty_block".Ft int8_t.Fn libewf_set_write_media_type "LIBEWF_HANDLE *handle, uint8_t media_type, uint8_t volume_type".Ft int8_t.Fn libewf_set_write_format "LIBEWF_HANDLE *handle, uint8_t format".Ft int8_t.Fn libewf_set_write_input_size "LIBEWF_HANDLE *handle, uint64_t input_write_size".Ft int8_t.Fn libewf_set_swap_byte_pairs "LIBEWF_HANDLE *handle, uint8_t swap_byte_pairs".Ft int8_t.Fn libewf_parse_header_values "LIBEWF_HANDLE *handle, uint8_t date_format".Ft int8_t.Fn libewf_parse_hash_values "LIBEWF_HANDLE *handle".Ft int8_t.Fn libewf_add_acquiry_error "LIBEWF_HANDLE *handle, uint64_t sector, uint32_t amount_of_sectors".Ft void.Fn libewf_set_notify_values "FILE *stream, uint8_t verbose".PpWhen the library was compiled with narrow character support (default) the following functions are available.Ft const char *.Fn libewf_get_version "void".Ft int8_t.Fn libewf_get_header_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length".Ft int8_t.Fn libewf_get_header_value_case_number "LIBEWF_HANDLE *handle, char *case_number, size_t length".Ft int8_t.Fn libewf_get_header_value_description "LIBEWF_HANDLE *handle, char *description, size_t length".Ft int8_t.Fn libewf_get_header_value_examiner_name "LIBEWF_HANDLE *handle, char *examiner_name, size_t length".Ft int8_t.Fn libewf_get_header_value_evidence_number "LIBEWF_HANDLE *handle, char *evidence_number, size_t length".Ft int8_t.Fn libewf_get_header_value_notes "LIBEWF_HANDLE *handle, char *notes, size_t length".Ft int8_t.Fn libewf_get_header_value_acquiry_date "LIBEWF_HANDLE *handle, char *acquiry_date, size_t length".Ft int8_t.Fn libewf_get_header_value_system_date "LIBEWF_HANDLE *handle, char *system_date, size_t length".Ft int8_t.Fn libewf_get_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, char *acquiry_operating_system, size_t length".Ft int8_t.Fn libewf_get_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, char *acquiry_software_version, size_t length".Ft int8_t.Fn libewf_get_header_value_password "LIBEWF_HANDLE *handle, char *password, size_t length".Ft int8_t.Fn libewf_get_header_value_compression_type "LIBEWF_HANDLE *handle, char *compression_type, size_t length".Ft int8_t.Fn libewf_get_hash_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length".Ft int8_t.Fn libewf_set_header_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length".Ft int8_t.Fn libewf_set_header_value_case_number "LIBEWF_HANDLE *handle, char *case_number, size_t length".Ft int8_t.Fn libewf_set_header_value_description "LIBEWF_HANDLE *handle, char *description, size_t length".Ft int8_t.Fn libewf_set_header_value_examiner_name "LIBEWF_HANDLE *handle, char *examiner_name, size_t length".Ft int8_t.Fn libewf_set_header_value_evidence_number "LIBEWF_HANDLE *handle, char *evidence_number, size_t length".Ft int8_t.Fn libewf_set_header_value_notes "LIBEWF_HANDLE *handle, char *notes, size_t length".Ft int8_t.Fn libewf_set_header_value_acquiry_date "LIBEWF_HANDLE *handle, char *acquiry_date, size_t length".Ft int8_t.Fn libewf_set_header_value_system_date "LIBEWF_HANDLE *handle, char *system_date, size_t length".Ft int8_t.Fn libewf_set_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, char *acquiry_operating_system, size_t length".Ft int8_t.Fn libewf_set_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, char *acquiry_software_version, size_t length".Ft int8_t.Fn libewf_set_header_value_password "LIBEWF_HANDLE *handle, char *password, size_t length".Ft int8_t.Fn libewf_set_header_value_compression_type "LIBEWF_HANDLE *handle, char *compression_type, size_t length".Ft int8_t.Fn libewf_set_hash_value "LIBEWF_HANDLE *handle, char *identifier, char *value, size_t length".Ft int8_t.Fn libewf_calculate_md5_hash "LIBEWF_HANDLE *handle, char *string, size_t length".Ft int8_t.Fn libewf_get_stored_md5_hash "LIBEWF_HANDLE *handle, char *string, size_t length".Ft int8_t.Fn libewf_get_calculated_md5_hash "LIBEWF_HANDLE *handle, char *string, size_t length".PpWhen the library was compiled with wide character support the following functions are available instead of the narrow character functions.Ft const wchar_t *.Fn libewf_get_version "void".Ft int8_t.Fn libewf_get_header_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length".Ft int8_t.Fn libewf_get_header_value_case_number "LIBEWF_HANDLE *handle, wchar_t *case_number, size_t length".Ft int8_t.Fn libewf_get_header_value_description "LIBEWF_HANDLE *handle, wchar_t *description, size_t length".Ft int8_t.Fn libewf_get_header_value_examiner_name "LIBEWF_HANDLE *handle, wchar_t *examiner_name, size_t length".Ft int8_t.Fn libewf_get_header_value_evidence_number "LIBEWF_HANDLE *handle, wchar_t *evidence_number, size_t length".Ft int8_t.Fn libewf_get_header_value_notes "LIBEWF_HANDLE *handle, wchar_t *notes, size_t length".Ft int8_t.Fn libewf_get_header_value_acquiry_date "LIBEWF_HANDLE *handle, wchar_t *acquiry_date, size_t length".Ft int8_t.Fn libewf_get_header_value_system_date "LIBEWF_HANDLE *handle, wchar_t *system_date, size_t length".Ft int8_t.Fn libewf_get_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, wchar_t *acquiry_operating_system, size_t length".Ft int8_t.Fn libewf_get_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, wchar_t *acquiry_software_version, size_t length".Ft int8_t.Fn libewf_get_header_value_password "LIBEWF_HANDLE *handle, wchar_t *password, size_t length".Ft int8_t.Fn libewf_get_header_value_compression_type "LIBEWF_HANDLE *handle, wchar_t *compression_type, size_t length".Ft int8_t.Fn libewf_get_hash_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length".Ft int8_t.Fn libewf_set_header_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length".Ft int8_t.Fn libewf_set_header_value_case_number "LIBEWF_HANDLE *handle, wchar_t *case_number, size_t length".Ft int8_t.Fn libewf_set_header_value_description "LIBEWF_HANDLE *handle, wchar_t *description, size_t length".Ft int8_t.Fn libewf_set_header_value_examiner_name "LIBEWF_HANDLE *handle, wchar_t *examiner_name, size_t length".Ft int8_t.Fn libewf_set_header_value_evidence_number "LIBEWF_HANDLE *handle, wchar_t *evidence_number, size_t length".Ft int8_t.Fn libewf_set_header_value_notes "LIBEWF_HANDLE *handle, wchar_t *notes, size_t length".Ft int8_t.Fn libewf_set_header_value_acquiry_date "LIBEWF_HANDLE *handle, wchar_t *acquiry_date, size_t length".Ft int8_t.Fn libewf_set_header_value_system_date "LIBEWF_HANDLE *handle, wchar_t *system_date, size_t length".Ft int8_t.Fn libewf_set_header_value_acquiry_operating_system "LIBEWF_HANDLE *handle, wchar_t *acquiry_operating_system, size_t length".Ft int8_t.Fn libewf_set_header_value_acquiry_software_version "LIBEWF_HANDLE *handle, wchar_t *acquiry_software_version, size_t length".Ft int8_t.Fn libewf_set_header_value_password "LIBEWF_HANDLE *handle, wchar_t *password, size_t length".Ft int8_t.Fn libewf_set_header_value_compression_type "LIBEWF_HANDLE *handle, wchar_t *compression_type, size_t length".Ft int8_t.Fn libewf_set_hash_value "LIBEWF_HANDLE *handle, wchar_t *identifier, wchar_t *value, size_t length".Ft int8_t.Fn libewf_calculate_md5_hash "LIBEWF_HANDLE *handle, wchar_t *string, size_t length".Ft int8_t.Fn libewf_get_stored_md5_hash "LIBEWF_HANDLE *handle, wchar_t *string, size_t length".Ft int8_t.Fn libewf_get_calculated_md5_hash "LIBEWF_HANDLE *handle, wchar_t *string, size_t length".PpWhen wide character support functions like wmain and wopen are present and libewf is compiled with.Ar HAVE_WIDE_CHARACTER_SUPPORT_FUNCTIONSthe following functions will replace their narrow character functions..Ft int8_t.Fn libewf_check_file_signature "const wchar_t *filename".Ft LIBEWF_HANDLE *.Fn libewf_open "wchar_t * const filenames[], uint16_t file_amount, uint8_t flags".Sh DESCRIPTIONThe.Fn libewf_get_versionfunction is used to retrieve the library version..PpThe.Fn libewf_check_file_signaturefunction is used to test if the EWF file signature is present within a certain.Ar filename..PpThe.Fn libewf_open ,.Fn libewf_seek_offset ,.Fn libewf_read_buffer ,.Fn libewf_read_random ,.Fn libewf_write_buffer ,.Fn libewf_write_random ,.Fn libewf_closefunctions can be used to open, seek in, read from, write to and close a set of EWF files..PpThe.Fn libewf_write_finalizefunction needs to be called after writing a set of EWF files without knowing the input size upfront, e.g. reading from a pipe..Fn libewf_write_finalizewill the necessary correction to the set of EWF files.Note that certain information like the calculated MD5 has is not available if.Fn libewf_write_finalizehas not been issued..PpThe.Fn libewf_get_*functions can be used to retrieve information from the.Ar handle.This information is read from a set of EWF files when.Fn libewf_openis used. The.Fn libewf_parse_header_values,.Fn libewf_parse_hash_valuesfunctions need to be called before retrieving header or hash values..PpThe.Fn libewf_set_*functions can be used to set information in the.Ar handle.This information is written to a set of EWF files when.Fn libewf_write_bufferis used..PpThe.Fn libewf_parse_header_valuesfunction can be used to parse the values in the header strings within a set of EWF files..PpThe.Fn libewf_parse_hash_valuesfunction can be used to parse the values in the hash string within a set of EWF files. The hash string is currently only present in the EWF-X format..PpThe.Fn libewf_add_acquiry_errorfunction can be used to add an acquiry error (a read error during acquiry) to be written into a set of EWF files..PpThe.Fn libewf_set_notify_valuesfunction can be used to direct the warning, verbose and debug output from the library..Sh RETURN VALUESMost of the functions return NULL or -1 on error, dependent on the return type. For the actual return values refer to libewf.h.Sh ENVIRONMENTNone.Sh FILESNone.Sh BUGSPlease report bugs of any kind to <forensics@hoffmannbv.nl> or on the project website:https://libewf.uitwisselplatform.nl/.Sh AUTHORThese man pages were written by Joachim Metz..Sh COPYRIGHTCopyright 2006-2007 Joachim Metz, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors.This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE..Sh SEE ALSOthe libewf.h include file