There was a problem!
I made out of package the ewftools(sleuthkit-2.09\src\libewf\) utility of ewfaqcuire under windows, decided to test. Floppy took,.. simply rewrote him in a file. This file gave on the entrance of ewaqcuire, set out of encase4 parameter, other by default. Got on an output 1.E01. Made an effort open through Encase4 got an error. Then through Encase4.2 created appearance of floppy and compared, at once saw a difference! First bytes
Through ewfacquire 45 56 46 09 0d 0d 0a FF 00 01 01 00 00 00 68 65
Through Encase4.2 45 56 46 09 0d 0a FF 00 01 01 00 00 00 68 65 61
Evidently that was the superfluous byte of 0d added, help to decide a problem, who can already ran into similar?
I took the source codes of ewfacauire and compiled them in Mvstudio 2005. On an entrance I give a not device and counted at a help fread file. I can deport project! In principle I found an error it consists here in this place of built-in write.c(c\program Files\microsoft Visual Studio 8\vc\crt\src\) Library CRT
286-294
while ( q - lfbuf < sizeof(lfbuf) - 1 &&
(unsigned)(p - (char *) buf) < cnt ) {
ch = *p++;
if ( ch == LF ) {
++lfcount;
*q++ = CR;
}
*q++ = ch;
}
In signature of EWF const uint8_t evf_file_signature[] = { 0x45, 0x56, 0x46, 0x09, 0x0d, 0x0a, 0xff, 0x00 };
Apparently 5 byte = 0d, and perceived as LF( checked), and there is an insertion of superfluous 0d, what changes all of further! Here such thing