Acquire ewf images with ewfacquire on MacOSX/Freebsd/OpenBSD/Linux

Besides reading and writing (EnCase) EWF files with the libewf library, it’s now possible to read and write SMART images as well. With the ewfacquire tool you now can create a bit-copy image from devices in the SMART image format (s01). The ewfacquire tool supports reading devices in Linux, FreeBSD, NetBSD, OpenBSD, MacOS-X/Darwin. On other platforms (Windows/Cygwin) it can convert a raw (dd) image into a EWF file or SMART file. With the tool you can acquire disk images just like in Encase or FTK and save the same meta data and hash value within the EWF or SMART file.

Usage ewfacquire:
./ewfacquire /dev/hda

The libewf library is integrated within the Sleuth Kit and so are the other tools. The libewf library comes with other tools to export data from EWF or SMART files (ewfexport), show the meta data stored in the EWF or SMART file (ewfinfo), and verify the integrity of the EWF or SMART files (ewfverify)

You can download the source code on the project website:

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

Leave a Comment

Latest Articles