PAGES
← all tools
◆ Digital Forensics & Incident Response

libewf

20140817 open-source

Library and tools to read/write Expert Witness Compression Format (EWF) forensic disk images in formats like E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. and S01.

Summary

libewf is an open-source (LGPL-3.0) library for reading and writing the Expert Witness Compression Format used for forensic disk images, including SMART .s01 and EnCase .E01, with read-only support for Logical Evidence Files. It is built to be linked into other software, but the package also ships command-line tools for acquiring media to EWF, exporting or recovering corrupt image sets, verifying data integrity, and mounting EWF files via FUSEFUSEA Linux kernel interface that lets userspace programs implement a filesystem without kernel code, maintained as part of the kernel project; tools use it to mount virtual or synthetic filesystems without requiring root or kernel modules., which makes it usable directly from a terminal as well. This puts it in the hands of digital forensics practitioners who need to create, convert, or validate disk images rather than application developers building unrelated features. It sits in the DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. tooling space alongside other evidence-format libraries rather than any named competitor. Development is quiet but not dormant: one maintainer, first committed in 2016, with 11 commits in the past year.

Library and tools to read/write Expert Witness Compression Format (EWF) forensic disk images in formats like E01 and S01.

How libewf helps

Is this seized drive still an exact match to the image I made of it?

recalculates the stored hash across the full data set and reports whether it still verifies against the value recorded at acquisition time

Can I recover a usable image from a disk set that got corrupted?

rebuilds a new EWF set from the damaged one, skipping unreadable sections while carrying forward as much of the original data as possible

What metadata was captured about this piece of evidence?

reads the case information, hashes, and acquisition details stored in the image file and prints them without touching the raw media

How do I get this evidence into a format another tool can open?

exports the media data to raw format or converts it to a different EWF version, splitting output files as needed

Can I browse this image's contents without extracting the whole thing first?

mounts the EWF file as a filesystem via FUSE so files inside can be read directly with normal tools

How do I capture a live acquisition from a device rather than an existing file?

writes storage media data straight from the device or from stdin into a new EWF file as it is acquired

all 17 features, with the evidence for each →

Languages

Not documented

Features

17 capabilities

Built from libewf's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • libewf covers 1 of the 8 investigation and response capabilities we track.

What libewf offers you

  • Command-line interface3
  • Python scripting support1
  • Scripting language support1
Disk and filesystem forensics 15 features Investigation and response since 2006
EWF acquisition control shipped Acquires physical devices or specific offsets/sizes into EWF images with configurable chunk sizes, error retries, and compression settings. 22 releases · first seen Apr 2006

Shared capability: Disk and filesystem forensics

release 22 total

  • ewfacquirestream now accepts -P option to set bytes per sector 20101029 · Oct 2010 · source · release history
  • Adds encase6 as the default acquisition format for encase1 input in ewfacquirestream. 20101019 · Oct 2010 · source · release history
  • Adds acquisition resume offset alignment support in ewfacquire for non-block-boundary offsets. 20090509 · May 2009 · source · release history
  • Added ewfacquire(stream) -P option to set bytes per sector 20090228 · Feb 2009 · source · release history
  • Added support for missing units in byte size string (defaults to mebibytes) 20090228 · Feb 2009 · source · release history
  • Implements imaging_handle in ewfacquirestream to add raw access support for imaging operations 20090225 · Feb 2009 · source · release history
EWF header and metadata management shipped Reads, writes, and manipulates EWF header fields, including signature identification, compression info, and XML xheader support. 20 releases · first seen Apr 2006

Shared capability: Disk and filesystem forensics

release 20 total

  • Adds get_entry_flags and get_media_data_value functions to the ewf.net module 20120212 · Feb 2012 · source · release history
  • Adds libewf_file_entry_get_offset function for retrieving file entry offsets 20111016 · Oct 2011 · source · release history
  • Formats extents header value in a more table-like manner 20090425 · Apr 2009 · source · release history
  • Adds libewf_convert_date_xheader_value function to convert extended header values to dates 20071110 · Nov 2007 · source · release history
  • Adds libewf_set_hash_value_md5 and libewf_set_hash_value_sha1 macros to set hash values 20070908 · Sep 2007 · source · release history
  • The function libewf_calculate_md5_hash has been removed from the public API. 20070905 · Sep 2007 · source · release history
E01 and S01 forensic image support shipped Read and write Expert Witness Compression Format (EWF) disk images, including E01 and S01 variants. 10 releases · 1 other source · first seen Apr 2006

Shared capability: Disk and filesystem forensics

Also counts toward: Command-line interface

release 10 total

  • Support for EnCase segment files larger than 2 GiB (tested with EnCase 6.7). 20070905 · Sep 2007 · source · release history
  • Adds write support for EnCase 6.7 EWF segment files larger than 2 GiB. 20070829 · Aug 2007 · source · release history
  • Enables reading EnCase 6.7 EWF segment files exceeding 2 GiB. 20070829 · Aug 2007 · source · release history
  • Completes reading dirty chunks from delta segment files 20070819 · Aug 2007 · source · release history
  • Updates ewfexport to no longer export to stdout by default, requiring -t - for continuous raw output 20070819 · Aug 2007 · source · release history
  • ewfexport no longer exports to stdout by default; users must now specify -t - to write to stdout only for continuous raw output 20070819 · Aug 2007 · source · release history

docs

  • Library and tools to read/write Expert Witness Compression Format (EWF) forensic disk images in formats like E01 and S01.
EWF image information analysis shipped Displays detailed information about EWF images, including date formats, compression media, and header values. 9 releases · first seen Apr 2006

Shared capability: Disk and filesystem forensics

release 9 total

  • Adds offset, size, and duplicate_offset methods to the file entry class 20120212 · Feb 2012 · source · release history
  • File entry date and time values are now 32-bit values instead of their previous type 20111016 · Oct 2011 · source · release history
  • section read count is returned instead of section size when possible 20071123 · Nov 2007 · source · release history
  • ewfinfo now uses ctime as the default date format instead of the previous default. 20071110 · Nov 2007 · source · release history
  • ewfinfo now prints additional hashes (SHA1) 20070120 · Jan 2007 · source · release history
  • ewfinfo will now print extended header values 20070115 · Jan 2007 · source · release history
SHA-1 hash verification support shipped Performs SHA-1 checksum verification for EWF images via CLI tools and provides macros to retrieve or set SHA-1 values within the library API. 7 releases · first seen Jan 2007

Shared capability: Disk and filesystem forensics

Also counts toward: Command-line interface

release 7 total

  • worked on libhashf to wrap message digest hash functions 20110625 · Jun 2011 · source · release history
  • ewfexport now supports SHA1 hash calculation for exported EWF files. 20071124 · Nov 2007 · source · release history
  • Adds libewf_get_hash_value_md5 and libewf_get_hash_value_sha1 macros to retrieve calculated hashes 20070908 · Sep 2007 · source · release history
  • Adds libewf_set_hash_value_md5 and libewf_set_hash_value_sha1 macros to set hash values 20070908 · Sep 2007 · source · release history
  • ewfverify gains SHA-1 hash verification capability 20070120 · Jan 2007 · source · release history
  • ewfacquire and ewfacquirestream gain an option to calculate SHA1 hashes 20070120 · Jan 2007 · source · release history
Extended header (xheader) parsing and conversion shipped Parses extended header values, converts them to date formats, and allows setting custom user-defined xheader values during acquisition. 7 releases · first seen Jan 2007

Shared capability: Disk and filesystem forensics

release 7 total

  • Added support for 5 value xheader date/time value in EWF files. 20101025 · Oct 2010 · source · release history
  • EWF image header date fields now include the UTC/GMT offset (e.g., +0200) for precise timestamp preservation 20090418 · Apr 2009 · source · release history
  • Adds set_header_codepage function to control the codepage used when writing EWF header values 20090418 · Apr 2009 · source · release history
  • Adds APIv2 function to retrieve current segment filename 20090404 · Apr 2009 · source · release history
  • ewfinfo now outputs session information as part of media information if present. 20080302 · Mar 2008 · source · release history
  • Adds libewf_convert_date_xheader_value function to convert extended header values to dates 20071110 · Nov 2007 · source · release history
EWF acquisition reporting shipped Provides status updates during acquisition, including start/finish times, throughput, and computed hash verification. 7 releases · first seen Apr 2006

Shared capability: Disk and filesystem forensics

release 7 total

  • Adds libnotify integration. 20090624 · Jun 2009 · source · release history
  • ewfacquire, ewfacquirestream, and ewfexport use byte size strings for segment file sizes (excluding acquisition size). 20080302 · Mar 2008 · source · release history
  • Adds libewf_get_amount_of_acquiry_errors function to retrieve the count of acquisition errors 20071027 · Oct 2007 · source · release history
  • ewfacquire prints the computed MD5 hash upon successful acquisition 20060928 · Sep 2006 · source · release history
  • Updates ewfacquire to report total acquire time and bytes/second throughput 20060905 · Sep 2006 · source · release history
  • ewfacquire now reports start and finish time values. 20060904 · Sep 2006 · source · release history
EWF verification via CLI shipped Verifies EWF images by calculating and comparing checksums, including support for MD5 hashing. 7 releases · first seen Apr 2006

Shared capability: Disk and filesystem forensics

Also counts toward: Command-line interface

release 7 total

  • ewfexport now supports SHA1 hash calculation for exported EWF files. 20071124 · Nov 2007 · source · release history
  • Adds libewf_get_hash_value_md5 and libewf_get_hash_value_sha1 macros to retrieve calculated hashes 20070908 · Sep 2007 · source · release history
  • Improves ewfverify output by fixing misleading Success error messages via errno checks. 20070829 · Aug 2007 · source · release history
  • ewfverify gains SHA-1 hash verification capability 20070120 · Jan 2007 · source · release history
  • Replaces direct MD5 access with OpenSSL's EVP interface for hashing 20070120 · Jan 2007 · source · release history
  • Added md5.h header to provide an abstraction layer over different MD5 calculation code bases, such as the one integrated in The SleuthKit. 20060413 · Apr 2006 · source · release history
Acquisition error reporting and handling shipped Tracks acquisition errors via API counters and automatically wipes raw buffers/chunks when acquisition errors occur to prevent data leakage. 5 releases · first seen Oct 2007

Shared capability: Disk and filesystem forensics

release

  • Makes ewfacquire more tolerant for missing device information 20100110 · Jan 2010 · source · release history
  • added support for handling empty last session 20090624 · Jun 2009 · source · release history
  • implemented 64-bit sector support in APIv2 for add crc and acquiry error and sessions 20090501 · May 2009 · source · release history
  • Adds automatic chunk wiping in ewfacquire on acquisition errors 20071110 · Nov 2007 · source · release history
  • Adds libewf_get_amount_of_acquiry_errors function to retrieve the count of acquisition errors 20071027 · Oct 2007 · source · release history
Large segment file support (>2 GiB) shipped Enables reading and writing EnCase-style EWF segment files larger than 2 GiB, including specific support for EnCase 6.7 format compatibility. 5 releases · first seen Aug 2007

Shared capability: Disk and filesystem forensics

release

  • ewfacquirestream and ewfexport added support for segment files larger than 2 GiB. 20071124 · Nov 2007 · source · release history
  • Enables write support for EnCase 6.7 segment files larger than 2 GiB 20070908 · Sep 2007 · source · release history
  • Support for EnCase segment files larger than 2 GiB (tested with EnCase 6.7). 20070905 · Sep 2007 · source · release history
  • Adds write support for EnCase 6.7 EWF segment files larger than 2 GiB. 20070829 · Aug 2007 · source · release history
  • Enables reading EnCase 6.7 EWF segment files exceeding 2 GiB. 20070829 · Aug 2007 · source · release history
CD-ROM media type support shipped Adds specific metadata support for CD-ROM media types during image acquisition. 2 releases · first seen Nov 2007

Shared capability: Disk and filesystem forensics

release

EnCase Linen 5 format compatibility shipped Creates EWF files compatible with the EnCase Linen 5 format and supports reading its specific metadata. 2 releases · first seen Aug 2006

Shared capability: Disk and filesystem forensics

release

  • Adds linen5 write support enabling creation of EWF files compatible with EnCase linen 5 format 20061129 · Nov 2006 · source · release history
  • Makes the encase5 file option the default for ewfacquire 20060816 · Aug 2006 · source · release history
EWF byte order and endian conversion shipped Handles byte swapping and UTF-16 to ASCII conversion for cross-platform compatibility during read/write operations. 2 releases · first seen Aug 2006

Shared capability: Disk and filesystem forensics

release

  • UTF-16 to ASCII conversion includes simple byte order detection. 20060908 · Sep 2006 · source · release history
  • Adds byte swap (equivalent of dd conv=swab) functionality in both read and write operations 20060822 · Aug 2006 · source · release history
EWF file path globbing shipped Allows matching multiple EWF disk image files simultaneously using glob patterns in the Python interface. 1 release · first seen Oct 2010

Shared capability: Disk and filesystem forensics

Also counts toward: Python scripting support, Scripting language support

release

  • pyewf now implements pyewf_glob, enabling globbing patterns to match multiple EWF disk image files simultaneously. 20101014 · Oct 2010 · source · release history
EWF export notification support shipped Provides event notifications when files are exported via the EWF export tooling. 1 release · first seen Oct 2010

Shared capability: Disk and filesystem forensics

release

  • ewfexport added exporting notification for files export 20101005 · Oct 2010 · source · release history
Other / not yet classified 2 features Features we have not matched to a capability yet. A suggested match is marked.
Modern Python packaging configuration shipped Manage setuptools project metadata within pyproject.toml. 6 releases · first seen Dec 2006

release

  • Moves setuptools configuration into pyproject.toml.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 20140817 · Sep 2026 · source · release history
  • Adds libewf_get_flags_ function for use of libewf in Phyton with ctypes 20070819 · Aug 2007 · source · release history
  • Adds get_version function to retrieve the library version 20070107 · Jan 2007 · source · release history
  • Adds write_random function for random-access writing support 20061227 · Dec 2006 · source · release history
  • Adds pkg-config file (experimental) to aid build integration 20061227 · Dec 2006 · source · release history
  • Adds make lib and make library targets for compiling libewf as a standalone library without running tests 20061223 · Dec 2006 · source · release history
Cross-platform and build system support shipped Supports native compilation on Win32 via CMake, RPM builds, and library linking via Libtool. 4 releases · first seen Apr 2006

release

  • Improved libtool DLL support for Windows builds 20070715 · Jul 2007 · source · release history
  • Enabled native compilation of libewf and its tools on Win32 via CMake adjustments. 20061022 · Oct 2006 · source · release history
  • Adds libtool support based on patches by Rob Meijer 20061009 · Oct 2006 · source · release history
  • Added md5.h header to provide an abstraction layer over different MD5 calculation code bases, such as the one integrated in The SleuthKit. 20060413 · Apr 2006 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for libewf, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail libewf puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

69 entries

  1. September 20261
  2. February 20121
  3. October 20111
  4. June 20111
  5. October 20105
  6. January 20101
  7. June 20091
  8. May 20093
  9. April 20094
  10. February 20092
  11. September 20082
  12. August 20081
  13. March 20082
  14. November 20073
  15. October 20071
  16. September 20072
  17. August 20072
  18. July 20071
  19. January 20075
  20. December 20064
  21. November 20063
  22. October 20067
  23. September 20065
  24. August 20066
  25. May 20061
  26. April 20064
    Show

    69 entries

    Project health

    Issue, contributor and maintainer activity in libyal/libewf-legacy, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 ±0 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close 2.2 years issues closed, last 12 months
    6. Open backlog 2 of 27 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 2
    3. Contributors / month 1
    4. Commits / month 4
    5. Stars 15
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →