libewf
20140817 open-sourceThe section your link pointed to isn't on libewf's page any more, so we've brought you to the top.
Library and tools to read/write Expert Witness Compression Format (EWF) forensic disk images in formats like E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. and S01.
Summary
libewf is an open-source (LGPL-3.0) library for reading and writing the Expert Witness Compression Format used for forensic disk images, including SMART .s01 and EnCase .E01, with read-only support for Logical Evidence Files. It is built to be linked into other software, but the package also ships command-line tools for acquiring media to EWF, exporting or recovering corrupt image sets, verifying data integrity, and mounting EWF files via FUSEFUSEA Linux kernel interface that lets userspace programs implement a filesystem without kernel code, maintained as part of the kernel project; tools use it to mount virtual or synthetic filesystems without requiring root or kernel modules., which makes it usable directly from a terminal as well. This puts it in the hands of digital forensics practitioners who need to create, convert, or validate disk images rather than application developers building unrelated features. It sits in the DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. tooling space alongside other evidence-format libraries rather than any named competitor. Development is quiet but not dormant: one maintainer, first committed in 2016, with 11 commits in the past year.
Library and tools to read/write Expert Witness Compression Format (EWF) forensic disk images in formats like E01 and S01.
How libewf helps
Is this seized drive still an exact match to the image I made of it?
recalculates the stored hash across the full data set and reports whether it still verifies against the value recorded at acquisition time
Can I recover a usable image from a disk set that got corrupted?
rebuilds a new EWF set from the damaged one, skipping unreadable sections while carrying forward as much of the original data as possible
What metadata was captured about this piece of evidence?
reads the case information, hashes, and acquisition details stored in the image file and prints them without touching the raw media
How do I get this evidence into a format another tool can open?
exports the media data to raw format or converts it to a different EWF version, splitting output files as needed
Can I browse this image's contents without extracting the whole thing first?
mounts the EWF file as a filesystem via FUSE so files inside can be read directly with normal tools
How do I capture a live acquisition from a device rather than an existing file?
writes storage media data straight from the device or from stdin into a new EWF file as it is acquired
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for libewf, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail libewf puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
69 entries
No entries match these filters.
- September 20261
- February 20121
- October 20111
- June 20111
- October 20105
- January 20101
- June 20091
- May 20093
- April 20094
- February 20092
- September 20082
- August 20081
- March 20082
- November 20073
- October 20071
- September 20072
- August 20072
- July 20071
- January 20075
- December 20064
- November 20063
- October 20067
- September 20065
- August 20066
- May 20061
- April 20064
Project health
Issue, contributor and maintainer activity in libyal/libewf-legacy, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 1 ±0 vs prior 12 months
- Maintainers 1 +1 joined · −0 left, last 12 months
- Bus factor 1 committers behind half the commits
- Community-filed not measured of issues opened, last 12 months
- Median time to close 2.2 years issues closed, last 12 months
- Open backlog 2 of 27 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 2
- Contributors / month 1
- Commits / month 4
- Stars 15
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Libraries its release ships
What its latest release locks, checked against known advisories.None of its release's images build from a lockfile we can read.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.