it in EWF format(1)
ENVIRONMENT
None
FILES
None
EXAMPLES
# ewfacquirestream -C 1 -D Floppy -E 1.1 -e 'John D.' -N 'Just a floppy in my system' -m removable -M physical -t floppy </dev/fd0 ewfacquirestream 20090229 (libewf 20090229, libuna 20090124, zlib 1.2.3, libcrypto 0.9.8g, libuuid)
Using the following acquiry parameters:
Image path and filename: floppy.E01
Case number: 1
Description: Floppy
Evidence number: 1.1
Examiner name: John D.
Notes: Just a floppy in my system
Media type: removable
Volume type: physical
Compression used: none
EWF file format: EnCase 5
Acquiry start offet: 0
Amount of bytes to acquire: 0 (until end of input)
Evidence segment file size: 1.4 GiB (1572864000 bytes)
Block size: 64 sectors
Error granularity: 64 sectors
Retries on read error: 2
Wipe sectors on read error: no
Acquiry started at: Sat Feb 28 11:32:41 2009
This could take a while.
- Status: acquired 1.4 MiB (1474560 bytes)
- in 1 second(s) with 1 MiB/s (1474560 bytes/second).
- Acquiry completed at: Sat Feb 28 11:32:42 2009
- Written: 1.4 MiB (1474560 bytes) in 1 second(s) with 1 MiB/s (1474560 bytes/second).
- MD5 hash calculated over data: ae1ce8f5ac079d3ee93f97fe3792bda3
DIAGNOSTICS
Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled
at compilation.
BUGS
Please report bugs of any kind to <forensics@hoffmannbv.nl> or on the
project website: http://libewf.sourceforge.net/
AUTHOR
These man pages were written by Joachim Metz.
COPYRIGHT
Copyright 2006-2009 Joachim Metz, Hoffmann Investigations <forensics@hoffmannbv.nl> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.