int main( int argc, char * const argv[] )
#endif
{
uint8_t guid[ 16 ];
#ifndef HAVE_GLOB_H
EWFGLOB *glob = NULL;
int32_t glob_count = 0;
#endif
LIBEWF_HANDLE *handle = NULL;
INT_T option = 0;
int8_t format = 0;
int8_t compression_level = 0;
int8_t media_type = 0;
int8_t media_flags = 0;
int8_t volume_type = 0;
uint8_t verbose = 0;
uint8_t date_format = LIBEWF_DATE_FORMAT_DAYMONTH;
char info_option = 'a';
ewfsignal_initialize();
ewfcommon_version_fprint( stderr, _S_LIBEWF_CHAR( "ewfinfo" ) );
while( ( option = ewfgetopt( argc, argv, _S_CHAR_T( "d:himvV" ) ) ) != (INT_T) -1 )
{
switch( option )
{
case (INT_T) '?':
default:
fprintf( stderr, "Invalid argument: %" PRIs "\n", argv[ optind ] );
usage();
return( EXIT_FAILURE );
case (INT_T) 'd':
if( CHAR_T_COMPARE( optarg, _S_CHAR_T( "md" ), 3 ) == 0 )
{
date_format = LIBEWF_DATE_FORMAT_MONTHDAY;
}
else if( CHAR_T_COMPARE( optarg, _S_CHAR_T( "iso8601" ), 8 ) == 0 )
{
date_format = LIBEWF_DATE_FORMAT_ISO8601;
}
else if( CHAR_T_COMPARE( optarg, _S_CHAR_T( "dm" ), 3 ) != 0 )
{
fprintf( stderr, "Unsupported date format: %" PRIs " using default day/month.\n", optarg );
}
break;
case (INT_T) 'e':
if( info_option != 'a' )
{
fprintf( stderr, "Conflicting options: %" PRIc " and %c\n", option, info_option );
usage();
return( EXIT_FAILURE );
}
info_option = 'e';
break;
case (INT_T) 'h':
usage();
return( EXIT_SUCCESS );
case (INT_T) 'i':
if( info_option != 'a' )
{
fprintf( stderr, "Conflicting options: %" PRIc " and %c\n", option, info_option );
usage();
return( EXIT_FAILURE );
}
info_option = 'i';
break;
case (INT_T) 'm':
if( info_option != 'a' )
{
fprintf( stderr, "Conflicting options: %" PRIc " and %c\n", option, info_option );
usage();
return( EXIT_FAILURE );
}
info_option = 'm';
break;
case (INT_T) 'v':
verbose = 1;
break;
case (INT_T) 'V':
ewfcommon_copyright_fprint( stderr );
return( EXIT_SUCCESS );
}
}
if( optind == argc )
{
fprintf( stderr, "Missing EWF image file(s).\n" );
usage();
return( EXIT_FAILURE );
}
libewf_set_notify_values( stderr, verbose );
#ifndef HAVE_GLOB_H
glob = ewfglob_alloc();
if( glob == NULL )
{
fprintf( stderr, "Unable to create glob.\n" );
return( EXIT_FAILURE );
}
glob_count = ewfglob_resolve( glob, &argv[ optind ], ( argc - optind ) );
if( glob_count <= 0 )
{
fprintf( stderr, "Unable to resolve glob.\n" );
ewfglob_free( glob );
return( EXIT_FAILURE );
}
handle = libewf_open( glob->results, glob->amount, LIBEWF_OPEN_READ );
ewfglob_free( glob );
#else
handle = libewf_open( &argv[ optind ], ( argc - optind ), LIBEWF_OPEN_READ );
#endif
if( handle == NULL )
{
fprintf( stderr, "Unable to open EWF image file(s).\n" );
return( EXIT_FAILURE );
}
if( libewf_parse_header_values( handle, date_format ) != 1 )
{
fprintf( stderr, "Unable to parse header values.\n" );
}
format = libewf_get_format( handle );
if( verbose == 1 )
{
fprintf( stdout, "File format:\t\t\t" );
switch( format )
{
case LIBEWF_FORMAT_EWF:
fprintf( stdout, "original EWF" );
break;
case LIBEWF_FORMAT_SMART:
fprintf( stdout, "SMART" );
break;
case LIBEWF_FORMAT_FTK:
fprintf( stdout, "FTK Imager" );
break;
case LIBEWF_FORMAT_ENCASE1:
fprintf( stdout, "EnCase 1" );
break;
case LIBEWF_FORMAT_ENCASE2:
fprintf( stdout, "EnCase 2" );
break;
case LIBEWF_FORMAT_ENCASE3:
fprintf( stdout, "EnCase 3" );
break;
case LIBEWF_FORMAT_ENCASE4:
fprintf( stdout, "EnCase 4" );
break;
case LIBEWF_FORMAT_ENCASE5:
fprintf( stdout, "EnCase 5" );
break;
case LIBEWF_FORMAT_ENCASE6:
fprintf( stdout, "EnCase 6" );
break;
case LIBEWF_FORMAT_LINEN5:
fprintf( stdout, "linen 5" );
break;
case LIBEWF_FORMAT_LINEN6:
fprintf( stdout, "linen 6" );
break;
case LIBEWF_FORMAT_EWFX:
fprintf( stdout, "extended EWF (libewf)" );
break;
case LIBEWF_FORMAT_UNKNOWN:
default:
fprintf( stdout, "unknown" );
break;
}
fprintf( stdout, "\n\n" );
}
if( ( info_option == 'a' ) || ( info_option == 'i' ) )
{
fprintf( stdout, "Acquiry information\n" );
ewfcommon_header_values_fprint( stdout, handle );
fprintf( stdout, "\n" );
}
if( ( info_option == 'a' ) || ( info_option == 'm' ) )
{
fprintf( stdout, "Media information\n" );
if( ( format != LIBEWF_FORMAT_EWF )
&& ( format != LIBEWF_FORMAT_SMART ) )
{
media_type = libewf_get_media_type( handle );
media_flags = libewf_get_media_flags( handle );
volume_type = libewf_get_volume_type( handle );
if( media_type == LIBEWF_MEDIA_TYPE_REMOVABLE )
{
fprintf( stdout, "\tMedia type:\t\tremovable disk\n" );
}
else if( media_type == LIBEWF_MEDIA_TYPE_FIXED )
{
fprintf( stdout, "\tMedia type:\t\tfixed disk\n" );
}
else
{
fprintf( stdout, "\tMedia type:\t\tunknown (0x%" PRIx8 ")\n", media_type );
}
if( verbose == 1 )
{
fprintf( stdout, "\tMedia flags:\t\t0x%" PRIx8 "\n", media_flags );
}
if( volume_type == LIBEWF_VOLUME_TYPE_LOGICAL )
{
fprintf( stdout, "\tMedia is physical:\tno\n" );
}
else if( volume_type == LIBEWF_VOLUME_TYPE_PHYSICAL )
{
fprintf( stdout, "\tMedia is physical:\tyes\n" );
}
else
{
fprintf( stdout, "\tVolume type:\t\tunknown (0x%" PRIx8 ")\n", volume_type );
}
}
fprintf( stdout, "\tAmount of sectors:\t%" PRIu32 "\n", libewf_get_amount_of_sectors( handle ) );
fprintf( stdout, "\tBytes per sector:\t%" PRIu32 "\n", libewf_get_bytes_per_sector( handle ) );
fprintf( stdout, "\tMedia size:\t\t%" PRIu64 "\n", libewf_get_media_size( handle ) );
if( ( format == LIBEWF_FORMAT_ENCASE5 )
|| ( format == LIBEWF_FORMAT_ENCASE6 )
|| ( format == LIBEWF_FORMAT_LINEN5 )
|| ( format == LIBEWF_FORMAT_LINEN6 )
|| ( format == LIBEWF_FORMAT_EWFX ) )
{
fprintf( stdout, "\tError granularity:\t%" PRIu32 "\n", libewf_get_error_granularity( handle ) );
compression_level = libewf_get_compression_level( handle );
if( compression_level == LIBEWF_COMPRESSION_NONE )
{
fprintf( stdout, "\tCompression type:\tno compression\n" );
}
else if( compression_level == LIBEWF_COMPRESSION_FAST )
{
fprintf( stdout, "\tCompression type:\tgood (fast) compression\n" );
}
else if( compression_level == LIBEWF_COMPRESSION_BEST )
{
fprintf( stdout, "\tCompression type:\tbest compression\n" );
}
else
{
fprintf( stdout, "\tCompression type:\tunknown compression\n" );
}
if( libewf_get_guid( handle, guid, 16 ) == 1 )
{
fprintf( stdout, "\tGUID:\t\t\t%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "\n",
guid[ 0 ], guid[ 1 ], guid[ 2 ], guid[ 3 ], guid[ 4 ], guid[ 5 ], guid[ 6 ], guid[ 7 ],
guid[ 8 ], guid[ 9 ], guid[ 10 ], guid[ 11 ], guid[ 12 ], guid[ 13 ], guid[ 14 ], guid[ 15 ]
);
}
}
ewfcommon_hash_values_fprint( stdout, handle );
fprintf( stdout, "\n" );
}
if( ( info_option == 'a' ) || ( info_option == 'e' ) )
{
ewfcommon_acquiry_errors_fprint( stdout, handle );
}
if( libewf_close( handle ) != 0 )
{
fprintf( stdout, "Unable to close EWF file handle.\n" );
return( EXIT_FAILURE );
}
return( EXIT_SUCCESS );
}
int main( int argc, char * const argv[] )
#endif
{
#ifndef HAVE_GLOB_H
EWFGLOB *glob = NULL;
int32_t glob_count = 0;
#endif
LIBEWF_HANDLE *handle = NULL;
uint8_t *buffer = NULL;
INT_T option = 0;
int64_t count = 0;
uint64_t size = 0;
uint64_t alter_offset = 0;
uint64_t alter_size = 0;
uint8_t swap_byte_pairs = 0;
uint8_t verbose = 0;
ewfsignal_initialize();
fprintf( stderr, "ewfalter is for expirimental usage only.\n" );
ewfcommon_version_fprint( stderr, _S_LIBEWF_CHAR( "ewfalter" ) );
while( ( option = ewfgetopt( argc, argv, _S_CHAR_T( "hsqvV" ) ) ) != (INT_T) -1 )
{
switch( option )
{
case (INT_T) '?':
default:
fprintf( stderr, "Invalid argument: %" PRIs ".\n", argv[ optind ] );
usage();
return( EXIT_FAILURE );
case (INT_T) 'h':
usage();
return( EXIT_SUCCESS );
case (INT_T) 's':
swap_byte_pairs = 1;
break;
case (INT_T) 'q':
break;
case (INT_T) 'v':
verbose = 1;
break;
case (INT_T) 'V':
ewfcommon_copyright_fprint( stderr );
return( EXIT_SUCCESS );
}
}
if( optind == argc )
{
fprintf( stderr, "Missing EWF image file(s).\n" );
usage();
return( EXIT_FAILURE );
}
libewf_set_notify_values( stderr, verbose );
#ifndef HAVE_GLOB_H
glob = ewfglob_alloc();
if( glob == NULL )
{
fprintf( stderr, "Unable to create glob.\n" );
return( EXIT_FAILURE );
}
glob_count = ewfglob_resolve( glob, &argv[ optind ], ( argc - optind ) );
if( glob_count <= 0 )
{
fprintf( stderr, "Unable to resolve glob.\n" );
ewfglob_free( glob );
return( EXIT_FAILURE );
}
handle = libewf_open( glob->results, glob->amount, LIBEWF_OPEN_READ_WRITE );
ewfglob_free( glob );
#else
handle = libewf_open( &argv[ optind ], ( argc - optind ), LIBEWF_OPEN_READ_WRITE );
#endif
if( handle == NULL )
{
fprintf( stderr, "Unable to open EWF image file(s).\n" );
return( EXIT_FAILURE );
}
if( libewf_set_swap_byte_pairs( handle, swap_byte_pairs ) != 1 )
{
fprintf( stderr, "Unable to set swap byte pairs in handle.\n" );
return( EXIT_FAILURE );
}
size = libewf_get_media_size( handle );
if( size == 0 )
{
fprintf( stderr, "Error altering data from EWF file(s) - media size is 0.\n" );
return( EXIT_FAILURE );
}
/* Request the necessary case data
*/
fprintf( stderr, "Information for alter required, please provide the necessary input\n" );
alter_offset = ewfcommon_get_user_input_size_variable( stderr, _S_LIBEWF_CHAR( "Start altering at offset" ), 0, size, 0 );
alter_size = ewfcommon_get_user_input_size_variable( stderr, _S_LIBEWF_CHAR( "Amount of bytes to alter" ), 0, size, size );
buffer = libewf_common_alloc( alter_size * sizeof( uint8_t ) );
if( buffer == NULL )
{
fprintf( stderr, "Unable to allocate buffer.\n" );
if( libewf_close( handle ) != 0 )
{
fprintf( stdout, "Unable to close EWF file handle.\n" );
}
return( EXIT_FAILURE );
}
if( libewf_common_memset( buffer, 'X', alter_size ) == NULL )
{
fprintf( stderr, "Unable to set buffer.\n" );
if( libewf_close( handle ) != 0 )
{
fprintf( stdout, "Unable to close EWF file handle.\n" );
}
return( EXIT_FAILURE );
}
count = libewf_write_random( handle, buffer, alter_size, alter_offset );
if( count <= -1 )
{
fprintf( stderr, "Alteration failed.\n" );
if( libewf_close( handle ) != 0 )
{
fprintf( stdout, "Unable to close EWF file handle.\n" );
}
return( EXIT_FAILURE );
}
fprintf( stderr, "Alteration completed.\n" );
if( libewf_close( handle ) != 0 )
{
fprintf( stdout, "Unable to close EWF file handle.\n" );
return( EXIT_FAILURE );
}
return( EXIT_SUCCESS );
}
int main( int argc, char * const argv[] )
#endif
{
character_t media_size_string[ 16 ];
uint8_t guid[ 16 ];
character_t *program = _CHARACTER_T_STRING( "ewfinfo" );
#if !defined( HAVE_GLOB_H )
ewfglob_t *glob = NULL;
int32_t glob_count = 0;
#endif
#if defined( HAVE_STRERROR_R ) || defined( HAVE_STRERROR )
system_character_t *error_string = NULL;
#endif
char *file_format_string = NULL;
system_integer_t option = 0;
size64_t media_size = 0;
uint32_t bytes_per_sector = 0;
uint32_t amount_of_sectors = 0;
uint32_t error_granularity = 0;
uint32_t amount_of_acquiry_errors = 0;
uint32_t amount_of_sessions = 0;
int8_t compression_level = 0;
int8_t media_type = 0;
int8_t media_flags = 0;
int8_t volume_type = 0;
uint8_t compress_empty_block = 0;
uint8_t format = 0;
uint8_t verbose = 0;
uint8_t date_format = LIBEWF_DATE_FORMAT_CTIME;
char info_option = 'a';
int result = 0;
/*
ewfoutput_version_fprint(
stdout,
program );
*/
while( ( option = ewfgetopt(
argc,
argv,
_SYSTEM_CHARACTER_T_STRING( "d:ehimvcV" ) ) ) != (system_integer_t) -1 )
{
switch( option )
{
case (system_integer_t) '?':
default:
fprintf( stderr, "Invalid argument: %" PRIs_SYSTEM "\n",
argv[ optind ] );
usage_fprint(
stdout );
return( EXIT_FAILURE );
case (system_integer_t) 'd':
if( system_string_compare(
optarg,
_SYSTEM_CHARACTER_T_STRING( "dm" ),
3 ) == 0 )
{
date_format = LIBEWF_DATE_FORMAT_DAYMONTH;
}
else if( system_string_compare(
optarg,
_SYSTEM_CHARACTER_T_STRING( "md" ),
3 ) == 0 )
{
date_format = LIBEWF_DATE_FORMAT_MONTHDAY;
}
else if( system_string_compare(
optarg,
_SYSTEM_CHARACTER_T_STRING( "iso8601" ),
8 ) == 0 )
{
date_format = LIBEWF_DATE_FORMAT_ISO8601;
}
else if( system_string_compare(
optarg,
_SYSTEM_CHARACTER_T_STRING( "ctime" ),
3 ) != 0 )
{
fprintf( stderr, "Unsupported date format: %" PRIs_SYSTEM " using default ctime.\n",
optarg );
}
break;
case (system_integer_t) 'e':
if( info_option != 'a' )
{
fprintf( stderr, "Conflicting options: %" PRIc_SYSTEM " and %c\n",
option, info_option );
usage_fprint(
stdout );
return( EXIT_FAILURE );
}
info_option = 'e';
break;
case (system_integer_t) 'h':
usage_fprint(
stdout );
return( EXIT_SUCCESS );
case (system_integer_t) 'i':
if( info_option != 'a' )
{
fprintf( stderr, "Conflicting options: %" PRIc_SYSTEM " and %c\n",
option, info_option );
usage_fprint(
stdout );
return( EXIT_FAILURE );
}
info_option = 'i';
break;
case (system_integer_t) 'c':
info_option = 'c';
break;
case (system_integer_t) 'm':
if( info_option != 'a' )
{
fprintf( stderr, "Conflicting options: %" PRIc_SYSTEM " and %c\n",
option, info_option );
usage_fprint(
stdout );
return( EXIT_FAILURE );
}
info_option = 'm';
break;
case (system_integer_t) 'v':
verbose = 1;
break;
case (system_integer_t) 'V':
ewfoutput_copyright_fprint(
stdout );
return( EXIT_SUCCESS );
}
}
if( optind == argc )
{
fprintf( stderr, "Missing EWF image file(s).\n" );
usage_fprint(
stdout );
return( EXIT_FAILURE );
}
libewf_set_notify_values(
stderr,
verbose );
if( ewfsignal_attach(
ewfcommon_signal_handler ) != 1 )
{
fprintf( stderr, "Unable to attach signal handler.\n" );
}
#if 0 && !defined( HAVE_GLOB_H )
glob = ewfglob_alloc();
if( glob == NULL )
{
fprintf( stderr, "Unable to create glob.\n" );
return( EXIT_FAILURE );
}
glob_count = ewfglob_resolve(
glob,
&argv[ optind ],
( argc - optind ) );
if( glob_count <= 0 )
{
fprintf( stderr, "Unable to resolve glob.\n" );
ewfglob_free(
glob );
return( EXIT_FAILURE );
}
ewfcommon_libewf_handle = libewf_open(
glob->results,
glob->amount,
LIBEWF_OPEN_READ );
ewfglob_free(
glob );
#else
ewfcommon_libewf_handle = libewf_open(
&argv[ optind ],
( argc - optind ),
LIBEWF_OPEN_READ );
#endif
if( ( ewfcommon_abort == 0 )
&& ( ewfcommon_libewf_handle == NULL ) )
{
#if defined( HAVE_STRERROR_R ) || defined( HAVE_STRERROR )
if( errno != 0 )
{
error_string = ewfcommon_strerror(
errno );
}
if( error_string != NULL )
{
fprintf( stderr, "Unable to open EWF file(s) with failure: %" PRIs_SYSTEM ".\n",
error_string );
memory_free(
error_string );
}
else
{
fprintf( stderr, "Unable to open EWF file(s).\n" );
}
#else
fprintf( stderr, "Unable to open EWF file(s).\n" );
#endif
return( EXIT_FAILURE );
}
if( ( ewfcommon_abort == 0 )
&& ( libewf_parse_header_values(
ewfcommon_libewf_handle,
date_format ) != 1 ) )
{
fprintf( stderr, "Unable to parse header values.\n" );
}
if( ( ewfcommon_abort == 0 )
&& ( libewf_get_format(
ewfcommon_libewf_handle,
&format ) != 1 ) )
{
fprintf( stderr, "Unable to determine format.\n" );
}
else if( verbose == 1 )
{
switch( format )
{
case LIBEWF_FORMAT_EWF:
file_format_string = "original EWF";
break;
case LIBEWF_FORMAT_SMART:
file_format_string = "SMART";
break;
case LIBEWF_FORMAT_FTK:
file_format_string = "FTK Imager";
break;
case LIBEWF_FORMAT_ENCASE1:
file_format_string = "EnCase 1";
break;
case LIBEWF_FORMAT_ENCASE2:
file_format_string = "EnCase 2";
break;
case LIBEWF_FORMAT_ENCASE3:
file_format_string = "EnCase 3";
break;
case LIBEWF_FORMAT_ENCASE4:
file_format_string = "EnCase 4";
break;
case LIBEWF_FORMAT_ENCASE5:
file_format_string = "EnCase 5";
break;
case LIBEWF_FORMAT_ENCASE6:
file_format_string = "EnCase 6";
break;
case LIBEWF_FORMAT_LINEN5:
file_format_string = "linen 5";
break;
case LIBEWF_FORMAT_LINEN6:
file_format_string = "linen 6";
break;
case LIBEWF_FORMAT_EWFX:
file_format_string = "extended EWF (libewf)";
break;
case LIBEWF_FORMAT_UNKNOWN:
default:
file_format_string = "unknown";
break;
}
fprintf( stdout, "File format:\t\t\t%s\n\n",
file_format_string );
}
if( ( ewfcommon_abort == 0 )
&& ( ( info_option == 'a' )
|| ( info_option == 'i' ) ) )
{
fprintf( stdout, "Acquiry information\n" );
ewfoutput_header_values_fprint(
stdout,
ewfcommon_libewf_handle );
fprintf( stdout, "\n" );
}
if( ( ewfcommon_abort == 0 )
&& ( ( info_option == 'a' )
|| ( info_option == 'm' ) ) )
{
fprintf( stdout, "Media information\n" );
if( ( format != LIBEWF_FORMAT_EWF )
&& ( format != LIBEWF_FORMAT_SMART ) )
{
if( libewf_get_media_type(
ewfcommon_libewf_handle,
&media_type ) != 1 )
{
fprintf( stderr, "Unable to determine media type.\n" );
}
else if( media_type == LIBEWF_MEDIA_TYPE_REMOVABLE )
{
fprintf( stdout, "\tMedia type:\t\tremovable disk\n" );
}
else if( media_type == LIBEWF_MEDIA_TYPE_FIXED )
{
fprintf( stdout, "\tMedia type:\t\tfixed disk\n" );
}
else if( media_type == LIBEWF_MEDIA_TYPE_CD )
{
fprintf( stdout, "\tMedia type:\t\tCD/DVD\n" );
}
else
{
fprintf( stdout, "\tMedia type:\t\tunknown (0x%" PRIx8 ")\n",
media_type );
}
if( libewf_get_media_flags(
ewfcommon_libewf_handle,
&media_flags ) != 1 )
{
fprintf( stderr, "Unable to determine media flags.\n" );
}
else if( verbose == 1 )
{
fprintf( stdout, "\tMedia flags:\t\t0x%" PRIx8 "\n",
media_flags );
}
if( libewf_get_volume_type(
ewfcommon_libewf_handle,
&volume_type ) != 1 )
{
fprintf( stderr, "Unable to determine volume type.\n" );
}
else if( volume_type == LIBEWF_VOLUME_TYPE_LOGICAL )
{
fprintf( stdout, "\tMedia is physical:\tno\n" );
}
else if( volume_type == LIBEWF_VOLUME_TYPE_PHYSICAL )
{
fprintf( stdout, "\tMedia is physical:\tyes\n" );
}
else
{
fprintf( stdout, "\tVolume type:\t\tunknown (0x%" PRIx8 ")\n",
volume_type );
}
}
if( libewf_get_amount_of_sectors(
ewfcommon_libewf_handle,
&amount_of_sectors ) == 1 )
{
fprintf( stdout, "\tAmount of sectors:\t%" PRIu32 "\n",
amount_of_sectors );
}
else
{
fprintf( stderr, "Unable to determine amount of sectors.\n" );
}
if( libewf_get_bytes_per_sector(
ewfcommon_libewf_handle,
&bytes_per_sector ) == 1 )
{
fprintf( stdout, "\tBytes per sector:\t%" PRIu32 "\n",
bytes_per_sector );
}
else
{
fprintf( stderr, "Unable to determine bytes per sector.\n" );
}
if( libewf_get_media_size(
ewfcommon_libewf_handle,
&media_size ) == 1 )
{
result = ewfbyte_size_string_create(
media_size_string,
16,
media_size,
EWFBYTE_SIZE_STRING_UNIT_MEBIBYTE );
if( result == 1 )
{
fprintf( stdout, "\tMedia size:\t\t%" PRIs " (%" PRIu64 " bytes)\n",
media_size_string, media_size );
}
else
{
fprintf( stdout, "\tMedia size:\t\t%" PRIu64 " bytes\n",
media_size );
}
}
else
{
fprintf( stderr, "Unable to determine media size.\n" );
}
if( ( format == LIBEWF_FORMAT_ENCASE5 )
|| ( format == LIBEWF_FORMAT_ENCASE6 )
|| ( format == LIBEWF_FORMAT_LINEN5 )
|| ( format == LIBEWF_FORMAT_LINEN6 )
|| ( format == LIBEWF_FORMAT_EWFX ) )
{
if( libewf_get_error_granularity(
ewfcommon_libewf_handle,
&error_granularity ) == 1 )
{
fprintf( stdout, "\tError granularity:\t%" PRIu32 "\n",
error_granularity );
}
else
{
fprintf( stderr, "Unable to determine error granularity.\n" );
}
if( libewf_get_compression_values(
ewfcommon_libewf_handle,
&compression_level,
&compress_empty_block ) == 1 )
{
if( compression_level == LIBEWF_COMPRESSION_NONE )
{
fprintf( stdout, "\tCompression type:\tno compression\n" );
}
else if( compression_level == LIBEWF_COMPRESSION_FAST )
{
fprintf( stdout, "\tCompression type:\tgood (fast) compression\n" );
}
else if( compression_level == LIBEWF_COMPRESSION_BEST )
{
fprintf( stdout, "\tCompression type:\tbest compression\n" );
}
else
{
fprintf( stdout, "\tCompression type:\tunknown compression\n" );
}
}
else
{
fprintf( stderr, "Unable to determine compression level.\n" );
}
if( libewf_get_guid(
ewfcommon_libewf_handle,
guid,
16 ) == 1 )
{
fprintf( stdout, "\tGUID:\t\t\t%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8
"%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8 "%.2" PRIx8 "-%.2" PRIx8
"%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "%.2" PRIx8 "\n",
guid[ 0 ], guid[ 1 ], guid[ 2 ], guid[ 3 ], guid[ 4 ], guid[ 5 ], guid[ 6 ], guid[ 7 ],
guid[ 8 ], guid[ 9 ], guid[ 10 ], guid[ 11 ], guid[ 12 ], guid[ 13 ], guid[ 14 ], guid[ 15 ]
);
}
}
ewfoutput_hash_values_fprint(
stdout,
ewfcommon_libewf_handle );
fprintf( stdout, "\n" );
ewfoutput_sessions_fprint(
stdout,
ewfcommon_libewf_handle,
&amount_of_sessions );
}
if ( ( ewfcommon_abort == 0)
&& ( ( info_option =='c' )))
{
libewf_internal_handle_t *handle = (libewf_internal_handle_t *)ewfcommon_libewf_handle;
int i;
struct libewf_chunk_offset *chunk = handle->offset_table->chunk_offset;
// Print some attributes
printf("size=%lld\n", handle->media_values->media_size);
printf("chunk_size=%d\n", handle->media_values->chunk_size);
printf("count=%d\n", handle->offset_table->amount);
for(i=0; i<handle->offset_table->amount; i++) {
printf("%d,%lld,%d,%d,%s\n", i, chunk[i].file_offset, chunk[i].size,
chunk[i].compressed,
chunk[i].segment_file_handle->filename);
};
};
if( ( ewfcommon_abort == 0 )
&& ( ( info_option == 'a' )
|| ( info_option == 'e' ) ) )
{
ewfoutput_acquiry_errors_fprint(
stdout,
ewfcommon_libewf_handle,
&amount_of_acquiry_errors );
}
if( ewfsignal_detach() != 1 )
{
fprintf( stderr, "Unable to detach signal handler.\n" );
}
if( ewfcommon_abort != 0 )
{
fprintf( stdout, "%" PRIs ": ABORTED\n",
program );
return( EXIT_FAILURE );
}
if( libewf_close(
ewfcommon_libewf_handle ) != 0 )
{
fprintf( stderr, "Unable to close EWF file(s).\n" );
return( EXIT_FAILURE );
}
return( EXIT_SUCCESS );
}
