---
name: "ewfrecover"
section: "1"
platform: "linux"
package: "libewf"
version: "20140816-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/ewfrecover"
---

# ewfrecover(1)

exports media data stored in EWF files

## NAME

**ewfrecover** – exports media data stored in EWF files

## SYNOPSIS

**ewfrecover** \[**-A** *codepage*\] \[**-l** *log\_filename*\] \[**-p** *process\_buffer\_size*\] \[**-t** *target*\] \[**-hquvVx**\] *ewf\_files*

## DESCRIPTION

**ewfrecover** is a utility to recover corrupt EWF files.

**ewfrecover** is part of the **libewf** package. **libewf** is a library to access the Expert Witness Compression Format (EWF).

*ewf\_files* the first or the entire set of EWF segment files

The options are as follows:

- **-A** *codepage*

  the codepage of header section, options: ascii (default), windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252, windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258

- **-h**

  shows this help

- **-l** *log\_filename*

  logs recover errors and the digest (hash) to the log filename

- **-p** *process\_buffer\_size*

  the process buffer size (default is the chunk size)

- **-t** *target*

  the target file to recover to (default is recover)

- **-v**

  verbose output to stderr

- **-V**

  print version

- **-x**

  use the chunk data instead of the buffered read and write functions.

## ENVIRONMENT

None

## FILES

None

## EXAMPLES

**ewfrecover** will ask the information it needs.

### Recovering a corrupted image

```
ewfrecover corrupt.E01
ewfrecover 20120805
Export started at: Mon Aug  6 07:09:34 2012
This could take a while.
...
```

Export completed at: Mon Aug  6 07:09:34 2012

MD5 hash calculated over data:		d41d8cd98f00b204e9800998ecf8427e ewfrecover: SUCCESS

### Trying to recover a non-corrupted image

```
ewfrecover notcorrupt.E01
ewfrecover 20120805
EWF file(s) are not corrupted.
```

## DIAGNOSTICS

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

## BUGS

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libewf-legacy/issues

## AUTHOR

These man pages were written by Joachim Metz.

## COPYRIGHT

Copyright 2006-2014, Joachim Metz \<joachim.metz@gmail.com\>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

[ewfacquire(1)](/ewfacquire/1.md), [ewfacquirestream(1)](/ewfacquirestream/1.md), [ewfexport(1)](/ewfexport/1.md), [ewfinfo(1)](/ewfinfo/1.md), [ewfmount(1)](/ewfmount/1.md), [ewfverify(1)](/ewfverify/1.md)