---
name: "libewf"
section: "3"
platform: "linux"
package: "libewf"
version: "20140816-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libewf"
---

# libewf(3)

Library to access the Expert Witness Compression Format (EWF) format

## NAME

**libewf.h** – Library to access the Expert Witness Compression Format (EWF) format

## SYNOPSIS

**#include \<libewf.h\>**

Support functions

*const* *char* *\**\

**libewf\_get\_version**(*void*);

*int*\

**libewf\_get\_access\_flags\_read**(*void*);

*int*\

**libewf\_get\_access\_flags\_read\_write**(*void*);

*int*\

**libewf\_get\_access\_flags\_write**(*void*);

*int*\

**libewf\_get\_access\_flags\_write\_resume**(*void*);

*int*\

**libewf\_get\_codepage**(*int \*codepage*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_set\_codepage**(*int codepage*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_check\_file\_signature**(*const char \*filename*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_glob**(*const char \*filename*, *size\_t filename\_length*, *uint8\_t format*, *char \*\*filenames\[\]*, *int \*number\_of\_filenames*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_glob\_free**(*char \*filenames\[\]*, *int number\_of\_filenames*, *libewf\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libewf\_check\_file\_signature\_wide**(*const wchar\_t \*filename*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_glob\_wide**(*const wchar\_t \*filename*, *size\_t filename\_length*, *uint8\_t format*, *wchar\_t \*\*filenames\[\]*, *int \*number\_of\_filenames*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_glob\_wide\_free**(*wchar\_t \*filenames\[\]*, *int number\_of\_filenames*, *libewf\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libewf\_check\_file\_signature\_file\_io\_handle**(*libbfio\_handle\_t \*file\_io\_handle*, *libewf\_error\_t \*\*error*);

Notify functions

*void*\

**libewf\_notify\_set\_verbose**(*int verbose*);

*int*\

**libewf\_notify\_set\_stream**(*FILE \*stream*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_notify\_stream\_open**(*const char \*filename*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_notify\_stream\_close**(*libewf\_error\_t \*\*error*);

Error functions

*void*\

**libewf\_error\_free**(*libewf\_error\_t \*\*error*);

*int*\

**libewf\_error\_fprint**(*libewf\_error\_t \*error*, *FILE \*stream*);

*int*\

**libewf\_error\_sprint**(*libewf\_error\_t \*error*, *char \*string*, *size\_t size*);

*int*\

**libewf\_error\_backtrace\_fprint**(*libewf\_error\_t \*error*, *FILE \*stream*);

*int*\

**libewf\_error\_backtrace\_sprint**(*libewf\_error\_t \*error*, *char \*string*, *size\_t size*);

Handle functions

*int*\

**libewf\_handle\_initialize**(*libewf\_handle\_t \*\*handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_free**(*libewf\_handle\_t \*\*handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_signal\_abort**(*libewf\_handle\_t \*handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_clone**(*libewf\_handle\_t \*\*destination\_handle*, *libewf\_handle\_t \*source\_handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_open**(*libewf\_handle\_t \*handle*, *char \* const filenames\[\]*, *int number\_of\_filenames*, *int access\_flags*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_close**(*libewf\_handle\_t \*handle*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_prepare\_read\_chunk**(*libewf\_handle\_t \*handle*, *void \*chunk\_buffer*, *size\_t chunk\_buffer\_size*, *void \*uncompressed\_chunk\_buffer*, *size\_t \*uncompressed\_chunk\_buffer\_size*, *int8\_t is\_compressed*, *uint32\_t chunk\_checksum*, *int8\_t chunk\_io\_flags*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_read\_chunk**(*libewf\_handle\_t \*handle*, *void \*chunk\_buffer*, *size\_t chunk\_buffer\_size*, *int8\_t \*is\_compressed*, *void \*checksum\_buffer*, *uint32\_t \*chunk\_checksum*, *int8\_t \*chunk\_io\_flags*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_read\_buffer**(*libewf\_handle\_t \*handle*, *void \*buffer*, *size\_t buffer\_size*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_read\_random**(*libewf\_handle\_t \*handle*, *void \*buffer*, *size\_t buffer\_size*, *off64\_t offset*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_prepare\_write\_chunk**(*libewf\_handle\_t \*handle*, *void \*chunk\_buffer*, *size\_t chunk\_buffer\_size*, *void \*compressed\_chunk\_buffer*, *size\_t \*compressed\_chunk\_buffer\_size*, *int8\_t \*is\_compressed*, *uint32\_t \*chunk\_checksum*, *int8\_t \*chunk\_io\_flags*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_write\_chunk**(*libewf\_handle\_t \*handle*, *void \*chunk\_buffer*, *size\_t chunk\_buffer\_size*, *size\_t data\_size*, *int8\_t is\_compressed*, *const void \*checksum\_buffer*, *uint32\_t chunk\_checksum*, *int8\_t chunk\_io\_flags*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_write\_buffer**(*libewf\_handle\_t \*handle*, *const void \*buffer*, *size\_t buffer\_size*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_write\_random**(*libewf\_handle\_t \*handle*, *const void \*buffer*, *size\_t buffer\_size*, *off64\_t offset*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_handle\_write\_finalize**(*libewf\_handle\_t \*handle*, *libewf\_error\_t \*\*error*);

*off64\_t*\

**libewf\_handle\_seek\_offset**(*libewf\_handle\_t \*handle*, *off64\_t offset*, *int whence*, *libewf\_error\_t \*\*error*);

*off64\_t*\

**libewf\_handle\_get\_offset**(*libewf\_handle\_t \*handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_maximum\_number\_of\_open\_handles**(*libewf\_handle\_t \*handle*, *int maximum\_number\_of\_open\_handles*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_segment\_filename\_size**(*libewf\_handle\_t \*handle*, *size\_t \*filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_segment\_filename**(*libewf\_handle\_t \*handle*, *char \*filename*, *size\_t filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_segment\_filename**(*libewf\_handle\_t \*handle*, *const char \*filename*, *size\_t filename\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_maximum\_segment\_size**(*libewf\_handle\_t \*handle*, *size64\_t \*maximum\_segment\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_maximum\_segment\_size**(*libewf\_handle\_t \*handle*, *size64\_t maximum\_segment\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_delta\_segment\_filename\_size**(*libewf\_handle\_t \*handle*, *size\_t \*filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_delta\_segment\_filename**(*libewf\_handle\_t \*handle*, *char \*filename*, *size\_t filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_delta\_segment\_filename**(*libewf\_handle\_t \*handle*, *const char \*filename*, *size\_t filename\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_maximum\_delta\_segment\_size**(*libewf\_handle\_t \*handle*, *size64\_t \*maximum\_delta\_segment\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_maximum\_delta\_segment\_size**(*libewf\_handle\_t \*handle*, *size64\_t maximum\_delta\_segment\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_segment\_files\_corrupted**(*libewf\_handle\_t \*handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_segment\_files\_encrypted**(*libewf\_handle\_t \*handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_filename\_size**(*libewf\_handle\_t \*handle*, *size\_t \*filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_filename**(*libewf\_handle\_t \*handle*, *char \*filename*, *size\_t filename\_size*, *libewf\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libewf\_handle\_open\_wide**(*libewf\_handle\_t \*handle*, *wchar\_t \* const filenames\[\]*, *int number\_of\_filenames*, *int access\_flags*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_segment\_filename\_size\_wide**(*libewf\_handle\_t \*handle*, *size\_t \*filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_segment\_filename\_wide**(*libewf\_handle\_t \*handle*, *wchar\_t \*filename*, *size\_t filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_segment\_filename\_wide**(*libewf\_handle\_t \*handle*, *const wchar\_t \*filename*, *size\_t filename\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_delta\_segment\_filename\_size\_wide**(*libewf\_handle\_t \*handle*, *size\_t \*filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_delta\_segment\_filename\_wide**(*libewf\_handle\_t \*handle*, *wchar\_t \*filename*, *size\_t filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_delta\_segment\_filename\_wide**(*libewf\_handle\_t \*handle*, *const wchar\_t \*filename*, *size\_t filename\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_filename\_size\_wide**(*libewf\_handle\_t \*handle*, *size\_t \*filename\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_filename\_wide**(*libewf\_handle\_t \*handle*, *wchar\_t \*filename*, *size\_t filename\_size*, *libewf\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libewf\_handle\_open\_file\_io\_pool**(*libewf\_handle\_t \*handle*, *libbfio\_pool\_t \*file\_io\_pool*, *int access\_flags*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_file\_io\_handle**(*libewf\_handle\_t \*handle*, *libbfio\_handle\_t \*\*file\_io\_handle*, *libewf\_error\_t \*\*error*);

Meta data functions

*int*\

**libewf\_handle\_get\_sectors\_per\_chunk**(*libewf\_handle\_t \*handle*, *uint32\_t \*sectors\_per\_chunk*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_sectors\_per\_chunk**(*libewf\_handle\_t \*handle*, *uint32\_t sectors\_per\_chunk*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_bytes\_per\_sector**(*libewf\_handle\_t \*handle*, *uint32\_t \*bytes\_per\_sector*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_bytes\_per\_sector**(*libewf\_handle\_t \*handle*, *uint32\_t bytes\_per\_sector*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_number\_of\_sectors**(*libewf\_handle\_t \*handle*, *uint64\_t \*number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_chunk\_size**(*libewf\_handle\_t \*handle*, *size32\_t \*chunk\_size*, *libewf\_error\_t \*\*error*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_error\_granularity**(*libewf\_handle\_t \*handle*, *uint32\_t \*error\_granularity*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_error\_granularity**(*libewf\_handle\_t \*handle*, *uint32\_t error\_granularity*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_compression\_method**(*libewf\_handle\_t \*handle*, *uint16\_t \*compression\_method*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_compression\_method**(*libewf\_handle\_t \*handle*, *uint16\_t compression\_method*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_compression\_values**(*libewf\_handle\_t \*handle*, *int8\_t \*compression\_level*, *uint8\_t \*compression\_flags*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_compression\_values**(*libewf\_handle\_t \*handle*, *int8\_t compression\_level*, *uint8\_t compression\_flags*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_media\_size**(*libewf\_handle\_t \*handle*, *size64\_t \*media\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_media\_size**(*libewf\_handle\_t \*handle*, *size64\_t media\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_media\_type**(*libewf\_handle\_t \*handle*, *uint8\_t \*media\_type*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_media\_type**(*libewf\_handle\_t \*handle*, *uint8\_t media\_type*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_media\_flags**(*libewf\_handle\_t \*handle*, *uint8\_t \*media\_flags*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_media\_flags**(*libewf\_handle\_t \*handle*, *uint8\_t media\_flags*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_format**(*libewf\_handle\_t \*handle*, *uint8\_t\* format*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_format**(*libewf\_handle\_t \*handle*, *uint8\_t format*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_segment\_file\_version**(*libewf\_handle\_t \*handle*, *uint8\_t \*major\_version*, *uint8\_t \*minor\_version*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_segment\_file\_set\_identifier**(*libewf\_handle\_t \*handle*, *uint8\_t \*set\_identifier*, *size\_t size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_segment\_file\_set\_identifier**(*libewf\_handle\_t \*handle*, *uint8\_t \*set\_identifier*, *size\_t size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_md5\_hash**(*libewf\_handle\_t \*handle*, *uint8\_t \*md5\_hash*, *size\_t size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_md5\_hash**(*libewf\_handle\_t \*handle*, *const uint8\_t \*md5\_hash*, *size\_t size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_sha1\_hash**(*libewf\_handle\_t \*handle*, *uint8\_t \*sha1\_hash*, *size\_t size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_sha1\_hash**(*libewf\_handle\_t \*handle*, *const uint8\_t \*sha1\_hash*, *size\_t size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_read\_zero\_chunk\_on\_error**(*libewf\_handle\_t \*handle*, *uint8\_t zero\_on\_error*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_copy\_media\_values**(*libewf\_handle\_t \*destination\_handle*, *libewf\_handle\_t \*source\_handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_number\_of\_acquiry\_errors**(*libewf\_handle\_t \*handle*, *uint32\_t \*number\_of\_errors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_acquiry\_error**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *uint64\_t \*start\_sector*, *uint64\_t \*number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_append\_acquiry\_error**(*libewf\_handle\_t \*handle*, *uint64\_t start\_sector*, *uint64\_t number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_number\_of\_checksum\_errors**(*libewf\_handle\_t \*handle*, *uint32\_t \*number\_of\_errors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_checksum\_error**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *uint64\_t \*start\_sector*, *uint64\_t \*number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_append\_checksum\_error**(*libewf\_handle\_t \*handle*, *uint64\_t start\_sector*, *uint64\_t number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_number\_of\_sessions**(*libewf\_handle\_t \*handle*, *uint32\_t \*number\_of\_sessions*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_session**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *uint64\_t \*start\_sector*, *uint64\_t \*number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_append\_session**(*libewf\_handle\_t \*handle*, *uint64\_t start\_sector*, *uint64\_t number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_number\_of\_tracks**(*libewf\_handle\_t \*handle*, *uint32\_t \*number\_of\_tracks*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_track**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *uint64\_t \*start\_sector*, *uint64\_t \*number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_append\_track**(*libewf\_handle\_t \*handle*, *uint64\_t start\_sector*, *uint64\_t number\_of\_sectors*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_header\_codepage**(*libewf\_handle\_t \*handle*, *int \*codepage*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_header\_codepage**(*libewf\_handle\_t \*handle*, *int codepage*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_header\_values\_data\_format**(*libewf\_handle\_t \*handle*, *int date\_format*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_header\_values\_data\_format**(*libewf\_handle\_t \*handle*, *int date\_format*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_number\_of\_header\_values**(*libewf\_handle\_t \*handle*, *uint32\_t \*number\_of\_values*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_header\_value\_identifier\_size**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *size\_t \*identifier\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_header\_value\_identifier**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *uint8\_t \*identifier*, *size\_t identifier\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_size**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *size\_t \*utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_case\_number**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_description**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_examiner\_name**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_evidence\_number**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_notes**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_acquiry\_date**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_system\_date**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_acquiry\_operating\_system**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_acquiry\_software\_version**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_password**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_header\_value\_compression\_level**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_case\_number**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_description**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_examiner\_name**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_evidence\_number**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_notes**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_acquiry\_date**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_system\_date**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_acquiry\_operating\_system**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_acquiry\_software\_version**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_password**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_compression\_level**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_model**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_header\_value\_serial\_number**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf16\_header\_value\_size**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *size\_t \*utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf16\_header\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf16\_header\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*);

*int*\

**libewf\_handle\_copy\_header\_values**(*libewf\_handle\_t \*destination\_handle*, *libewf\_handle\_t \*source\_handle*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_number\_of\_hash\_values**(*libewf\_handle\_t \*handle*, *uint32\_t \*number\_of\_values*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_hash\_value\_identifier\_size**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *size\_t \*identifier\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_hash\_value\_identifier**(*libewf\_handle\_t \*handle*, *uint32\_t index*, *uint8\_t \*identifier*, *size\_t identifier\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_hash\_value\_size**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *size\_t \*utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_hash\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_hash\_value\_md5**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf8\_hash\_value\_sha1**(*libewf\_handle\_t \*handle*, *uint8\_t \*value*, *size\_t value\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_hash\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_hash\_value\_md5**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf8\_hash\_value\_sha1**(*libewf\_handle\_t \*handle*, *const uint8\_t \*value*, *size\_t value\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf16\_hash\_value\_size**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *size\_t \*utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_utf16\_hash\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_set\_utf16\_hash\_value**(*libewf\_handle\_t \*handle*, *const uint8\_t \*identifier*, *size\_t identifier\_length*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_handle\_get\_root\_file\_entry**(*libewf\_handle\_t \*handle*, *libewf\_file\_entry\_t \*\*root\_file\_entry*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_get\_file\_entry\_by\_utf8\_path**(*libewf\_handle\_t \*handle*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libewf\_file\_entry\_t \*\*file\_entry*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_get\_file\_entry\_by\_utf16\_path**(*libewf\_handle\_t \*handle*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libewf\_file\_entry\_t \*\*file\_entry*, *libewf\_error\_t \*\*error*);

Single file entry functions

*int*\

**libewf\_file\_entry\_free**(*libewf\_file\_entry\_t \*\*file\_entry*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_type**(*libewf\_file\_entry\_t \*file\_entry*, *uint8\_t \*type*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_flags**(*libewf\_file\_entry\_t \*file\_entry*, *uint32\_t \*flags*, *libewf\_error\_t \*\*error*);

**int**();

*libewf\_file\_entry\_get\_media\_data\_offset* *libewf\_file\_entry\_t \*file\_entry* *off64\_t \*media\_data\_offset* *libewf\_error\_t \*\*error*\

**int**();

*libewf\_file\_entry\_get\_media\_data\_size* *libewf\_file\_entry\_t \*file\_entry* *size64\_t \*media\_data\_size* *libewf\_error\_t \*\*error*\

**int**();

*libewf\_file\_entry\_get\_duplicate\_media\_data\_offset* *libewf\_file\_entry\_t \*file\_entry* *off64\_t \*duplicate\_media\_data\_offset* *libewf\_error\_t \*\*error*\

*int*\

**libewf\_file\_entry\_get\_utf8\_name\_size**(*libewf\_file\_entry\_t \*file\_entry*, *size\_t \*utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_utf8\_name**(*libewf\_file\_entry\_t \*file\_entry*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_utf16\_name\_size**(*libewf\_file\_entry\_t \*file\_entry*, *size\_t \*utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_utf16\_name**(*libewf\_file\_entry\_t \*file\_entry*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_size**(*libewf\_file\_entry\_t \*file\_entry*, *size64\_t \*size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_creation\_time**(*libewf\_file\_entry\_t \*file\_entry*, *uint32\_t \*creation\_time*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_modification\_time**(*libewf\_file\_entry\_t \*file\_entry*, *uint32\_t \*modification\_time*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_access\_time**(*libewf\_file\_entry\_t \*file\_entry*, *uint32\_t \*access\_time*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_entry\_modification\_time**(*libewf\_file\_entry\_t \*file\_entry*, *uint32\_t \*entry\_modification\_time*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_utf8\_hash\_value\_md5**(*libewf\_file\_entry\_t \*file\_entry*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_utf16\_hash\_value\_md5**(*libewf\_file\_entry\_t \*file\_entry*, *uint8\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_utf8\_hash\_value\_sha1**(*libewf\_file\_entry\_t \*file\_entry*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_utf16\_hash\_value\_sha1**(*libewf\_file\_entry\_t \*file\_entry*, *uint8\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_file\_entry\_read\_buffer**(*libewf\_file\_entry\_t \*file\_entry*, *void \*buffer*, *size\_t buffer\_size*, *libewf\_error\_t \*\*error*);

*ssize\_t*\

**libewf\_file\_entry\_read\_random**(*libewf\_file\_entry\_t \*file\_entry*, *void \*buffer*, *size\_t buffer\_size*, *off64\_t offset*, *libewf\_error\_t \*\*error*);

*off64\_t*\

**libewf\_file\_entry\_seek\_offset**(*libewf\_file\_entry\_t \*file\_entry*, *off64\_t offset*, *int whence*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_offset**(*libewf\_file\_entry\_t \*file\_entry*, *off64\_t \*offset*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_number\_of\_sub\_file\_entries**(*libewf\_file\_entry\_t \*file\_entry*, *int \*number\_of\_sub\_file\_entries*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_sub\_file\_entry**(*libewf\_file\_entry\_t \*file\_entry*, *int sub\_file\_entry\_index*, *libewf\_file\_entry\_t \*\*sub\_file\_entry*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_sub\_file\_entry\_by\_utf8\_name**(*libewf\_file\_entry\_t \*file\_entry*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libewf\_file\_entry\_t \*\*sub\_file\_entry*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_sub\_file\_entry\_by\_utf8\_path**(*libewf\_file\_entry\_t \*file\_entry*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libewf\_file\_entry\_t \*\*sub\_file\_entry*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_sub\_file\_entry\_by\_utf16\_name**(*libewf\_file\_entry\_t \*file\_entry*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libewf\_file\_entry\_t \*\*sub\_file\_entry*, *libewf\_error\_t \*\*error*);

*int*\

**libewf\_file\_entry\_get\_sub\_file\_entry\_by\_utf16\_path**(*libewf\_file\_entry\_t \*file\_entry*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libewf\_file\_entry\_t \*\*sub\_file\_entry*, *libewf\_error\_t \*\*error*);

## DESCRIPTION

The **libewf\_get\_version**() function is used to retrieve the library version.

The **libewf\_get\_flags\_\***() functions are used to get the values of the flags for read and/or write.

The **libewf\_check\_file\_signature**() and **libewf\_check\_file\_signature\_wide**() functions are used to test if the EWF file signature is present within a certain *filename.*

The **libewf\_glob**() and **libewf\_glob\_wide**() functions glob *filenames* using the *filename* and the *format* according to the EWF segment file naming schema. If the *format* is known the filename should contain the base of the filename otherwise the function will try to determine the format based on the extension.

The **libewf\_handle\_signal\_abort**() function signals the handle to aborts it current activity.

The **libewf\_handle\_open**(), **libewf\_handle\_open\_wide**(), **libewf\_handle\_close**(), **libewf\_handle\_read\_buffer**(), **libewf\_handle\_read\_random**(), **libewf\_handle\_write\_buffer**(), **libewf\_handle\_write\_random**(), **libewf\_handle\_seek\_offset**() functions can be used to open, seek in, read from, write to and close a set of EWF files.

The **libewf\_handle\_write\_finalize**() function needs to be called after writing a set of EWF files without knowing the input size upfront, e.g. reading from a pipe. **libewf\_handle\_write\_finalize**() will the necessary correction to the set of EWF files.

The **libewf\_handle\_prepare\_read\_chunk**(), **libewf\_handle\_read\_chunk**() functions can be used to read chunks to a set of EWF files.

The **libewf\_handle\_prepare\_write\_chunk**(), **libewf\_handle\_write\_chunk**() functions can be used to write chunks to a set of EWF files.

The **libewf\_handle\_get\_\***() functions can be used to retrieve information from the *handle.* This information is read from a set of EWF files when **libewf\_handle\_open**() or **libewf\_handle\_open\_wide**() is used.

The **libewf\_handle\_set\_\***() functions can be used to set information in the *handle.* This information is written to a set of EWF files when **libewf\_handle\_write\_buffer**() is used.

The **libewf\_handle\_append\_acquiry\_error**() function can be used to append an acquiry error (a read error during acquiry) to be written into a set of EWF files.

The **libewf\_handle\_append\_checksum\_error**() function can be used to append an Adler-32 checksum error (a validation error in a chunk in a set of EWF files) to be set in the handle.

The **libewf\_handle\_append\_session**() function can be used to append a session to be written into a set of EWF files. Note that the only the start offset is stored in a set of EWF files. Libewf ignores the number of sectors on write and determines the session sizes using the available session and media information on read.

The **libewf\_handle\_copy\_\***() functions copy information from the *source\_handle* to the *destination\_handle.*

The **libewf\_notify\_set\_verbose**(), **libewf\_notify\_set\_stream**() functions can be used to direct the warning, verbose and debug output from the library.

## RETURN VALUES

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values refer to libewf.h

To determine the cause of an error pass a reference to libewf\_error\_t \*error = NULL. libewf will create an error object that must be freed with the libewf\_error\_free function. If the error reference is NULL libewf will not create an error object.

## ENVIRONMENT

None

## FILES

None

## NOTES

libewf supports both UTF-8 and UTF-16 encoded strings except for filenames. Some platforms like WINAPI require wide character support for Unicode filenames. To compile libewf with wide character support use *./configure* *--enable-wide-character-type=yes* or pass the definition *\_UNICODE*\
  or *UNICODE*\
  to the compiler (i.e. in case of Microsoft Visual Studio (MSVS) C++).

To have other code to determine if libewf was compiled with wide character support it defines *LIBEWF\_HAVE\_WIDE\_CHARACTER\_TYPE*\
  in libewf/features.h.

The header in a set of EWF files contains an extended ASCII string using the codepage of the system it was created on. The function *libewf\_handle\_set\_header\_codepage*\
  allows one to set the required codepage for reading and writing. The default codepage is ASCII and replaces all extended characters to the Unicode replacement character (U+fffd) when reading and the ASCII substitute character (0x1a) when writing.

The header2 contains UTF-16 little endian stream and the xheader and xhash contain a UTF-8 stream without or with byte order mark (as of version 20080903).

libewf allows one to be compiled with chained IO support using libbfio. libewf will automatically detect if a compatible version of libbfio is available.

To have other code to determine if libewf was compiled with libbfio support it defines *LIBEWF\_HAVE\_BFIO*\
  in libewf/features.h.

## BUGS

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libewf-legacy/issues

## AUTHOR

These man pages were written by Joachim Metz.

## COPYRIGHT

Copyright 2006-2022, Joachim Metz \<joachim.metz@gmail.com\>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

the libewf.h include file