Accession Number:

ADA550432

Title:

Implementation of Libewfcs

Descriptive Note:

Technical rept. 1 Oct 2010-30 Sep 2011

Corporate Author:

NAVAL POSTGRADUATE SCHOOL MONTEREY CA DEPT OF COMPUTER SCIENCE

Personal Author(s):

Report Date:

2011-09-26

Pagination or Media Count:

22.0

Abstract:

libewfcs is a a C library that can read the Expert Witness Format EWF . E01 for computer forensic information such as disk images. libewfcs provides portability and security that is not available in existing solutions and also provides a means for cross-validation with existing EWF readers. In addition to providing basic EWF reading services, libewfcs permits reading from custom EWF input streams, provides image streaming capability, and internally optimizes performance using caching and aligned reading. This document describes the interfaces and internal operation of libewfcs.

Subject Categories:

  • Information Science

Distribution Statement:

APPROVED FOR PUBLIC RELEASE