|
Roadmap:
* low level and high level api - to allow raw access to sections etc. (for recovery) * xsignature section to sign xhash and/or hash * create iso2ewf tool? * resume write i.e. system failure (check to which part EWF files ok) * lvf support * library/tools enhancements (getoptlong) * internationalisation (gettext) * enhance thread safety - protect writing to internal data structures - protect reading when writing to internal data structures - thread safe functions Further analysis of the EWF format: * password hash * 16 bytes in hash section (EWF-E01) * values in EnCase5 header2 (+/-) * values in ltree strings (EWF-L01 LVF) * values in session section (+/-) To do/think about: * all: add LVF support - ltree section * all: check for race conditions especially on change of data elements * all: allow for multiple language support - what about gettext? * libewf_string: enhance UTF16 conversion code * reduce open file descriptors allows reading a lot of segment files - make sure to detect when a file is closed and when a new segment file needs to be created - use io pooling * implement raw split support in ewfexport and ewfacquire? * add function to retrieve the segment file names and amount? * ewftools: add getoptlong * ewfacquire: restrict error granularity and amount per sectors to > encase5 and > linen5 format ? * ewfacquire: warn if values exceed maximum segment count * ewfacquire: add native Windows support for accessing devices * ewfacquire: read from pipe - what about input size? * ewfacquire: non interactive mode - read settings from file? - no, but perhaps commandline parameters? * ewfacquire: allow for variable read buffer size, this should allow performance testing * ewfacquire: allow for multiple raw files as input - make a generic media access solution also useable for revit? * ewfexport: calculate the md5 hash of exported data and validate this with the stored hash? * ewfexport: log hashes to file -l option * ewfverify: verify against all available hashes that can be verified, print others * windows port: build globbing support - basic support in there * windows port: some of the Windows functions are MVC 2005 specific - figure out a way to warn about the compiler used * windows port: reduce _s function to pre MVC 2005 variants provides for wider support * windows port: linux alternative to wmain? Recovery and analysis: * ewfacquire: detect disk full and ask for new segment file location? - have libewf allow to set the segment file path during write (done) - like alternative segment file path in EnCase however EnCase seems to fully test if the segment file upfront by allocating the necessary disk space * resume write i.e. system failure (check to which part EWF files ok) - requires (some form of) read and write mode - error resistency * all: recovering corrupt EWF files (missing segment file, corrupt sections, etc.) - can the values in data be used to correct a corrupted volume ? * read: correct for errors in the table or table2 section for EWF-E01 * ewfdebug: create a tool to analyse a single segment file * ewfrecover: create a tool recover ewf files * ewfverify: detect and show which files are corrupted Additional (integrity) checks: * check if successive headers match first header ? * read: add check for next and done segment - really the last segment in the file - offset pointing at themselves - correct size Possible performance improvements: * create a offset table per segment file - create it on demand - section list per segment table is done - map offset table start entry from segment table as a pointer or index number ? * build offset table while reading ? - only read first and last segment file for index build - add offsets of other segment files when needed * remove write_buffer copy to chunk_cache read - chunk cache read really required? * tune read and write buffer sizes - read/write block size seems to have little effect for dd on average * reduce alloc, realloc and free (this reduces breaks) use strace to analyze - pass values as parameters or use of handle * optimize empty block test * what allocation causes the break in strace of ewfacquire with compression libewf? zlib? * optimize string functions * remove libewf_get_write_amount_of_chunks from ewfcommon_read_input and use local variable instead - currently used for verbose output Known issues: * error acquiring USB floppy with bad blocks under FreeBSD - no problem with internal floppy drive virtualisation could be part of the problem * output redirection of ewfexport under Windows XP replaces \n with \r\n - No problem under Windows 2000 ? - binary mode of the stdout file descriptor * The library needs to be compiled with /MD under Visual Studio, because stderr is passed from the executables * check chunk size for > 2 GiB table offsets the current assumption is that these chunks only can be uncompressed because the MSB is normally used to mark if the chunk is compressed This actually is a bug in EnCase 6.7.1 the behavior is gone in EnCase 6.8 * MSVS C++ does not allow pre compiler macro in macro defintions Code clean up * remove internal_handle passing from most functions only pass the necessary values * rewrite ewfglob marcros to function macros (including arguments) * what about setting errno for API set and get function i.e. for size too small * have ewftools only use API ? - most of the internal library code has been removed * change ewf_char/string into byte_char/string * merge alloc and realloc blocks Next release(s): * implement low memory usage option - trade off IO versus memory use - for write only offset table is not needed etc. * Try to correct the offset table - add error flag * create libewf_create_handle and libewf_destroy_handle functions? * improve error handling - store error in handle? or additional parameter? - useful to store error/warning string * what about header values parsing with preservation of timestamps? store a timestamp string in the header value and convert them in ewfinfo * retrieve md5 hash in md5 hash value function? * implement io pooling? * make compilation resilient for missing crypto library - remove the cryptographic options if crypto library is missing * refactor character string split to return int * ewfalter - allow to set maximum delta file size default 4 GiB? * change libewf_notify_set_values in libewf_file.c to notify_set_values CLOSED * what about read+write and compression? solved by delta files * change string duplicate function to macro? strndup is not available on all platforms * do not finalize on error no, does not add any additional value if a write error did occur the library should not make any guesses about if this is write or wrong * file: add function/flag to open segments files progressively using only the basename (like write) no the glob function provides for a way to determine segment filenames using the basename * ewfacquire: add entire disk (physical) and partition only (logical) to volume type description no * test if wide character mode is portable between big and little endian platforms due to conversion functions? checks out ok Version: 20080501 * Fixed the package config file (.pc) (Nicolas (kwizart)) * Fixed the debian package files (Guy Voncke)n * Fixed minor issue in the manual (Guy Vonckens) * Fixed make lib (Christophe Grenier) Version: 20080430 * Fixed in configuration for MSVCPP wide character compilation * Fixed small memory leak Version: 20080426 * Minor changes Version: 20080416 * Minor changes Version: 20080412 * Fixed issue (introduced by RW fixes) in libewf_glob * Uncommented dh_makeshlibs in debian/rules Version: 20080405 * Moved basename from segment table entry 0 to segment table * The segment filename can now be overwritten during acquiry this allows alternative segment filename paths * updated manuals * improved ewfalter test scenarios Version: 20080403 * Fixed macosx installation path Version: 20080330 * Fixed multiple bugs in read write mode, delta files were initiallity opened without read access * Worked on ewfalter to handle more complex RW scenarios * Changed libewf_read_chunk_data no longer to copy to buffer if buffer is the chunk cache data * Fixed unnecessary reopen of delta segement file in libewf_segment_table_create_segment_file Version: 20080329 * Fixed wrong license in MacOS-X package Version: 20080323 * Moved functions in libewf_file to libewf_interface and libewf_support * Renamed libewf_internal_handle to libewf_handle Version: 20080322 * implemented endian conversion macros * fixed minor issue in libewf_debug_header_print Version: 20080320 * performance testing * fix for %jd and %zd detection for gcc-2.95 on Debian 3.1 * fix for openssl evp and gcc-2.95 on Debian 3.1 * fixed sha.h detection error in autoconf/make scripts * updated manuals * fix for %jd and %zd detection for OpenBSD because gcc throws a warning if %jd has no parameter but fails to print the parameter * implement usage of LIBEWF_WIDE_CHARACTER_TYPE instead of HAVE_WIDE_CHARACTER_TYPE in header and source files except in common code Version: 20080319 * refactored test write functions * refactored the conversion from offset table to table offsets from section to segment file this reduces multiple unnecessary conversion Version: 20080318 * removed overflow from write - this seems to be a bug in EnCase 6.7.1 behavior is no longer present in EnCase 6.8, read still support overflow this will allow to convert faulty EnCase 6.7.1 EWF files Version: 20080317 * fixed typo in configure.ac * libewf EnCase 6 >2GB segment files not compatible with EnCase 6.8 offset table overflow is no longer written by libewf * added LIBEWF_CD_SUPPORT for testing purposes - no way to detect amount of sessions yet, will default to 1 section with start sector 1 * changed trailing bytes warning into verbose print Version: 20080315 * corrected dist clean in Makefile.am * corrections for MSVCPP project * fixed binary stdout for WINDOWS version of ewfexport * fixed binary stdin for WINDOWS version of ewfacquirestream Version: 20080314 * Fix for verbose output Version: 20080313 * tested session section R/W functionality * made package ready for stable test Version: 20080312 * Code clean up * ewftools implicitly link libcommon * fixed memory leak in header values for export to ewf Version: 20080309 * Code clean up * fixed ewfcommon_determine_operating_system * fixed overflow on compression read error, buffer is no longer passed for compressed chunks * fixed raw access parameter mix up Version: 20080308 * Code clean up * worked on seperating common code * fixed issue with byte size string and more than 1 digit after the seperator will now handle 2 digits and skip remaining * fixed issue with minimum segement file size in ewf tools also lowered values to 1.0 MiB * implemented determining session size * fixed MSVCPP project * fiexde signal handling for Windows Version: 20080306 * Code clean up * worked on seperating common code Version: 20080305 * Code clean up * worked on signal handling * fixed issues with date string in header * fixes for missing printf "%jd" and "%zd" under Cygwin and WIN32 * worked on seperating common code Version: 20080304 * Code clean up * worked on signal handling * fixed error due to fclose( NULL ) in ewftools Version: 20080303 * Code clean up * added byte size string to ewfinfo * updated manuals of ewfinfo * worked on signal handling Version: 20080302 * Code clean up * worked on session support * ewfinfo will now output session information if present part of media information * worked on byte size string * added byte size string to ewfacquire, ewfacquirestream and ewfexport segment file size, not to acquiry size due to possible rounding errors * updated manuals of ewfacquire, ewfacquirestream and ewfexport Version: 20080301 * Code clean up * Refactored hash and header value functions * fixed writing incorrect linen6 header Version: 20080229 * Code clean up * safe guarded libewf set functions for read/write * made header parse more fault tollerant * rewrote UTF16 conversion routine also handle wide character strings solves issues with mbsrtowcs (handling characters like back space) Version: 20080228 * Worked on not finalizing on error * Refactored libewf_header_values_parse_header and libewf_header_values_parse_header2 * Removed dirty value from offset table entry, reduces memory usage * worked on export to EWF * worked on handling not empty chunk cache in write existing data data in chunck cache is ignored for now, write existing is not called without a read handle * fixed logical error in write existing data Version: 20080227 * refactored ewfdigest_hash * changed LIBEWF_VERSION into LIBEWF_VERSION_STRING and added numeric LIBEWF_VERSION * added LIBEWF_WIDE_CHARACTER_TYPE definition * Worked on not finalizing on error * Code clean up Version: 20080225 * Worked on not finalizing on error Version: 20080224 * Added error output to the log * refactored ewfinfo Version: 20080223 * worked on logging of digest hashes to log file * refactored ewfacquire, ewfacquirestream, ewfexport, ewfverify * updated manuals * moved libewf_internal_handle_determine_format to header_sections Version: 20080221 * fixed logical error in libewf_write_test_chunks_section_full changed section_amount_of_chunks > maximum_section_amount_of_chunks to >= solves >16375 chunks offset table issue Version: 20080220 * Worked on refactoring chunk dirty to segment file type Version: 20080219 * removed corruption detection test in libewf_segment_file_write_chunks_data no longer needed * code cleanup * refactored use internal handle in libewf_write Version: 20080217 * added corruption detection test in libewf_segment_file_write_chunks_data needed for test Version: 20080214 * worked on abort * worked on low memory usage * code cleanup * removed libewf_filename_get and libewf_filename_set Version: 20080212 * fixed ewfverify the EWF file can be verified without the integrity hash as pointed out by David Loveall * fixed incorrect default segment file size in ewfacquirestream as pointed out by Dennis Schreiber * fixed missing ewfinfo -e option Version: 20080202 * code cleanup Version: 20080129 * small adjustment in libewf_get_format function Version: 20080127 * corrected comment in libewf.h.in Version: 20080126 * code clean up * implemented libewf_glob function * worked on signal abort function * fixed incorrect return value in raw read Version: 20080119 * worked on basic multi threaded safety Version: 20080115 * worked on refactoring write initialize * added initialize function for format specific write values * added initialize function for media values specific write values Version: 20080114 * removed initialize write in libewf_raw_write_prepare_buffer messes up multi threaded compression aproach * removed write initialize from libewf_get_chunk_size chunk_size is calculated on set of sectors_per_chunk and bytes_per_sector * removed libewf_internal_handle_read_initialize * worked on refactoring write initialize Version: 20080112 * removed errno from library * fixed error regarding hours in ewfoutput_timestamp_fprint Version: 20080107 * added more verbose output for raw write * added check for read sub handle in libewf_write_buffer and libewf_raw_write_buffer Version: 20080106 * worked on removing type definition Version: 20080105 * Used memwatch to analyze allocation issues * Fixed memory leakage due to insufficient error clean up in libewf_segment_table_read_open * ewfacquire user input now defaults on error instead of bailing out Version: 20080103 * Used memwatch to analyze allocation issues * Fixed memory leakage in values list and in internal handle with sector table * Fixed missing libewf_common_alloc in ewfalter * Added NULL pointer free protection against non NULL protected libewf_common_free replacements Version: 20080102 * Updated package config file Version: 20071230 * adjustments to summary message to configure.ac * worked on MacOS-X package Version: 20071229 * added summary message to configure.ac * small changed to debian package files and Makefile.am Version: 20071228 * removed libewf_error_sector_table.h * type definition consistency changes in read input function in ewftools * updated year in copyright * changed LIBEWF_SECTOR_TABLE to libewf_sector_table_t * changed LIBEWF_CHAR and EWF_CHAR into libewf_char_t and ewf_char_t * changed EWF_SESSION and EWF_SESSION_ENTRY to ewf_session_t and ewf_session_entry_t Version: 20071227 * moved hash string length from libewf definitions to ewfstring Version: 20071222 * changed CDROM media type into CD media type Version: 20071209 * minor changes to debian package files * fixes for the MS Visual C++ build * added ewfalter to MSVCpp build Version: 20071208 * pkgconfig added to spec file Version: 20071205 * minor change in defaults Version: 20071201 * worked on refactoring code * API changes to get and set functions Version: 20071130 * worked on refactoring code Version: 20071129 * worked on refactoring code * fixed error in delta chunk size Version: 20071128 * worked on refactoring code Version: 20071126 * minor changes Version: 20071124 * worked on refactoring code * made buffer passthrough default behavior * ewfexport added sha1 calculation support * fixed error writing segment files > 2 Gib * reduced multiple successive crc error entries to a single * reduced multiple successive acquiry error (error2) entries to a single * ewfcommon_export_ewf added raw access write support * change string to (u)int64 conversion routines to use long long equivalents * ewfacquirestream and ewfexport added > 2 GiB segment file support * libewf_filename_create now takes string and length as parameters * ewfalter added functionality to set delta segment file path/basename Version: 20071123 * worked on refactoring code * moved libewf_offset_table_compare after the full index build in libewf_segment_file_read_open * added chunk size to delta chunk for redundancy * removed internal handle from most functions in section * ewfexport added argument set detection for interactive mode * section read count is returned instead of section size when possible * fixed win32 support solution file and ewfglob * added section type length to section list entry * added length filename in segment file struct * fixed error in error2 section regarding debug * worked on session section * added CD-ROM media type Version: 20071121 * worked on refactoring code * libewf no longer allows to raw read/write a chunk of 0 bytes Version: 20071120 * worked on refactoring code Version: 20071119 * worked on refactoring to use segment file struct in section * changed stored delta segment number to 1 ... x count instead of 0 ... x count Version: 20071118 * refactored segment table to a table of segment file ** * refactored offset table chunk offset segment_number and file_descriptor to reference of segment file * worked on refactoring to use segment file struct in section Version: 20071117 * changed MB to MiB, etc. * worked on refactoring offset table to table of chunk offsets * worked on IO pool * removed common alloc/realloc cleared functions * libewf_segment_file_write_open is now used by libewf_open * removed libewf_offset_table_set_values * implemented libewf_filename to reduce code duplication for wide character type * worked on refactoring the offset table to use the segment file struct Version: 20071114 * worked on refactoring segment files functions Version: 20071113 * worked on refactoring segment table to table of segment files * fixed error in libewf_raw_read_chunk regarding use of the right segment table * worked on refactoring offset table to table of chunnk offsets Version: 20071112 * change default segment file size to 1500 MB (^10) about 1400 MB in (^2), 3x segment files should fit on a DVD * worked on refactoring segment table to table of segment files * removed segment number in table check from libewf_segment_file_read_sections() Version: 20071111 * changed default wipe behavior for ewfacquire(stream) default behavior is that only remainder of the chunk is wiped instead of the entire chunk * Updated manual pages Version: 20071110 * updated MSVSC++ project files * commented out io pool * automated delta file testing * added libewf_convert_date_xheader_value * added ctime date format to ewfinfo which is now default refactored header values dat conversion functions * ewfacquire wipes remainder of chunk on acquiry error if wipe chunk is not set * fixed error in reading error2 section Version: 20071107 * worked on delta file Version: 20071106 * worked on delta file delta chunk header data is now 'protected' by a CRC * ewfacquire(stream) added check if last segment file is closed before telling acquiry was completed, by moving close handle before complete notification Version: 20071105 * refactored raw access support in ewfexport Version: 20071104 * refactored write functions * refactored read functions * worked on raw access support for ewfexport * small fixes in ewfexport * fixed write of duplicate table(s) in finalize, introduced by MD5 move * checked usage of stderr and stdout in ewfexport * worked on raw access support in ewfexport Version: 20071103 * refactored write functions Version: 20071030 * fixed input handling of format in ewfexport wide string support * fixed handling problems with raw read and size returned Version: 20071028 * fixed error in write finalize for ewfacquirestream, due to restrictive check * fixed error for handling wide character delta segment filenames * worked on read wipe chunk on error * fixed miscalculation for CRC error in last chunk in read * added function to API to add CRC errors * fixed wrong function calls in ewfoutput_crc_errors_fprint Version: 20071027 * Worked on cleaning up ewf struct read and write functions * Cleanup of set/get functions in internal handle * Added libewf_get_amount_of_acquiry_errors * Wrote API functions to rid ewfcommon of internal_handle for acquiry and CRC errors, header and hash values * Moved duplicate code for handling header and hash values into libewf_values_table * Removed internal_handle from ewftools * ewftools no longer create human readable byte string if size <= 1024 * changed int8_t return values into int return values * changed libewf_get and libewf_set functions for API consistency * moved several get and set functions from internal handle to file * fixed error in windows retrieving digest hashes Version: 20071016 * Worked on cleaning up ewf struct read and write functions Version: 20071015 * Worked on file io handler * Worked on cleaning up ewf struct read and write functions * change section start to static definition in libewf_section_last_write and libewf_section_start_write Version: 20071009 * Worked on file io handler Version: 20070919 * Worked on implementing raw read in ewftools Version: 20070918 * Worked on implementing raw read in ewftools Version: 20070916 * Fixed bug in libewf_section_hash_read introduced by MD5 calculation removal * Worked on implementing raw read in ewftools - moved the string functions from ewfcommon to ewfstring - moved the user input functions from ewfcommon to ewfinput - moved the user output functions from ewfcommon to ewfoutput - updated MSVCPP project files - seperated read and crc/uncompression functions Version: 20070915 * Worked on deb based package - added distclean make directive * Adjusted rpm based package * fixed for rogue next sections in delta segment file section list during RW * fixed libewf_debug_read_section to handle a size of size64_t - still limited to SSIZE_MAX Version: 20070912 * fixed on error in delta file accouting for multiple rewrites * removed libewf_write_chunk, libewf_internal_handle_read_is_initialized and libewf_internal_handle_write_is_initialized * fixed write finalize after R or RW open * clean up of small to do's Version: 20070910 * worked to allow to set the delta file path * fixed error in delta file header offset handing * worked on error regarding delta file end Version: 20070908 * worked on remove of MD5 calculation from library - implemented MD5 calculation in ewfcommon for ewfacquire and ewfacquirestream - removed libewf_set_media_values, calculated_md5_hash and libewf_raw_update_md5 from API - removed digest context and md5 from library - removed calculated md5 hash and md5 context from internal handle - added macros libewf_get_hash_value_md5 and libewf_get_hash_value_sha1 to API - added macros libewf_set_hash_value_md5 and libewf_set_hash_value_sha1 to API - removed libewf_get_md5_hash from API - removed several libewf_internal_handle_get_ and libewf_internal_handle_set_ functions * worked on write support for > 2 GiB segment file for EnCase 6.7 * added check to libewf_close to enforce libewf_write_finalize * worked on having compound reallocation functions return an integer as result - removed libewf_internal_handle_chunk_cache_realloc * worked on moving byte swap out library into ewftools - removed libewf_set_swap_byte_pairs from API Version: 20070905 * worked on remove of MD5 calculation from library - removed MD5 calculation from read - implemented MD5 calculation in ewfcommon for ewfverify - removed hashed flags in offset table - removed libewf_calculate_md5_hash from API * worked on read support for > 2 GiB segment file for EnCase 6.7 Version: 20070830 * changed use of stdout and stderr in ewfacquirestream, ewfinfo, ewfalter * removed program: error output in ewfacquire, ewfverify * fixed duplicate write of delta chunks Version: 20070829 * worked on read support for > 2 GiB segment file for EnCase 6.7 * worked on write support for > 2 GiB segment file for EnCase 6.7 * worked on session section support * changed use of stdout and stderr in ewfverify * added errno == 0 check in ewftools after libewf open to prevent the following output "Unable to open EWF file(s) with failure: Success." Version: 20070828 * worked on read support for > 2 GiB segment file for EnCase 6.7 * changed off_t to off64_t for Windows > 2 GiB segment file support * worked on write support for > 2 GiB segment file for EnCase 6.7 * changed use of stdout and stderr in ewfacquire Version: 20070827 * removed libewf_common_string_copy and libewf_common_wide_string_copy using memcpy instead * changed some int8_t return values into int return values * worked on changing libewf_get functions for API consistency * removed unused macros from internal handle * replaced libewf_set_media_values by libewf_set_sectors_per_chunk and libewf_set_bytes_per_sector Version: 20070822 * worked on allowing the internal MD5 calculation to be disabled * changed some int8_t return values to int Version: 20070821 * worked on ewfexport exporting ewf formatted data for delta merge * print a more detailed error in ewftools for open errors * fixed amount of bytes to acquire in ewfacquire Version: 20070819 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * change libewf_offset_table_realloc to return integer value because function does not change pointer of offset table itself the same for libewf_fill_offset_table and libewf_offset_table_read * completed reading dirty chunks from delta segment files * fixed spelling error in unsuported => unsupported in ewftools * rewritten #ifdef to #if defined() and #ifndef to #if !defined() * refactored user input handling code from ewftools to ewfcommon * worked on ewfexport exporting ewf formatted data for delta merge ewfexport no longer exports to stdout specify '-t -' to write to stdout only for continuous raw output * added libewf_get_flags_ function for use of libewf in Phyton with ctypes Version: 20070818 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * completed refactoring of PRINT( "libewf and PRINT( "ewf function names * changed warning strings with 2^ values to value exceeds maximum * write optimalisation: - the data section is cached for multiple writes - refactored libewf_get_chunk_size out of ewfcommon_read_input * removed libewf_write_process_chunk_data no longer needed Version: 20070816 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * removed internal handle passing from libewf_section_start_read, libewf_section_start_write * changed section start allocation in libewf_section_start_read from dynamic to static Version: 20070815 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files Version: 20070814 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * made macros of libewf_date_string_set_month, libewf_date_string_set_day_of_month, etc. in header values Version: 20070813 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files Version: 20070812 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * moved gmtime function from libewf_common to ewfcommon * removed error string from libewf_write_finalize * moved strerror functions from libewf_common to ewfcommon * removed chunk cache passthrough Version: 20070811 * removed external char * removed error string from libewf_check_file_signature, libewf_segment_file_read_open, libewf_segment_file_write_open * merged common code in wide and narrow functions * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * removed segment_table_build Version: 20070809 * fixed weird progress indiction, changed localtime into gmtime * fixed error in libewf_close comment regarding return value Version: 20070807 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files Version: 20070806 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files Version: 20070728 * worked on restructuring to improve internal structure Version: 20070725 * worked on restructuring to improve internal structure Version: 20070723 * worked on allowing to read raw buffers as chunks * worked on restructuring to improve internal structure Version: 20070722 * worked on allowing to write raw buffers as chunks Version: 20070721 * worked on allowing to write raw buffers as chunks * removed is_dll function no need * adjusted seek offset function * added libewf_segment_file to give library improved structure Version: 20070718 * worked on allowing to write raw buffers as chunks Version: 20070717 * worked on allowing to write raw buffers as chunks * refactored function names into static char * * ewfacquire stream made physical default instead of logical just like in ewfacquire * fixed configuration error in MSVS C++ libewf_dll project file wrong DLL compilation mode /MT * added fix for off_t being 32 it in MSVS C++ Version: 20070716 * worked on allowing to write raw buffers as chunks * refactored function names into static char * Version: 20070715 * worked on libtool DLL support * worked on allowing to write raw buffers as chunks * fixed reallocation bug in libewf_internal_handle_add_crc_error_chunk * refactored function names into static char * Version: 20070714 * worked on libtool DLL support * worked on allowing to write raw buffers as chunks * refactored function names into static char * Version: 20070713 * worked on libtool DLL support - changed macros in libewf_extern.h into LIBEWF_DLL_EXPORT and _IMPORT without the S * made libcrypto EVP interface default, use MD5 and SHA1 as fallback * refactored function names into static char * Version: 20070710 * refactored function names into static char * * removed type from configure.ac Version: 20070708 * worked on space in directory issue * added DLL support to configure.ac Version: 20070707 * added fix for missing type definition u64 in linux/fs.h on some platforms * worked on issue with progress indicator, removed usage of difftime time_t B - time_t A should equal difftime without conversion to double Version: 20070526 * removed the advertisement clause from the license Version: 20070512 * changed default order of physical and logical in ewfacquire - makes more sense this way * updated manuals * fixed error in example of ewfacquire manual page Version: 20070407 * minor corrections for Win32 port * fixed error in passing error retry value in ewftools * fixed memory corruption in libewf_internal_handle_set_acquiry_error_sector Version: 20070406 * worked on next stable release * added status print to ewfacquirestream * change to print of type in notify Version: 20070317 * worked on next stable release * changed libcrypto back to the MD5_ and SHA1_ interface still allows for EVP and Windows Crypto API Version: 20070304 * minor type adjustments Version: 20070303 * fixed bug regarding growth of segment file beyond maximum size Version: 20070225 * fixed typo in libewf_handle.h * fixed cause of segmentation error in libcrypto Version: 20070218 * added include of libewf_types to libewf_handle.h Version: 20070210 * worked on changing size and offset types Version: 20070208 * worked on changing size and offset types - fixed some errors while testing Version: 20070207 * worked on changing size and offset types Version: 20070206 * worked on changing size and offset types - updated libewf.3 Version: 20070205 * worked on changing size and offset types - fixed issue in section list after adjustments - reduces storage size and fixed issue in fill table Version: 20070204 * worked on changing size and offset types Version: 20070203 * worked on changing size and offset types - changed ewf_string_length, ewf_string_copy and ewf_string_compare into macro's - fixed memory leak in ewf_string_write_compressed * worked on code clean up - rewrote libewf_common_alloc and _realloc to macro's - rewrote libewf_common_read, _lseek, _write and _close to macro's - rewrote ewf_x alloc funtions to macro's - removed ewf_type specific alloc and free macro's - removed ewf_error2_sectors_realloc, was not used and resizing should be handled by libewf_common_realloc - removed ewf_table_offsets_realloc, was not used and resizing should be handled by libewf_common_realloc - removed ewf_string_realloc replaced by libewf_common_realloc - removed ewf_string_wipe replaced by libewf_common_memset - removed libewf_error_sector.c Version: 20070131 * worked on changing size and offset types Version: 20070130 * worked on changing size and offset types - file header now allocated statically - rewrote section type tests functions to macro's Version: 20070129 * worked on changing size and offset types - added sys/types.h to libewf_types.h Version: 20070128 * worked on seperate config header files for library and ewftools to fix installable header issue - removed LIBEWF_CHAR from API, wide functions were added * remove quick refences in header values - breaks compatibility with 0.2.1 version of libmodewf.c - was already broken due to new API design * moved non portable headers back to library path Version: 20070127 * worked on seperate config header files for library and ewftools to fix installable header issue - changed functions containing CHAR_T in library to separate small and wide character functions (for trace-ability) - moved error_string print out of common function - removed open_read and open_write - moved copy from and to char_t functions out of the library into ewfcommon - CHAR_T now removed from library * implemented internal_handle to hide handle representation from outside code - added serveral API functions * renamed handle where used as internal handle to internal_handle Version: 20070125 * worked on seperate config header files for library and ewftools to fix installable header issue Version: 20070120 * now using openssl EVP interface instead of directly accessing MD5 functions * worked on implementation of xhash section - added hash values to handle - added get and set funtions for hash values - updated libewf.3 manual page * created a more generic digest_context and EWF digest hash to support SHA1 - replaces md5 context and hash by digest context and hash * an option was added to allow for SHA1 calculation from ewfacquire and ewfacquirestream - updated manuals * added print of additional hashes to ewfinfo * added verification of SHA1 hash to ewfverify * seperate generic definitions from libewf_config.h Version: 20070118 * worked on reducing the usage of header values quick references in libewf and ewftools * using equal definitions for CHAR_T as for LIBEWF_CHAR * worked on implementation of xhash section * fixed issue EWXF format not setting GUID in data section Version: 20070117 * worked on reducing the usage of header values quick references in libewf and ewftools Version: 20070116 * added new header values functions to libewf.3 manual * added reverse string search function * changed forward string search to macro * corrected error in split string due to new string search * changed string length function to macro * changed string compare function to macro (return type change) * changed string copy function to macro (return type change) - make sure the string is \0 terminated after copy * now using reverse search in parse xheader function for close tag * fixed error regarding the examiner_name parameter for ewfacquirestream Version: 20070115 * adjusted creation of xheader string * added function to add user defined header value * added acquiry_software xheader value to ewfacquire and ewfacquirestream * changes to spec file to include ewfacquirestream * added function to parse xheader * added random GUID to EWFX * ewfinfo will now print extended header values * xheader: give acquiry date human readable timestamp with time zone * ewfinfo change Software used into Software version used Version: 20070114 * worked on redesign of header values * fixed missing data issue in ewfacquirestream for large block sizes in combination with chunk cache passthrough * added manual for ewfacquirestrema and updated manuals * header values now uses a dynamic array - old pointers left in for compatibility at the moment Version: 20070113 * changed free functions for basic types to macro's allows for optimization * made adjustments due to splint warnings - fixed error regarding buffer_size of ewf_crc_calculated being a signed interger while it should be an unsigned one - fixed error regarding parameter validation due to optimalizations in ewf_string_copy - fixed possible integer overflow in ewf_volume_calculate_chunk_size and ewf_volume_smart_calculate_chunk_size - fixed not checking the return value of close in libewf_common_close - adjusted compression level in header values from uint8_t to int8_t (for consistency) * changed API of libewf_close to return a status value - adjusted ewftools accordingly - most functions return -1 on error (for consistency) * removed STREAMED_WRITE sections * updated manuals Version: 20070111 * fixed issue with unrestricting amount of offsets * media flags are written to volume and data section Version: 20070110 * changed libewf_set_write_media_type to set volume type * added option to set volume type in ewfacquire and ewfacquirestream * fixed error in new header types, two value lines do not contain additional tabs Version: 20070109 * added information about unknown_md and _sn * added libewf_header_value for more generic approach to handling header values * the volume media type in EnCase uses 0x00 for a floppy image and 0x01 for a hard disk image * adjusted library for fixed/removable media type * added error granularity to read and write * added function to set and get error granularity * adjusted ewfinfo and ewfacquire to handle error granularity - not needed in ewfacquirestream cannot compensate errors in streams Version: 20070108 * Fixed error in EWFX format header section should be xheader section * Removed setting value of unknown3 in data section Version: 20070107 * worked on linen6 support * added EnCase6 and linen6 to automated test * added get_version function * fixed errors for handing a write of less data than chunk size * fixed error in EnCase6/linen6 header string creation * added 8192, 16384 or 32768 sectors per block size options * removed signature from hash section * fixed error in strerror for strerror fallback missing return statement * fixed error in test statement in configure.ac Version: 20070104 * worked on automated acquirestream test * fixed error in ewfcommon_read_input for handing a write of less data than chunk size Version: 20070103 * adjusted copyright notice * worked on EnCase6 support * corrected error in writing original EWF, EnCase1 and SMART format Version: 20061231 * Fix for ctime_r detection not allowing for ctime fallback in configure script * Fix for incorrect handling of user provided strings in ewfacquirestream * Added missing sprintf function check and several precompiler definition changes by Christophe Grenier * configure and code now handles ctime_r 3rd argument under Solaris Version: 20061230 * Fix for precompiler handling for gcc 2.95 in header_values * Moved GUID and operating software determination to ewfcommon * Changed autoconf detection of operating software fallback string * Added some options to ewfacquirestream * Fixed error in configure.ac regarding libuuid check * Added macros for tol and toul, with atol fallback support Version: 20061229 * worked on read and write mode * removed chunk size buffer restriction from ewfcommon_read_chunk renamed it to ewfcommon_read_input * removed chunk cache wipe * several platforms tested Version: 20061228 * added write remaining chunk data for streamed write to libewf_write_finalize * worked on read and write mode - added amount_of_chunks to segment table, contains the amount of chunks of a segment file - removed segment_file_offset in handle write, overlap with file_offset in segment table - fill offset table while writing - removed handle->write->offset and ->amount_of_offsets - removed handle->write->create_segment_file Version: 20061227 * added pkg-config file (still expirimental) * added a check to libewf_close to enforce libewf_write_finalize * moved libewf header files to include/libewf - should fix missing header problem * worked on read and write mode - added seek_offset - added read_buffer - added it to API and libewf man page - added ewfalter (expirimental) - rewrote read_chunk not to do its own offset checking - added write_random Version: 20061226 * worked on read and write mode - added seek_chunk Version: 20061225 * worked on read and write correction regarding new insight into table sections * added macro for sprintf fallback * added configure.ac check for Solaris ctime_r * rewrite of ewf_string to calculate the byte size for all lengths * rewrite of common wrapper functions to macro's (memset, memcpy, memcmp, free) - allow for compiler optimization for functions free, memset, memcpy, memcmp * worked on streamed write - added libewf_write_finalize (still expirimental) - created ewfacquirestream - added type to section_list_entry - have write functions set section_list_entries - basic streamed write mode now working - still needs more testing requiring options set by ewfacquirestream * corrected error in comment libewf_write_buffer in libewf.h Version: 20061223 * test: full read & write on multiple platforms * test: different sized buffers for read and write * check into small segment files for a DVD image - more file handles than allowed will add support for this in the future * added make lib/library for libewf compilation only * removed multiple (same) -l<library> from configure * added check for snprintf (djgpp seems to be missing this function) - will add fallback support to snprintf in the future * corrected file rights on source files * added libewf.spec to source package to allow rpmbuild -ta <libewf> * fixed bug in reading header string 1 byte too little * libewf now warns if file exceeds the maximimum amount of offsets in a table section * worked on read and write correction regarding new insight into table sections * added support for the original EWF format Version: 20061219 * Added have config defaulting to libewf.h required for library include * several adjustments thanks to Christophe Grenier - manual/libewf.3 - libewf.spec.in - fix for 4 GiB support for native Windows compilation _lseek => _lseeki64 Version: 20061218 * added sys/types for Solaris signal.h include Version: 20061217 * worked on testing for stable release * fix for NetBSD using zlib 1.1.4 missing compressBound function * moved factor 2 buffer size enlargement from ewf_string_uncompress into ewf_uncompress this matches behaviour of ewf_compress * added support for missing ctime_r, localtime_r and strerror_r fallback to ctime, localtime, strerror * manually added INT64_MAX definition - for platforms missing LLONG_MAX definition Version: 20061216 * worked on testing for stable release * fixed bug for buffer passthrough exceeding the buffer boundary for compressed chunks * fixed bug for chunk cache passthrough * fixed reallocation of chunk cache for chunk cache passthrough * disabled -Wextra compiler flag for OpenBSD compilation * removed wcsftime and strftime for platform compatibility - now using snprintf based solution * fixed EnCase1 format error - contains only 1 header section * fixed handling of EnCase1 format in strict error mode * automatic generation of SPEC file thanks to Christophe Grenier Version: 20061213 * worked on testing for stable release * fixed bug regarding too small copy of date strings * fixed bug regarding over correcting uncompressed string length Version: 20061212 * Worked on Windows wide character support * adjusted string copy from/to char to char_t * finished first version of manpage libewf.3 Version: 20061211 * fixed typo in ewfacquire man page acquiry -> acquire * removed AC_FUNC_MALLOC and AC_FUN_REALLOC from configure.ac * fixed typo in libewf_includes.h HAVES_ -> HAVE_ * adjusted code for warnings in Windows port * changed segment number to 16 bit value in read and segment table * fixed issue with ewfgetopt * moved utf16 to/from ascii converion functions from ewf_string to libewf_string * added intermediate macros for wide character support under Windows * adjusted static string concats - MVC first executes the macro, after which it tries static string concat - gcc seems to do this in oposite order Version: 20061209 * added stdint.h support to libewf_includes.h * changed $build to $target in configure.ac * added libewf.spec file * libewf version numbers will not contain a release number any more - no additional value other than for development * fixed bug in \r detection in parse_header_string - when string length is 0 * adjusted option order in ewfacquire help function - should be alphabetical * worked on man pages using input provided by Kees Mastwijk * corrected some small output inconsistencies Version: 20061208 * worked on ewfinfo man page using input provided by Kees Mastwijk Version: 20061207 * worked on calculating a GUID for write * added guid get and set functions to libewf * added guid check for data section * added guid write for encase5 and linen5 format * ewfacquire now adds random guid (uuid) for encase5 and time based guid for linen5 - only if libuuid is present * ewfacquire added test for block or character device before determining device size * ewfcommon created generic version function - added library version information * changed version() to ewfcommon_copyright_fprint() * worked on ewfacquire man page using input provided by Kees Mastwijk Version: 20061206 * added hypens to GUID output in ewfinfo * worked on calculating a GUID for write Version: 20061204 * changed configure.in to configure.ac * moved CFLAGS to configure.ac * system dection code is now only used to determine the fallback string for ewfacquire - detection of available functions is now based on header detection * moved library code to ./libewf and code for the ewftools to ./ewftools and libewf.h to ./include * removed LIBEWF_H_USED_IN_PACKAGE * added defines to ewfcommon for different buffer size testing Version: 20061201 * added optimalization definitions - for testing * implemented chunk cache passthrough * added configuration parameters for buffer passthrough and chunk cache passthrough - buffer passthrough does not seem to enhance the performance significantly - chunk cache passthrough does not seem to enhance the performance significantly * ewfacquire: ask or determine media type (fixed and removable) * added EWFX format (expirimental) - (basically EWF-E01 based format) - allows for section xheader, which contains header information in XML and is stored in an compressed string Version: 20061130 * problem with media size calculation due to change - note: uint32_t * uint32_t = uint32_t and will not upscale to uint64_t * ewf_string: better solution for size*16 in ewf_string_uncompress - the length starts out with a factor 2 and keeps increasing by a factor 2 until string can be decompressed * moved process status and summary functions to ewfcommon * added process summary to ewfexport * read: will uncompress chunk directly to chunk sized buffers for non compressed chunks * are both the segment table and section list file descriptor value needed - can this be a single value? - the file descriptor in the section list was used as safe guard only - removed * Only use the chunk cache when the input buffer size does not suffice for reading or writing an entire chunk - the chunk cache actually reduces performance for sequential reads due to additional memcpy - completed * ewfverify: show status indicator * ewfverify: when done show time and Mb/s Version: 20061129 * Media size is calculated when not set * Added -Wextra compile flag for addition warning values * fixed: weird floating point exception after recompilation of working versions in callback functions - this was actualy a division by zero in the callback function * read: added improved support for EnCase linen 5 format - adjusted libewf_header_values for more flexible header creation * write: removed the CRC after the offset table for the SMART format * write: added linen5 support * header values: removed trailing \r from last header value * write: fixed error regarding buffer passthrough * read: will read chunk directly to chunk sized buffers for non compressed chunks Version: 20061128 * worked on performance enhancements * lseek is now only used if section data needs to be skipped - in libewf_sections_read_segment - in libewf_read_chunk - added segment number to offset table and file offset to segment table for basic offset tracking * found issues in documentation - EnCase1 (EWF-E01) format stores its chunks in the table sections not in the sectors section it uses an EWF-S01 alike layout - SMART in FTK Imager has a CRC at the end of the offset table * fixed read and write regarding issues in documentation * read: fixed error in recognizing FTK imager format Version: 20061127 * worked on performance enhancements * changed ewf_crc_calculate to make use of zlib's adler32 function instead of algorithm derived of CRC algorithm by Andrew Rosen - this improves the performance significantly ;-) * changed libewf_endian functions for improved error handling * removed memcpy from chunk cache read to data for non compressed data in libewf_read_random Version: 20061126 * worked on performance enhancements * changed iterator to 32 bit in ewf_crc_calculate saves conversion on a 32-bit platform Version: 20061125 * worked on string and char types * changed ewf_sectors.[ch] into ewf_chunk.[ch] - chunks do not only reside in sectors sections therefore the name change * removed ewf_chunk.c - now uses ewf_string functions, moved necessary functions to libewf_string.[ch] * worked on performance enhancements * reduced CRC (de)allocations Version: 20061124 * worked on performance enhancements * added buffer size option to ewfacquire Version: 20061123 * worked on string and char types * added macros for static char or wchar_t type strings * note: fgets and fgetws cannot be used on the same stream after one and other * string: wide character support (wchar support) - Windows also provides tchar, tchar is a wrapper for both char and wchar_t * change char* to EWF_CHAR* or LIBEWF_CHAR* - allow for char and w_char interfacing with library - use LIBEWF_CHAR for char/w_char wrapping and EWF_CHAR for byte strings in EWF file format, CHAR_T required for wchar_t support in basic functions - make internal EWF related strings byte strings (EWF_CHAR) - make string functions safe to be char or uint8_t - use string.x for string functions * string: added length to libewf_string_search * string: added length to libewf_string_split * ewfacquire: added wchar_t support for utsname_buffer.sysname * ltree: changed ewf_tree_data_read * ewfinfo: added stored MD5 hash * ewfacquire: added print read errors on exit * all: in read and write functions add file_descriptor test - not necessary libewf_common functions do check this Version: 20061122 * worked on string and char types * windows has: wmain for wide character arguments * moved getopt code to ewfgetopt for wmain support * moved glob code to ewfglob * changed libewf_open to match main and getopt type arguments * fixed check enable...=no validation - $withval needed to be $enableval * added CHAR_T and INT_T for wrapping character type of support functions like (w)open Version: 20061121 * worked on string and char types * fixed: missing ewf_char.h, ewf_string.h and libewf_config_windows.h in package * changed COPYING and AUTHORS due to license issue * removed: libewf_common_string_to_uint64 and libewf_common_string_to_int64 * fixed: several compilation errors for wide character type support * added: strchr to ewfcommon for getopt support Version: 20061119 * worked on string and char types * changed %s and %c where necessary to PRIs and PRIc Version: 20061118 * worked on string and char types * string: removed LIBEWF_STRING type definition * string: removed string_copy_from/to_char functions * string: added wrapper PRIc for c, lc and PRIs for s, ls * common: removed strdup - no longer needed - libewf_string_duplicate takes care of this functionality * common: removed strchr - no longer needed - libewf_string_search takes care of this functionality * common: removed strncmp - no longer needed - libewf_string_compare takes care of this functionality * fixed: inconsistency in libewf.h and libewf_file.h * common: removed strlen - no longer needed - libewf_string_length takes care of this functionality Version: 20061115 * worked on string and char types * implement libewf_string_copy_(from/to)_header functions * changed utf16/ascii convert to copy functions * libewf_string: allow to set multibyte strings from header values - still need to test this Version: 20061114 * worked on string and char types * implemented non compressed read and write in ewf_string - for ltree tree data * fixed bug in compression buffer reallocation in ewf_string - reallocation pointer was not provided backwards * delay header and header2 conversion to parse function * moved basic ewf_header2 functions to ewf_char - ewf_header2 has become a type wrapper * string: make a more generic ewf_string (use this in ewf_header, ewf_header2, ewf_ltree) also move ASCII and UTF Version: 20061113 * worked on string and char types * ewf_string removed several functions * moved basic ewf_header functions to ewf_char - ewf_header has become a type wrapper Version: 20061112 * worked on string and char types * header_values: rewrite libewf_header_values_set_value to return integer with status code * moved md5hash to string function to libewf_string * moved ewf_section_fprint and ewf_header_fprint to libewf_debug Version: 20061111 * ewfexport: added time estimate * moved byte print function to ewfcommon * added API functions to retrieve header values * string: add string copy * string: add string copy to char/w_char types Version: 20061110 * Fixed strerror_r char * return type on Ubuntu Version: 20061109 * Fixed several logical bugs in write_buffer - incorrect check of chunk cache passthrough - incorrect handling of buffer sizes - incorrect handling of last buffer write * Fixed bug in ewfexport adding 128 bytes - due to print output to stdout * Fixed output write libewf_write_test_segment_file_full * ewfacquire: added time estimate * libewf_common_open: added check for return values _sopen_s Version: 20061029 * Worked on clean up of includes in libewf.h * Created API functions to get and set the header values - this moves the header values dependency out of the ewftools * Moved verbose into library, also added notify stream - windows port: allow error output stream redirection (libewf_notify) requires Visual C/C++ /MD compilation flag * Fixed a memory leak in ewf_header_read - the compressed header was not freed * Added alternative compile time method for platform determination when uname() is missing * Fixed error in handling if AES crypt provider is not available * Moved the error handling values out of the library - no longer contains read chunk function * Added basic globbing code for windows port - should suffice * Fixed memory leak of last section in libewf_read_build_index * Fixed memory leak in ewfacquire bytes_string was never freed Version: 20061028 * Merged the libewf win32 port by George Garner with current working verion - signal handling and memory debug was added to ewfsignal - added libewf.c for MainDLL function Version: 20061026 * moved header_values_fprint to ewfcommon * created libewf_parse_header_values * moved from_ and to_file_descriptor functions out of the library and into ewfcommon * rewrite of from_ and to_file_descriptor functions in ewfcommon and related library functions * moved swap byte pair functions back into library * fixed header value creation is date strings are missing * added function to set media type in handle Version: 20061025 * made one type (error sector) for crc and acquiry read error sectors * Worked on Win32 native port - fix for file open - not using the right parameters for Windows - fix for crypto API calls for md5 context - rewrote some API functions to pass buffers from the application to the library so allocation and de-allocation is handled within the same program space Version: 20061024 * minor alterations for BSD licensed getopt * added a libewf version of getopt to ewfcommon - it is basically a rewrite of the version by The Regents of the University of California - it should suffice for platforms without getopt * prefixed functions in ewfcommon with ewfcommon - this distinguishes them from the libewf functions * created acquiry_error to move error2 and endian conversion in ewfcommon into library * fixed missing read error retry reset after sector skip * fixed 1024 kb human readable size will now become 1.0 Mb * default amount of read error retries is now 2 (will result in 3 read attempts) * fixed error regarding read error retry one off Version: 20061023 * Reduced input_file_size and input_write_size to 1 parameter: input_write_size * Renamed ewf_file_size to segment_file_size * Looked at generic character/string wrapper - for wide char support Version: 20061022 * Fixed media type mismatch in data section in EWF file from ewfacquire for EWF-E01 format * Fixed empty section start size in EnCase (EWF-E01) format for read and write - FTK Imager * Fixed error in read with byte swap, the MD5 hash must be calculated over the non swapped data * Clean up in libewf.h * Worked on Win32 native port - added LIBEWF_EXTERN macro for DLL import/export - changed ctime to libewf_common function using the thread safe variant * Added libewf_set_write_input_size function * libewf and tools are now compilable natively on Windows Version: 20061021 * Worked on Win32 native port - changed libewf_common_strncmp return to signed as it should be - changed strerror to libewf_common function using the thread safe variant - changed localtime to libewf_common function using the thread safe variant - requires some type casts from unsigned to signed - the libewf_common read and write function do the check if the size value exceeds INT32_MAX - rewrote ewf_md5hash_to_string() not to use snprintf - rewrote libewf_md5 to wrap multiple implementations is now libewf_md5_context - added Windows Crypto API support to libewf_md5_context * Reduced maximum amount in offset table to 32-bit value * Reduced segment values to a 16-bit value * Changed libewf_notify to use autoconf/make header check Version: 20061020 * Worked on rewriting libewf_write - when header values are empty a default is created - better fill EWF-S01 segment file - recalculate the chunks per segment after the table section is written Version: 20061019 * Block is only required to be wiped when offset is 0 * Worked on rewriting libewf_write - moved header values set and create to libewf_handle - removed set_parameter function * Fixed mismatch in segment size and chunks section size calculation for the EWF-S01 format * Fixed invalid amount of chunks per segment for 2 GiB segment file for the EWF-S01 and EWF-E01 format * Added maximum input size check * Added a generic set function for enabling byte swap * Completed redesign write and parameter functions to fallback to a default Version: 20061018 * fixed error catching negative remaining segment size * worked on: redesign write and parameter functions to fallback to a default * Worked on rewriting libewf_write Version: 20061017 * fixed error handling multiple segment files - the write_buffer loop now leaves the segment file in a state of an open chunks section * changed space left function into test full functions * implemented compressBound() for determing the required size a too small compression buffer * allow for a variable buffer size in write_buffer by using a chunk cache size and offset * ewf_header_compress: is there a better way to determine the size of the compressed buffer - compressBound fixes this * done: redesign handle, refactor certain aspects to sub structs like chunk_cache * worked on: redesign write and parameter functions to fallback to a default * Worked on rewriting libewf_write Version: 20061016 * at last done rewritting libewf_write_from_file_descriptor to use new function libewf_write_buffer * changed handle->write->chunks_per_segment and handle->write->maximum_chunks_per_segment * progressive method of amount of chunks per section/segment is required for EWF-E01 fill method * calculative method of amount of chunks per section/segment is required for EWF-S01 pre-write offset table size determination * Worked on rewriting libewf_write Version: 20061015 * corrected typo in src/Makefile.am * fixed libewf.h to be used from within the libewf package and outside * fixed maximum ewf file size in ewfacquire was 1 byte too large - due to new restriction in libewf * Worked on rewriting libewf_write * fixed remainder > 9 issue - using a naive solution but adequate Version: 20061014 * ewfinfo: move error2 list print code into library - to ewfcommon * ewfverify: move crc list print code into library - to ewfcommon * write: fixed incorrect implementation of EnCase1 header * ewfinfo: move format detection code into library - basic file format detection is now in library a small part still in ewfinfo, this because EnCase2 and EnCase3 format look a lot each other * added function to create original header format * rewritten function to create headers to 3 more generic functions - for header2 not needed yet * Worked on rewriting libewf_handle * Worked on rewriting libewf_write * Added API get function for certain information * Renamed sector_count => amount_of_sectors * Renamed chunk_count => amount_of_chunks * Renamed error_count => amount_of_errors * fixed textual error in ewf_sectors_chunk_compress Version: 20061012 * moved EWF definitions to ewf_definitions.h * moved PRIx fixes to libewf_includes.h Version: 20061011 * ewfinfo: add date format in ewfinfo to month in text - no interpretation differences possible ISO8601 date string support added - based on patches/adjustments by Rob Meijer * Rewritten part of header_values for new date format * Added date format support to ewfinfo * fixed a space in configure output * Worked on rewriting libewf_write * Worked on rewriting libewf_handle - introduced new read and write specific subhandles * removed compression_used from handle - no longer needed * added error_granularity_bytes to write subhandle Version: 20061010 * Worked on rewriting includes to use libewf_includes.h * Removed __attribute__((packed)) from structs for Win32 port - they do not seem neccessary anymore * Added the header file installation - based on patches/adjustments by Rob Meijer * read: warn when maximum offsets in table of S01 format is exceeded * Worked on rewriting libewf_write Version: 20061009 * Added libtool support - based on patches/adjustments by Rob Meijer * Changed config.h to src/libewf_config.h * Added libewf_includes.h to wrap libewf_config.h for beter autoconf/automake integration * Worked on rewriting includes to use libewf_includes.h Version: 20061008 * Changed program banner and version information * Version released Version: 20061007 * Fix for missing header definitions for OpenBSD * Fix for missing INTx_MAX definitions for OpenBSD * Fix for compilation warnings for SunOS - moved libewf_common.h to be first include * Bug in reallocating chunk cache - initial reallocation was removed by rewrite * change chunk cache allocated_size to 32 bit value - also chunk size in read function Version: 20061004 * Tested ewfacquire with disk with 0 sector error - success * Bug in MacOS-X reading a floppy with bad block - read with -1 could alter current file offset (determined by lseek) Added lseek check to check and correct for offset drift Version: 20061003 * fixed one-too-many read error retry * fixed bug not correcting bytes_to_read in read error handling - this surfaced on MacOS-X (Linux read behavior is different) * ewfacquire: minor adjustment in output - removed dot Version: 20061002 * fixed error in libewf_section.h - this surfaced on MacOS X Version: 20061001 * disabled lvf support * fixed error in read error handling in write functionality - this surfaced under FreeBSD Version: 20060929 * did some refactoring of write function Version: 20060928 * did some refactoring of write function * ewfacquire: print md5 hash when completed - added removed index build check from libewf_data_md5hash function - this function checks if hash is set ananyway Version: 20060927 * minor adjustment to verbose logging configure options - fixed error with variable names containing '-' * all: human readable size add .0 for single digit values - implemented * fixed bug with missing config.h for sleuthkit integration * fixed some formatting issues * did some refactoring of write function * defaulted handle values to unknowns * added function to determine header length instead of strlen - this is more appropiate Version: 20060926 * minor adjustment to verbose logging configure options * added program version to output * did some refactoring of write function - added more checks for write_count returns * write: warn before hand if segment file amount exceeds limit - implemented * all: human readable size add .[1-9] for single digit values - implemented Version: 20060922 * worked on ltree * fixed error in verbose output CRC value libewf_read_random - checked if bug resides in other CRC output - could not find any * changed values in volume definition Version: 20060916 * worked on code clean up and improved error handling * ewf_verify now generates CRC error list for sectors (also for compressed chunks) * verbose and debug prints are now optional (defaults are off) Version: 20060912 * worked on code clean up and improved error handling * worked on skip beyond media size in write Version: 20060911 * worked on code clean up and improved error handling * changed hardcoded max values to predifined macros Version: 20060910 * worked on code clean up and improved error handling * renamed file_read and file_write to read and write * ewfaquire: add offset and size question * write: add offset and size support in write function * added lseek to common, removed off_t from code * ewfacquire: added nice byte print for status * ewfexport: added nice byte print for status Version: 20060908 * worked on code clean up and improved error handling * worked on ltree implementation * added simple byte order detection to UTF16 to ASCII conversion * added offset and size question to ewfexport * added size and offset to read to and write from file descriptor functions * read: look at libewf_section_volume_read: volume chunk count is 0 - compensating - check removed no longer required due to LVF support Version: 20060906 * worked on code clean up and improved error handling * ewf tooling returns the error status no exit * worked on improving automated test scripts * corrected user input inconsistency in ewfacquire * fixed free bug with zlib_crc and calculated_crc in write * fixed pointer bug with zlib_crc in write Version: 20060905 * worked on code clean up and improved error handling * added large file support to configure.in for converting raw images > 4 GiB to EWF files * ewfacquire added total acquire time and bytes/second Version: 20060904 * worked on code clean up and improved error handling * fixed bug regarding setting chunk size in handle from volume - this got somehow removed due to clean up * ewfacquire: add start and finish time Version: 20060903 * worked on code clean up and improved error handling * moved section reading and writing code to libewf_section * fixed bug in libewf_read_random when offset is too large * wraped basic library calls in preperation of thread safety of library calls * added prefix to functions in libewf_common with common_ * enhanced error handling - no program exit but a nice return * using typedefs instead of defines * due to 20060505 fix, gave all value definitions a default value * removed a large amount of unrequired includes Version: 20060902 * worked on code clean up and improved error handling * libewf_handle_cache_realloc removed from read volume section function * endian functions are prepended with libewf_endian_ * the secondairy offset table in handle for S01 format will no longer be allocated for read * started on error tollerance levels for recovery * moved file descriptor check in last_offset calculation to do one check per section list - section list was altered to be used for a single segment file only - reduces memory requirements Version: 20060831 * worked on code clean up and improved error handling * created seperate structure for chunk cache Version: 20060830 * worked on code clean up and improved error handling * allow to set clean value in libewf_(re)alloc_cleared functions Version: 20060829 * worked on code clean up and improved error handling * worked on libewf_string - moved split code to it Version: 20060828 * worked on code clean up and improved error handling * introduced and fixed new bug - reminder do not free result from localtime() Version: 20060826 * worked on code clean up and improved error handling * fixed realloc calculation bug in file_read * moved definitions from .h files * changed headers in all files Version: 20060824 * worked on code clean up and improved error handling * move crc check from file_read into different EWF read methods? no embedding this check in the segment types makes it more difficult to generate an CRC error list for ewfinfo Version: 20060823 * no need for fatal warnings if code becomes re-entrant after error * added a wrapper of basic library calls * worked on code clean up and improved error handling * renamed notify.* to libewf_notify.* prevents name clashes * ewf_crc function now use a dynamic allocated CRC - this helps with error propagation * added big endian support to ascii to utf16 routine Version: 20060822 * added byte swap (equivalent of dd conv=swab) functionality in both read and write * changed sys/types.h to inttypes.h all: check if sys/types definitions still needed in ewf_*.h files ? - not under linux will do a cross platform test anyway * started with implementing improved error handling and re-entry after error, combined with code clean up, better error control, revision of header to allow for one place to maintain acknowledgements Version: 20060821 * read: added basic support for L01 files, which are basically EWF files * renamed ewf_file_signature to evf_file_signature - closer to the truth * ewfacquire: compensate for maximum S01 file size in ewf file size question - determine maximum - not relevant because there is a maximum of chunks within the file but the other data could grow to the 2 GiB Version: 20060820 * ewfacquire: small change to confirmation Version: 20060819 * lifted the 255 segment file limit on write, however it uses an (horrible) increment based naming scheme much like EnCase write: allow more than 255 segment files - completed * write: worked on SMART (EWF-S01) support * write: SMART (EWF-S01) - build in support for table2 * all: add SMART support - complete * worked on - all: due to 20060505 fix give all value definitions a default value - looks nicer * due to changes to the read and write logic the library was retested * read: error in percentage in libewf_read_random - works on FC5 * table size limitation does not seem present in EWF-E01 only in EWF-S01 * use autoconf/automake cross compilation parameters for platform determination - completed Version: 20060818 * read: worked on SMART (EWF-S01) support * alternative read method was removed, the assumption it was based on is no longer valid read: remove alternative read method the assumption behind is fails for the SMART format - completed * renamed alternative write method to wipe block on read error write: rename the alternative write method to wipe_block_on_error (or something) - completed * read random: chunk based size check now is a buffer based size check * removed handle->chunk_crc no longer needed * for the EWF-S01 format the entries in table2 are appended to the offset table - have yet to test a file with a table2 section * write: worked on SMART (EWF-S01) support Version: 20060817 * read: worked on SMART (EWF-S01) support Version: 20060816 * ewfacquire: add overview to confirm user input, otherwise restart input query - completed * ewfacquire: make encase5 file option default - completed * fixed incorrect order for values in header2 on write - also in documentation Version: 20060812 * made the amount of read error retries flexible and user adjustable through ewfacquire * correction of "int result" in file_write to be C89 code compliant * new file size algorithm to fill up closer to max file size when compressing write: change algorithm to fill files upto file size - completed * added empty block compression write: always compress empty chunks - completed as an option Version: 20060809 * fixed size bug for large images on Cygwin - fix of 20060610 not sufficient for Cygwin * fixed invalid value in printf volume read verbose messages * added autoconf/automake structure Version: 20060708 * renamed endian.h to libewf_endian.h for compatibility issues Version: 20060617 * put conditions around debug code in eqfacquire Version: 20060611 * fixed - one off bug in header value end of string Version: 20060610 * ewfacquire test on multiple platforms * added support for SMART format volume section - equals the original EWF volume section definition * fixed - type casting error in data size * fixed - missing header for encase1 format in write * fixed - bug in writing encase4 and encase5 header2 in write - error in ascii to utf16 routine * fixed - bug in writing encase4 and enacse5 header in write - logical formatting error * write: timestamp is now generated only once * write: fixed incorrect free in header values * write: fixed memory corruption bug in ewfacquire - required explicit zero of string Version: 20060605 * fix of data corruption bug - one off * ewfacquire: sanitize input provided by user * ewfinfo/eqwfacquire ? 1970 date when no case data is provided - bug in split function regarding first empty value * removed file cache - no longer required Version: 20060527 * started analysis of a data corruption bug Version: 20060526 * fixed write bug when read is successful after error with small error granualirity * fixed write bug with error granularity 1 * ewfacquire: add chunk size input possibility * ewfacquire: add error granularity size input possibility * ewfacquire: memory corruption bug in user input - repaced some code - looks OK now - but hard to reproduce * fixed write bug with block size 128 error granularity 16 in test * write: improve reading of bad sectors and writing a error2 section to file for encase5 file option Version: 20060520 * fixed media size bug - old method of calculation was still in there :-( * worked on ewfacquire read on error * added alternative write method to test acquired images against existing tooling * ewfaquire: able to produce exact media data as linen * write: what if read error is in last chunk and it is smaller than chunk size !? Version: 20060517 * removed duplicate include from notify.c Version: 20060516 * added media size to ewfinfo * worked on ewfacquire read on error Version: 20060513 * minor adjustment in libewf.h - ewf_close renamed to libewf_close Version: 20060505 * Fix for older compilers like gcc 2.95 - rewrite to older C statements Version: 20060424 * added warning macro to allow overriding some fatal errors * allow overriding invalid CRC's * refactored crc check in ewf_section to file_read - for scope of handle and uniformity within the code * further analysis of unknown values in hash section - also found difference in signature value Encase4 and Encase5 Version: 20060423 * Fix for Solaris in definitions.h Version: 20060422 * Fixed missing PRI definitions on OpenBSD - now defines in definitions.h * changed sprintf to snprintf * added device size determination for OpenBSD * fixed bug in header values parsing for empty first value empty * added compression level definition * ewfinfo: add compression media information in ewfinfo - Encase5 format only * write: moved compression type functionality from ewfacquire into library Version: 20060419 * Adjusted write method - to fix filesize problem * Correction of verbose print of last chunk number * the write function works only when a data section is at the start of the file - why ? not a bug in write but in read the first offset in the segment table was filled with 0 instead of 13 which is the size of the file header Version: 20060418 * Tested on FreeBSD 6.0 needed to add include header in ewf_sectors.h * Adjusted Make to be more generic and to work on FreeBSD 6.0 Version: 20060415 * changed u_int to uint * removed LIBEWF_ types * zlib uses a long which varies per 32 and 64 bit architecture using an intermediate variable fixes not able to read compressed images on a x86_64 architecure * Memory corruption bug in segment table filename fixed Version: 20060414 * Fixed previous offset size * removed memcpy assignments * type fixed malloc assignments * removed (void *) from memset * reduced the amount of int definions * changed printf formaters * added status indication to ewfexport using callback function in read_from_file_descriptor * added quiet option to ewfexport and ewfacquire * removed dependency on libiconv - created a naive utf16 to ascii conversion * moved header string generation code to header_values * added time string generation code to header_values * added acquire options for compression and file type to ewfacquire * code now partially fixed for x86_64 systems fixed malloc statement, printf sizes, and some type definitions * additional changes to memcpy statements made * Use header_values for write * ewfacquire fix error print on correct fixed value * ewfacquire fix for empty input values * ewfacquire fix strange image file rights * ewfacquire fix image filename weird characters - one byte off allocation problem in ewfacquire * ewfacquire allow for a default value - for fixed values * ewfacquire can now acquire devices on works on Mac OS-X/Darwin * fix write crc error in chunk on mac os x * ewfacquire add EWF file size input possibility - check upper bound 2 GiB, lower bound 1440k * fix write bug with small file size 1440k - for floppy image - this has to do if both the filesize and the ewf size are the same - write will adjust with one additional segment file Version: 20060413 * Used LIBEWF_VERSION in executables * Added file signature function to library for integration in The SleuthKit * Added md5.h for allowing to do with different MD5 calculation code bases like the one integrated in the The SleuthKit Version: 20060412 * Created separate file for header value logic - moved code from ewfinfo Version: 20060411 * Nearing release of first version, so started logging relevant changes * Removed memory leak with duplicate header assignment to handle * Renamed ewfmd5sum to ewfverify - still have to enhance functionality * Renamed ewfcat to ewfexport - still have to enhance functionality * Added time parsing functionality to ewfinfo - date format is currently fixed in MM/DD/YYYY * Enhanced password and compression header value output in ewfinfo |