|
Roadmap:
* support missing segment files (chunks) * multiple platform device handle * libbfio API extensions (partial) * low and high level API - to allow low level access to sections etc. (for recovery) * lvf support - add support for interaction with data in ltree section - use libpff like item approach? * xsignature section to sign xhash and/or hash * library/tools enhancements - getoptlong * internationalisation - Unicode support (added) - locale support (partial) - multi language string support (gettext) * enhance thread safety - protect writing to internal data structures - protect reading when writing to internal data structures - thread safe functions - check for race conditions especially on change of data elements Further analysis of the EWF format: * password hash * volume/disk section (EWF-E01) - do EnCase 5 or earlier versions support 64-bit amount of sectors? - unknowns * hash section (EWF-E01) - 16 byte unknown * values in EnCase5/6 header2 (+/-) * values in ltree strings (EWF-L01 LVF) * values in session section (+/-) * amount of sectors in volume/data section has changed to a 64-bit value but what about error2/sessions ? * does newer linen6 has sha1 support? Features * resume write support for ENCASE1/SMART table sections ? * support missing segment files (chunks) * implement low memory usage option - trade off IO versus memory use Recovery and analysis: * imaging: detect disk full and ask for new segment file location? - have libewf allow to set the segment file path during write (done) - like alternative segment file path in EnCase however EnCase seems to fully test if the segment file upfront by allocating the necessary disk space * recovering corrupt EWF files (missing segment file, corrupt sections, etc.) - can the values in data be used to correct a corrupted volume ? Additional (integrity) checks: * read: check if successive headers match first header * read: add check for next and done segment - really the last segment in the file - offset pointing at themselves - correct size Possible performance improvements: * create a offset table per segment file - create it on demand - map offset table start entry from segment table as a pointer or index number ? * fill offset table while reading ? - only read first and last segment file for index build? - add offsets of other segment files when needed * tune read and write buffer sizes - read/write block size seems to have little effect for dd on average - buffered bfio ? * reduce alloc, realloc and free (this reduces breaks) use strace to analyze - pass values as parameters or use of handle - what allocation causes the break in strace of ewfacquire with compression libewf? zlib? * optimize empty block test * optimize string functions - pass length/size as much as possible * pass zero byte empty block compressed data cache as a pointer do not copy data to compressed chunk cache Error handling/tollerance * what about a function that translates error into an equivalent errno? * have wchar error messages for WINAPI? * improve offset table correction - if not correctable skip chunk while reading and mark as crc error or try to determine offset/size of chunk somehow Python bindings * rewrite pyewf to match libewf API - library module functions - handle object - keep file object for legacy support ? * implement error backtrace support in v2 API version * keep certain Python function names as alias * use Unicode strings API changes * add wide character functions definitions by default? * libbfio API extension - add means to set pools open handle limit in libewf (partial completed) - add means to obtain libbfio handle of media data in ewf - add means to set narrow string codepage - export libewf_glob_file_io_handle refactor glob functions to use libbfio handle input and return libbfio pool? think about libewf_glob_file_io_handle and abstration of file io handle get/set name * low level API - add function to retrieve the segment file names and amount? - add function to retrieve EWFX xml header/hash directly * LVF - libewf_add/remove_file for LVF * file structure API extension (idea) device handle * add Windows support for accessing memory device * detect removable disk * detect optical disk * determine optical disk sessions * detect floppy * move fstat to file_io ? * improve error detection and output (refactor error string like libbfio) * detect bus type * determine USB serial number ewftools: * add getoptlong support * log handle - implement libpff log handle * make compilation resilient for missing crypto library - compile on system without libcrypto - remove the cryptographic options if crypto library is missing * have failed on open return a more sensible error (extract from error) * ewfacquire - restrict error granularity and amount per sectors to > encase5 and > linen5 format ? no, although not set in EWF file, the granualarity is still used in handling read errors - warn if values exceed maximum segment count - adjust error granularity if error granularity < process buffer size - move ewfacquire_read_buffer to device_handle, list read errors - warn if media does not fit using chunk size or APIv1 a (32-bit) chunks size of ( 64 * 512 ) will allow up to 128 TiB - for EnCase 6 format request serial number and model if not set ? * ewfacquirestream - what about wipe on error - does this do anything? (remove if not used) - add parameter to set sector size? - allow user to set bytes per sector for raw file conversion * stream handle - implement * ewfalter - allow to set maximum delta file size default 4 GiB? * ewfexport - implement more ewfacquire acquiry parameters? - handle different input and ouput chunk sizes in low level functions build - allow different input and output header codepages? - handle ewf/raw like in smioexport - creates write only raw export file with msvscpp compilation * ewfdebug - create a tool to analyse a single segment file - implement low and high level api separation * ewfrecover - create a tool recover ewf files Windows build * windows port - some of the Windows functions are MVC 2005 or later specific - figure out a way to warn about the compiler used * add WIN32_LEAN_AND_MEAN or VC_EXTRALEAN to msvscpp * locale support - print output convert to system string - reduce string conversions, use as much as possible the system string type in the tools * ewftools check char/wchar in/output Testing * add export unattended to automated tests * add encase 6.12 sha1 support to test Deployment * debian package - implement non local libuna and libbfio support like in spec file * configure - remove enable-v1-api after testing? Known issues: * error acquiring USB floppy with bad blocks under FreeBSD - no problem with internal floppy drive virtualisation could be part of the problem * check chunk size for > 2 GiB table offsets the current assumption is that these chunks only can be uncompressed because the MSB is normally used to mark if the chunk is compressed This actually is a bug in EnCase 6.7.1 the behavior is gone in EnCase 6.8 * MS Visual Studio C++ does not allow pre compiler macro in macro definitions Work in progress: * check sprintf use - liberror -> liberror_error_vsnprintf - libewf -> libewf_hash_values, libewf_header_values - ewftools -> byte_size_string, guid * what about header values parsing with preservation of timestamps? - change localtime to gmtime in libewf_date_time_values_copy_to_string ? - force set header value to require string formatted in the date format ? * check TODO * ewfexport: fix different input and output chunk sizes for low level functions * test: read/write of EnCase 6.12 SHA1 Beta after next stable release * remove DISABLED in ewfexport * move manuals/ewfexport.1.backup to manuals/ewfexport.1 * check into resume write error for 32-bit compile * check make distclean 20100226 * fix for ewfacquire the -g and -b options got swapped 20100126 * worked on solution for Debian 4.0 posix_fadvise break 20100119 * re-applied 20091224 fixes * correction of return value of several ree functions * applied multi header patch 20100110 * fixed ewfacquire manpage * removed use of base offset for linen6 format * worked fix for restriction on large segment file and chunk * made ewfacquire more tollerant for missing device information * added digest section support for linen6 format 20091114 * moved codepage definitions to libewf_codepage.h * updated libbfio * updated MacOS-X package project file * removed ewfalter and ewfdebug from stable 20091109 * fix for borland c compilation * update to MSVSCPP project files 20091108 * fix for MSVSCPP compilation * fixed incorrect return value in libsystem_glob * fix for print of program name 20091031 * fix for local use of libewf 20091030 * changed endian.h into byte_stream.h * updated libuna, libbfio * updated behavior of unmanaged file io handle 20091024 * add falign in device handle, small performance improvement 20091020 * fixed overflow of chunks_section_number in write io handle 20091018 * worked on aligned empty block test * fixed error in help output of ewfacquirestream * fixed error in ewfacquirestream regarding missing strings * worked on cached zero byte emtpy block based on idea by Bas Kloet 20091017 * preperation for stable release * removed All rights reserved because it has no additional legal value what so ever 20091003 * several fixes for Debian integration based on patches by Cristian Greco * corrected license in list and array type and several of the pfftool handles * updated libuna, libbfio * updated several manpages * changes to autoconf/make scripts to not link libcrypto and libuuid to libewf * renamed debian to dpkg * remove ZLIB_WINAPI from msvscpp configuration * several fixes to configure scripts 20091001 * small changes in common * made libewf a little more tollerant in allowing the data section not to contain values, the values must be 0 otherwise libewf still enforces validity checks 20090929 * worked on CodeGear project files - disabled creation of pre compiled headers 20090928 * small changes 20090927 * worked on secondary image output * added open resume signal handling in ewfacquire * worked on CodeGear project files * several minor fixes * updated libbfio for fix of CodeGear _sopen issue which results in files being created using libbfio_file_exists check * ewfacquire now provides default media type based on device information * updated list type 20090926 * worked on initialization issue - set sectors per chunk is now read protected - fixed bug in legacy wrapper set bytes per sector * small fix in verbose output * worked on secondary image output * small cross platform fixes in ewfacquire and ewfacquirestream * moved session handling from imaging handle to ewfacquire 20090911 * updated libsystem 20090905 * updated ewfinput codepage detection with libuna version 20090904 * updated codpage definitions 20090901 * worked on Borland C++ compiler support * updated common/file_stream.h 20090829 * updated msvscpp libbfio project 20090828 * updated libuna, libbfio * the parsing of the header and hash values is now handled by the library the corresponding parse functions were removed from API v2 * all header and hash sections are now parsed for additional values * updated libbfio detection * worked on libbfio API extensions 20090824 * adjustments in ewftools io access 20090823 * minor adjustments 20090822 * updated common: narrow_string, memory * updated libnotify * bug fix in libewf_values_table 20090821 * small adjustments * fixed handling 0 entries in libewf_values_table_initialize 20090820 * worked msvscpp solution files * worked codegear project files * small corrections in include/libewf/types.h.in * fixed libsystem_file_io open mode 20090819 * updated libbfio * updated libsystem_file * moved libuna include from ewftools to libsystem * fixed some small memory leaks in ewftools * moved ewfsignal to libsystem_signal 20090817 * worked on common system library for ewftools * updated msvscpp solution files * updated libewf_date_time * updated include/libewf/codepage.h * updated libbfio 20090816 * worked on common system library for ewftools 20090815 * worked on common system library for ewftools * rewrote ewftools date and time functions * rewrote ewftools error string functions * refactored ewftools to work with libsystem 20090811 * worked on Borland C++ Builder compiler support * updated libbfio, liberror and libuna * added m4 directory support to autoconf/make files for libtool * updated list type * fixed define error in libewf_libuna.h and libewf_libbfio.h * updated libewf_notify * updated ewftools: date_time, file_io, file_stream_io, glob 20090629 * worked on implementing Borland compiler patches * updated msvscpp for libnotify 20090628 * updated libbfio * updated liberror * updated libnotify * fixed Windows 64-bit ssize_t definition issue (pointerd out by Xavier Roche) * worked on implementing Borland compiler patches by Peter Van Hove of IsoBuster - added liberror sprint functions 20090624 * updated libbfio * added allow shared read to device handle CreateFile * fixed double string conversion in device handle for WINAPI build * removed system string trim copy function * added debug output to libewf_sessions * added support for handling empty last session * added libnotify 20090614 * small fix in libewf_glob_free * worked on stable testing 20090609 * added libewf_glob_free to v2 API * disabled chunk size option in ewfexport 20090606 * fixed missing code for correctly handling acquiry and system date header values (Thanks to David Loveall) * started working on improved version of pyewf * fixed error in info_handle * fixed issue regarding date time string must required to be at least 32 bytes should be at least 20 or 25 20090528 * fixed error in marco libewf_get_header_value_case_number (thanks to Guy Voncken) * updated libbfio, implemented support for track changes function * implemented generation of common/types.h by autoconf 20090512 * updated liberror, libuna and libbfio * worked fix for ewfexport for different input and output chunk sizes for low level functions * checked use of uninitialized ->chunk_size ini ewftools handles * fixed error in ewfacquire for write resume with low level functions * fixed error in prepare write chunk for resume write 20090511 * bug fix in ewfacquire error handling code * commented out some unused code * bug fix in libewf handle open regarding base name 20090510 * updated libbfio * added libewf_get_flags_write_resume * fixed small memory leak in verification and export handles 20090509 * worked on support for missing segment files (chunks) * applied patch by aozsyn for compilation errors of API v1 with low level functions and python bindings * corrected pyewf compiler warnings * worked on detecting device removal, write finalize no longer closes segment files if the media size was known and not entirely written * ewfacquire now adds model and serial to header values * ewfacquirestream implemented -B as write size upper boundary * ewfacquirestream implemented -o as skip of an amount of bytes * ewfacquire: added support for acquiry resume offset alignment, for non block boundary offsets * fixed crc buffer alignment error in write * removed get version and flags for local usage of libewf * fixed pyewf API v2 support * fixed small memory leak in ewfinfo 20090506 * fixed unsupported codepage 0 on NetBSD, system string too strict 20090504 * fixed error in device read error handling * added Darwin uuid/uuid.h support * removed check for caseless string compare from configure * added error to file_io updated system string accordingly * added 32-bit amount of sectors for MacOS-X * refactored guid generate from ewfcommon to guid * fixes for winapi * added Cygwin uuid/uuid.h support * changed ewftools dll import for Cygwin * added libewf_is_dll to libewf.c, this function is not exported 20090503 * worked on usb disk support * limited EWF/ENCASE1/SMART format to max 2 TiB acquire size * encase6 format is now default * library and tools pass automated tests * fixed error in device handle seek offset not correctly returning the current offset * fixed error in device read error handling 20090502 * worked on bus type support * worked on optical disk support * worked on usb disk support * worked on Tableau support 20090501 * implemented 64-bit sector support for add crc and acquiry error and sessions in APIv2 * worked on refactoring volume type into media flags in ewftools * added set media flags function to APIv1 20090429 * update for new findings regarding volume/data section * changed APIv2 function handle_get_amount_of_sectors to have a 64-bit parameter instead of 32-bit * worked on EnCase Fastbloc write blocker support 20090427 * updated libuna * worked on EnCase 6.13 Tableau write blocker support * remove volume type functions/definitions in APIv2 and changed it to media flags 20090426 * worked on device information * updated libbfio 20090425 * worked on libbfio exists handle function update * updated libbfio * worked on GUID support for windows build * extents header value is now formatted in more table like manner * fixed hash value identifier size issue in info and verification handle * rename libewf_format to ewf_format in ewftools * worked on device information 20090424 * updated libbfio - exist handle function update 20090422 * updated configure.ac * worked on local use support * implement codepage header file like in libpff * moved typedef from handle.h to type.h include header file * worked on automatic testing of write resume 20090421 * fixes for MSVSCPP build * moved segment file size from write io handle to segment table * segment file size is now set on read 20090420 * moved write finalize function to write io handle * refactored sections correction out of write finalize function into separate functions * removed \n from error strings in libewf and ewftools * moved write initialize and resume functions to write io handle * refactored chunk offset correction for last filled/compared offset 20090419 * worked on date and time strings * changed crc_buffer from uint8_t * to void * * libewf now tracks if pool was created inside library * worked on acquiry resume * updated libbfio * added get segment file size functions to API 20090418 * changes for local use of libewf in libsmio * updated process_status to use liberror * worked on glob to use liberror * updated libuna * worked on adding set_header_codepage to ewftools * worked on error tollerance * worked on preservation of timestamps in header values * fixed error in libewf_set_header_codepage * EWFX date values now contain +/- UTC/GMT difference 20090415 * fixed == in configure.ac 20090414 * added to do to ewfexport 20090412 * refactored order of functions handles: open, close, read, write, seek * corrected LIBEWF_DLL_EXPORT in ewftools to LIBEWF_DLL_IMPORT * worked on imaging handle and ewfacquire * fixed double free in verification and export handle * updated libbfio 20090411 * fixed misplaces #endif in libewf header file * fixed smart string length in ewfinput * changed compress empty block into compression flags in ewftools 20090410 * small adjustments 20090405 * small adjustments 20090404 * implemented chunk and crc buffer alignment * fixed crc mismatch in read delta chunk * added support for delta chunks in libewf_handle_prepare_write_chunk * added chunk size restriction in libewf_write_io_handle_write_existing_chunk * updated libbfio * added APIv2 function to retrieve current segment filename * refactored file_io out of device_handle * ewfexport, ewfverify now show which files contain CRC errors when compiled with APIv2 support * worked on header codepage support in ewftools 20090403 * added configure option for static executables * change raw-access configure option to low-level-functions * fixed on raw access in ewfalter * fixed read/write write beyond file size corruption 20090402 * Worked on pyewf * Removed EWFCOMMON_BUFFER_SIZE from tests 20090401 * Fixed some small errors in API version 1 legacy support * changed compress_emtpy_block into a compression flag * changed empty block compression behavior for all compression levels * add whence SEEK_SET, SEEK_END with 0 offset support to seek_offset * refactored libewf_write to libewf_write_io_handle * added support for Cygwin US-ASCII character set to system string 20090330 * Updated caseless compare functions with WINAPI support 20090329 * removed libbfio_file_io.[ch] * worked on adding system error string support to libbfio error messages * fixed multiple errors * cleaned end of lines in error in libbfio * worked on Windows PhysicalDrive device access 20090328 * updated narrow and wide string definitions * removed HAVE_WIDE_CHARACTER_SUPPORT_FUNCTIONS * change LIBBFIO_WIDE_SYSTEM_CHARACTER_TYPE into LIBBFIO_WIDE_SYSTEM_CHARACTER_T and implemented WINAPI UNICODE system string detection * worked on removing libbfio_file_io.[ch] 20090326 * updated type.h with corrected printf format specifiers for Windows 20090325 * updated windows config 20090324 * worked on native WINAPI file access in libbfio and device_handle * fixed SetFilePointerEx offset correction for SEEK_CUR 20090323 * updated make dist for missing libbfio msvscpp files * fixes for msvscpp build * updated config_windows.h * worked on native WINAPI file access in libbfio and device_handle 20090316 * worked on refactorin libewf_write 20090315 * worked on implementig v2 api in ewftools * moved fgets to file stream IO * renamed v2 api raw read/write functions * refactored libewf_read into libewf_handle and libewf_read_io_handle * refactored libewf_write into libewf_handle and libewf_write_io_handle * worked on libewf_handle_open_pool * removed libewf_internal_handle_create_header_values, default header values are now empty 20090314 * added verion 1 api disable functionality to configure.ac for testing purposes * worked on signal handler for ewftools handles 20090313 * worked on unifying header/hash value functions ini the ewftools * worked on alteration handle 20090312 * added support for separate libbfio * updated glob.[ch] 20090310 * added segment file name size functions * changed program to system string 20090309 * added values table get identifier and value size functions 20090308 * worked on libbfio support - created libbfio_pool - refactor libbfio_handle initialization out of libbfio_pool - implemented SEEK_END in libbfio_file and libbfio_handle * implemented libbfio_pool in libewf * worked on v2 api * changed libewf_character_t into uint8_t in libewf_values_table * implemented libbfio_file_exists 20090307 * worked on libbfio support * worked on v2 api 20090304 * worked on v2 api 20090303 * worked on raw access in verification handle * worked on raw access in export handle 20090302 * worked on raw access in export handle * updated manuals 20090301 * fixed regarding additional space in date value in libewf_convert_date_xheader_value * worked on export handle * fixed empty chunk issue in libewf_read_process_chunk_data * worked on info handle * fixed offset correction error in libewf_file_io_handle_seek_offset * fixed memory leak in libewf_open introduced by legacy change * removed ewflibewf * fixed wide character type support compilation 20090228 * worked on simplifying read input function for ewfacquire(stream) * worked on device handle - moved device code in ewfacquire to device handle * added support for missing units in byte size string (defaults to mebibytes) * fixed byte size string increment for no factor definition * ewfacquire added -P option to set bytes per sector * updated manuals * added support for optical disk and memory media type in ewfacquire(stream) * if removable or optical media type are chosen ewfacquire now defaults volume type to logical * worked on info handle * worked on export handle 20090227 * worked on imaging handle - refactored read input function * worked on simplifying read input function for ewfacquire(stream) * fixed missing verbose output * worked on detection of sector size 20090225 * worked on imaging handle raw access support * worked on v2 api * fixed delcaration error in libewf_error.h * moved error functions to libewf_error.c * moved remaining function in libewf_file to libewf_support * removed libewf_file * added description of functionality of tools in usage information * renamed libewf_interface into libewf_metadata * implemented imaging handle in ewfacquirestream 20090224 * worked on imaging handle * worked on v2 api * MD5 and SHA1 digest are now set by libewf_set_hash_value function 20090223 * worked on imaging handle 20090222 * worked on locale support * worked on imaging handle * worked on v2 api 20090219 * fixed rogue free of filenames in verification handle in amount_of_files check * fixed v2 api support in verification_handle_open 20090209 * worked on support for EnCase 6.12 SHA1 hash * fixed error in unknown section debug output * added support for process identifier and extents header2 values * fixed NULL free in ewfverify 20090125 * worked on ewfverify and verification handle * fixed missing libewf memwatch flags 20090124 * fixed missing quoted in configure.ac 20090118 * Updated headers * Updated configure.ac to conform to cache value naming schema * Updated autoconf/make to use flags and library definitions * Fixed missing notify_dump_data in for debug output * debug output is only provided on verbose output * worked on ewfverify and verification handle * Merged changes for EnCase 6.11 winen file format and memory image from 20080609 beta branch * Removed byte swap from ewfverify not needed 20081207 * fix for printing GUID 20081019 * Updated liberror * Added splint make option * Worked on verification handle 20081018 * Minor adjustments * Updated liberror_definitions with encryption error definitions 20081015 * Minor adjustments 20081013 * Fixed APIv2 of libewf_check_file_signature 20081012 * Worked on UTF character suppport 20081011 * changed ewfguid into guid * removed string duplicate functions * Worked on MSVSCPP build * Worked on UTF character suppport 20081007 * small adjustments to support 20081005 * small adjustments to file io 20080928 * worked on making ewftools code more gereneric * worked on making UTF-8 strings for internal use (not for filenames) 20080927 * small adjustment in makefiles 20080922 * fixed typo in definitions and internal definitions 20080921 * updated libuna * updated configure and Makefiles * implemented liberror * renamed doc into documents * removed date_time and notify from common * changed HAVE_WINDOWS_API into WINAPI 20080917 * Small change in configure.ac 20080916 * Fixed issue in error * Updated libuna 20080915 * worked on experimental version 2 API currently requires additional configure flag - made libewf_handle_initialize and libewf_handle_free available - rewrote open and close in correspondence with handle_initialize and handle_free 20080914 * worked on separation of narrow and wide character string functions 20080913 * worked on separation of narrow and wide character string functions 20080912 * worked on improved error handling * removed error tollerance setting the code will be error tollerant if it is able to compensate or certain a value is valid * fixed issue regarding write finalize did not set data sections correctly for streamed writes due to data section cache * changed chunk offset compressed value to flags to also contain corrupted * worked on improved method of handling corrupted offset tables 20080911 * worked on improved error handling 20080910 * worked on libuna * worked on improved error handling * implemted new version of notify dump data * fixed check of libewf_string_snprintf should also check for > size * removed explicit set end of string after snprintf * worked on clean up of common 20080909 * replaced libuca with libuna * worked on improved error handling based on libuna version 20080908 * minor changes to configure.ac 20080907 * worked on refactoring functions in ewfinput, too large input is now flushed * refactored ewfcommon_determine_operating_system * ewftools: added process buffer size option - this allows performance testing using different buffer sizes * ewftools: added missing in usage information * ewfexport: added -l option * ewfexport: added calculation of MD5 adn SHA1 hash of exported data * ewfexport: fixed bug exporting with SHA1 hash * ewftools: updated manuals * ewfacquirestream: fixed issue not being able to terminate by CTRL+C due to block by reading from stding - stdin is now forced to close in the signal handler * file io pool now allows to be initialize with 0 file io handles * fixed memory leak due to section list rewrite * ewfacquire: worked on non interactive mode * fixed error in byte size calculation for values with 2 digits after the separator * added acquire unattended to automated tests (separate test cycle) * added export sha1 to automated tests (part of alter test cycle) * fixed issue where last segment file contained next section when acquired with ewfacquirestream * ewfverify: print additional available hashes 20080906 * refactored section list to use list type * refactored libewf_values_table * parse hash values will now handle MD5 hash to MD5 hash value conversion * get MD5 hash will now handle MD5 hash value to MD5 hash conversion * set MD5 hash will now handle MD5 hash to MD5 hash value conversion * get MD5 hash value will now handle MD5 hash to MD5 hash value conversion * set MD5 hash value will now handle MD5 hash value to MD5 hash conversion 20080905 * worked on refactoring code * rewrote _alloc() functions into _initialize() functions with corresponding _free() functions * worked on file io pooling * improved way to determine if a segment file has been closed after write 20080904 * worked on refactoring functions in ewfinput * combined empty block compression and other compressions in ewftools * change empty_block to empty-block the former remains to work * fixed error in UTF-8 handling (libuca) * updated MacOS-X package changed project website * updated MSVSCPP project files * fixed multiple ewfglob issues * removed secondary offset table from handle libewf now checks and corrects differences with primary offset table * integrated check for ctime in autoconf CTIME check * created libewf_handle_initialize and libewf_handle_free functions not available for api yet 20080903 * worked on integrating libuca and replacing string conversion routines * fixed missing split lines issue in libewf_header_values_parse_header_string * fixed underflow issue in libewf_string_split 20080902 * refactored process status * code clean up in ewftools * implemented ewfguid * refactored character string split to return int * changed project website * worked on integrating libuca and replacing string conversion routines * removed ewf_char.h and ewf_string.h 20080901 * refactored ewfglob 20080831 * added libewf_extern.h * Improved configure.ac 20080830 * removed errno.h include from ewftools where not used * Improved common and configure.ac * Renamed _char_t functions to _system_character functions in ewftools 20080821 * ewfalter now support single segment file as argument 20080820 * ewfverify, ewfinfo and ewfexport now support single segment file as argument * fixed bug in libewf_glob function in automatic detection of ewf type 20080810 * fixes to the python bindings based on patch by David Collett 20080809 * Synchronised branches * Fixed seek end of file based on patch by David Collett * Fixed return at wrong location in libewf_date_time_gmtime * Implemented libewf_get_offset API function * relicensed to LGPL * implement features.h * updated common with libpff 20080808 version * changed libewf_notify_set_values in libewf_file.c to notify_set_values * implemented python bindings based on patch by David Collett 20080705 * added ewfouput_error_fprint 20080704 * added fopen and fclose to configure 20080511 * minor changes 20080505 * Consistency update in API for get and set media and volume type functions * Updated configure.ac 20080501 * Fixed the package config file (.pc) (Nicolas (kwizart)) * Fixed the debian package files (Guy Voncke)n * Fixed minor issue in the manual (Guy Vonckens) * Fixed make lib (Christophe Grenier) 20080430 * Fixed in configuration for MSVCPP wide character compilation * Fixed small memory leak 20080426 * Minor changes 20080416 * Minor changes 20080412 * Fixed issue (introduced by RW fixes) in libewf_glob * Uncommented dh_makeshlibs in debian/rules 20080405 * Moved basename from segment table entry 0 to segment table * The segment filename can now be overwritten during acquiry this allows alternative segment filename paths * updated manuals * improved ewfalter test scenarios 20080403 * Fixed macosx installation path 20080330 * Fixed multiple bugs in read write mode, delta files were initiallity opened without read access * Worked on ewfalter to handle more complex RW scenarios * Changed libewf_read_chunk_data no longer to copy to buffer if buffer is the chunk cache data * Fixed unnecessary reopen of delta segement file in libewf_segment_table_create_segment_file 20080329 * Fixed wrong license in MacOS-X package 20080323 * Moved functions in libewf_file to libewf_interface and libewf_support * Renamed libewf_internal_handle to libewf_handle 20080322 * implemented endian conversion macros * fixed minor issue in libewf_debug_header_print 20080320 * performance testing * fix for %jd and %zd detection for gcc-2.95 on Debian 3.1 * fix for openssl evp and gcc-2.95 on Debian 3.1 * fixed sha.h detection error in autoconf/make scripts * updated manuals * fix for %jd and %zd detection for OpenBSD because gcc throws a warning if %jd has no parameter but fails to print the parameter * implement usage of LIBEWF_WIDE_CHARACTER_TYPE instead of HAVE_WIDE_CHARACTER_TYPE in header and source files except in common code 20080319 * refactored test write functions * refactored the conversion from offset table to table offsets from section to segment file this reduces multiple unnecessary conversion 20080318 * removed overflow from write - this seems to be a bug in EnCase 6.7.1 behavior is no longer present in EnCase 6.8, read still support overflow this will allow to convert faulty EnCase 6.7.1 EWF files 20080317 * fixed typo in configure.ac * libewf EnCase 6 >2GB segment files not compatible with EnCase 6.8 offset table overflow is no longer written by libewf * added LIBEWF_CD_SUPPORT for testing purposes - no way to detect amount of sessions yet, will default to 1 section with start sector 1 * changed trailing bytes warning into verbose print 20080315 * corrected dist clean in Makefile.am * corrections for MSVCPP project * fixed binary stdout for WINDOWS version of ewfexport * fixed binary stdin for WINDOWS version of ewfacquirestream 20080314 * Fix for verbose output 20080313 * tested session section R/W functionality * made package ready for stable test 20080312 * Code clean up * ewftools implicitly link libcommon * fixed memory leak in header values for export to ewf 20080309 * Code clean up * fixed ewfcommon_determine_operating_system * fixed overflow on compression read error, buffer is no longer passed for compressed chunks * fixed raw access parameter mix up 20080308 * Code clean up * worked on seperating common code * fixed issue with byte size string and more than 1 digit after the seperator will now handle 2 digits and skip remaining * fixed issue with minimum segement file size in ewf tools also lowered values to 1.0 MiB * implemented determining session size * fixed MSVCPP project * fiexde signal handling for Windows 20080306 * Code clean up * worked on seperating common code 20080305 * Code clean up * worked on signal handling * fixed issues with date string in header * fixes for missing printf "%jd" and "%zd" under Cygwin and WIN32 * worked on seperating common code 20080304 * Code clean up * worked on signal handling * fixed error due to fclose( NULL ) in ewftools 20080303 * Code clean up * added byte size string to ewfinfo * updated manuals of ewfinfo * worked on signal handling 20080302 * Code clean up * worked on session support * ewfinfo will now output session information if present part of media information * worked on byte size string * added byte size string to ewfacquire, ewfacquirestream and ewfexport segment file size, not to acquiry size due to possible rounding errors * updated manuals of ewfacquire, ewfacquirestream and ewfexport 20080301 * Code clean up * Refactored hash and header value functions * fixed writing incorrect linen6 header 20080229 * Code clean up * safe guarded libewf set functions for read/write * made header parse more fault tollerant * rewrote UTF16 conversion routine also handle wide character strings solves issues with mbsrtowcs (handling characters like back space) 20080228 * Worked on not finalizing on error * Refactored libewf_header_values_parse_header and libewf_header_values_parse_header2 * Removed dirty value from offset table entry, reduces memory usage * worked on export to EWF * worked on handling not empty chunk cache in write existing data data in chunck cache is ignored for now, write existing is not called without a read handle * fixed logical error in write existing data 20080227 * refactored ewfdigest_hash * changed LIBEWF_VERSION into LIBEWF_VERSION_STRING and added numeric LIBEWF_VERSION * added LIBEWF_WIDE_CHARACTER_TYPE definition * Worked on not finalizing on error * Code clean up 20080225 * Worked on not finalizing on error 20080224 * Added error output to the log * refactored ewfinfo 20080223 * worked on logging of digest hashes to log file * refactored ewfacquire, ewfacquirestream, ewfexport, ewfverify * updated manuals * moved libewf_internal_handle_determine_format to header_sections 20080221 * fixed logical error in libewf_write_test_chunks_section_full changed section_amount_of_chunks > maximum_section_amount_of_chunks to >= solves >16375 chunks offset table issue 20080220 * Worked on refactoring chunk dirty to segment file type 20080219 * removed corruption detection test in libewf_segment_file_write_chunks_data no longer needed * code cleanup * refactored use internal handle in libewf_write 20080217 * added corruption detection test in libewf_segment_file_write_chunks_data needed for test 20080214 * worked on abort * worked on low memory usage * code cleanup * removed libewf_filename_get and libewf_filename_set 20080212 * fixed ewfverify the EWF file can be verified without the integrity hash as pointed out by David Loveall * fixed incorrect default segment file size in ewfacquirestream as pointed out by Dennis Schreiber * fixed missing ewfinfo -e option 20080202 * code cleanup 20080129 * small adjustment in libewf_get_format function 20080127 * corrected comment in libewf.h.in 20080126 * code clean up * implemented libewf_glob function * worked on signal abort function * fixed incorrect return value in raw read 20080119 * worked on basic multi threaded safety 20080115 * worked on refactoring write initialize * added initialize function for format specific write values * added initialize function for media values specific write values 20080114 * removed initialize write in libewf_raw_write_prepare_buffer messes up multi threaded compression aproach * removed write initialize from libewf_get_chunk_size chunk_size is calculated on set of sectors_per_chunk and bytes_per_sector * removed libewf_internal_handle_read_initialize * worked on refactoring write initialize 20080112 * removed errno from library * fixed error regarding hours in ewfoutput_timestamp_fprint 20080107 * added more verbose output for raw write * added check for read sub handle in libewf_write_buffer and libewf_raw_write_buffer 20080106 * worked on removing type definition 20080105 * Used memwatch to analyze allocation issues * Fixed memory leakage due to insufficient error clean up in libewf_segment_table_read_open * ewfacquire user input now defaults on error instead of bailing out 20080103 * Used memwatch to analyze allocation issues * Fixed memory leakage in values list and in internal handle with sector table * Fixed missing libewf_common_alloc in ewfalter * Added NULL pointer free protection against non NULL protected libewf_common_free replacements 20080102 * Updated package config file 20071230 * adjustments to summary message to configure.ac * worked on MacOS-X package 20071229 * added summary message to configure.ac * small changed to debian package files and Makefile.am 20071228 * removed libewf_error_sector_table.h * type definition consistency changes in read input function in ewftools * updated year in copyright * changed LIBEWF_SECTOR_TABLE to libewf_sector_table_t * changed LIBEWF_CHAR and EWF_CHAR into libewf_char_t and ewf_char_t * changed EWF_SESSION and EWF_SESSION_ENTRY to ewf_session_t and ewf_session_entry_t 20071227 * moved hash string length from libewf definitions to ewfstring 20071222 * changed CDROM media type into CD media type 20071209 * minor changes to debian package files * fixes for the MS Visual C++ build * added ewfalter to MSVCpp build 20071208 * pkgconfig added to spec file 20071205 * minor change in defaults 20071201 * worked on refactoring code * API changes to get and set functions 20071130 * worked on refactoring code 20071129 * worked on refactoring code * fixed error in delta chunk size 20071128 * worked on refactoring code 20071126 * minor changes 20071124 * worked on refactoring code * made buffer passthrough default behavior * ewfexport added sha1 calculation support * fixed error writing segment files > 2 Gib * reduced multiple successive crc error entries to a single * reduced multiple successive acquiry error (error2) entries to a single * ewfcommon_export_ewf added raw access write support * change string to (u)int64 conversion routines to use long long equivalents * ewfacquirestream and ewfexport added > 2 GiB segment file support * libewf_filename_create now takes string and length as parameters * ewfalter added functionality to set delta segment file path/basename 20071123 * worked on refactoring code * moved libewf_offset_table_compare after the full index build in libewf_segment_file_read_open * added chunk size to delta chunk for redundancy * removed internal handle from most functions in section * ewfexport added argument set detection for interactive mode * section read count is returned instead of section size when possible * fixed win32 support solution file and ewfglob * added section type length to section list entry * added length filename in segment file struct * fixed error in error2 section regarding debug * worked on session section * added CD-ROM media type 20071121 * worked on refactoring code * libewf no longer allows to raw read/write a chunk of 0 bytes 20071120 * worked on refactoring code 20071119 * worked on refactoring to use segment file struct in section * changed stored delta segment number to 1 ... x count instead of 0 ... x count 20071118 * refactored segment table to a table of segment file ** * refactored offset table chunk offset segment_number and file_descriptor to reference of segment file * worked on refactoring to use segment file struct in section 20071117 * changed MB to MiB, etc. * worked on refactoring offset table to table of chunk offsets * worked on IO pool * removed common alloc/realloc cleared functions * libewf_segment_file_write_open is now used by libewf_open * removed libewf_offset_table_set_values * implemented libewf_filename to reduce code duplication for wide character type * worked on refactoring the offset table to use the segment file struct 20071114 * worked on refactoring segment files functions 20071113 * worked on refactoring segment table to table of segment files * fixed error in libewf_raw_read_chunk regarding use of the right segment table * worked on refactoring offset table to table of chunnk offsets 20071112 * change default segment file size to 1500 MB (^10) about 1400 MB in (^2), 3x segment files should fit on a DVD * worked on refactoring segment table to table of segment files * removed segment number in table check from libewf_segment_file_read_sections() 20071111 * changed default wipe behavior for ewfacquire(stream) default behavior is that only remainder of the chunk is wiped instead of the entire chunk * Updated manual pages 20071110 * updated MSVSC++ project files * commented out io pool * automated delta file testing * added libewf_convert_date_xheader_value * added ctime date format to ewfinfo which is now default refactored header values dat conversion functions * ewfacquire wipes remainder of chunk on acquiry error if wipe chunk is not set * fixed error in reading error2 section 20071107 * worked on delta file 20071106 * worked on delta file delta chunk header data is now 'protected' by a CRC * ewfacquire(stream) added check if last segment file is closed before telling acquiry was completed, by moving close handle before complete notification 20071105 * refactored raw access support in ewfexport 20071104 * refactored write functions * refactored read functions * worked on raw access support for ewfexport * small fixes in ewfexport * fixed write of duplicate table(s) in finalize, introduced by MD5 move * checked usage of stderr and stdout in ewfexport * worked on raw access support in ewfexport 20071103 * refactored write functions 20071030 * fixed input handling of format in ewfexport wide string support * fixed handling problems with raw read and size returned 20071028 * fixed error in write finalize for ewfacquirestream, due to restrictive check * fixed error for handling wide character delta segment filenames * worked on read wipe chunk on error * fixed miscalculation for CRC error in last chunk in read * added function to API to add CRC errors * fixed wrong function calls in ewfoutput_crc_errors_fprint 20071027 * Worked on cleaning up ewf struct read and write functions * Cleanup of set/get functions in internal handle * Added libewf_get_amount_of_acquiry_errors * Wrote API functions to rid ewfcommon of internal_handle for acquiry and CRC errors, header and hash values * Moved duplicate code for handling header and hash values into libewf_values_table * Removed internal_handle from ewftools * ewftools no longer create human readable byte string if size <= 1024 * changed int8_t return values into int return values * changed libewf_get and libewf_set functions for API consistency * moved several get and set functions from internal handle to file * fixed error in windows retrieving digest hashes 20071016 * Worked on cleaning up ewf struct read and write functions 20071015 * Worked on file io handler * Worked on cleaning up ewf struct read and write functions * change section start to static definition in libewf_section_last_write and libewf_section_start_write 20071009 * Worked on file io handler 20070919 * Worked on implementing raw read in ewftools 20070918 * Worked on implementing raw read in ewftools 20070916 * Fixed bug in libewf_section_hash_read introduced by MD5 calculation removal * Worked on implementing raw read in ewftools - moved the string functions from ewfcommon to ewfstring - moved the user input functions from ewfcommon to ewfinput - moved the user output functions from ewfcommon to ewfoutput - updated MSVCPP project files - seperated read and crc/uncompression functions 20070915 * Worked on deb based package - added distclean make directive * Adjusted rpm based package * fixed for rogue next sections in delta segment file section list during RW * fixed libewf_debug_read_section to handle a size of size64_t - still limited to SSIZE_MAX 20070912 * fixed on error in delta file accouting for multiple rewrites * removed libewf_write_chunk, libewf_internal_handle_read_is_initialized and libewf_internal_handle_write_is_initialized * fixed write finalize after R or RW open * clean up of small to do's 20070910 * worked to allow to set the delta file path * fixed error in delta file header offset handing * worked on error regarding delta file end 20070908 * worked on remove of MD5 calculation from library - implemented MD5 calculation in ewfcommon for ewfacquire and ewfacquirestream - removed libewf_set_media_values, calculated_md5_hash and libewf_raw_update_md5 from API - removed digest context and MD5 from library - removed calculated MD5 hash and MD5 context from internal handle - added macros libewf_get_hash_value_md5 and libewf_get_hash_value_sha1 to API - added macros libewf_set_hash_value_md5 and libewf_set_hash_value_sha1 to API - removed libewf_get_md5_hash from API - removed several libewf_internal_handle_get_ and libewf_internal_handle_set_ functions * worked on write support for > 2 GiB segment file for EnCase 6.7 * added check to libewf_close to enforce libewf_write_finalize * worked on having compound reallocation functions return an integer as result - removed libewf_internal_handle_chunk_cache_realloc * worked on moving byte swap out library into ewftools - removed libewf_set_swap_byte_pairs from API 20070905 * worked on remove of MD5 calculation from library - removed MD5 calculation from read - implemented MD5 calculation in ewfcommon for ewfverify - removed hashed flags in offset table - removed libewf_calculate_md5_hash from API * worked on read support for > 2 GiB segment file for EnCase 6.7 20070830 * changed use of stdout and stderr in ewfacquirestream, ewfinfo, ewfalter * removed program: error output in ewfacquire, ewfverify * fixed duplicate write of delta chunks 20070829 * worked on read support for > 2 GiB segment file for EnCase 6.7 * worked on write support for > 2 GiB segment file for EnCase 6.7 * worked on session section support * changed use of stdout and stderr in ewfverify * added errno == 0 check in ewftools after libewf open to prevent the following output "Unable to open EWF file(s) with failure: Success." 20070828 * worked on read support for > 2 GiB segment file for EnCase 6.7 * changed off_t to off64_t for Windows > 2 GiB segment file support * worked on write support for > 2 GiB segment file for EnCase 6.7 * changed use of stdout and stderr in ewfacquire 20070827 * removed libewf_common_string_copy and libewf_common_wide_string_copy using memcpy instead * changed some int8_t return values into int return values * worked on changing libewf_get functions for API consistency * removed unused macros from internal handle * replaced libewf_set_media_values by libewf_set_sectors_per_chunk and libewf_set_bytes_per_sector 20070822 * worked on allowing the internal MD5 calculation to be disabled * changed some int8_t return values to int 20070821 * worked on ewfexport exporting ewf formatted data for delta merge * print a more detailed error in ewftools for open errors * fixed amount of bytes to acquire in ewfacquire 20070819 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * change libewf_offset_table_realloc to return integer value because function does not change pointer of offset table itself the same for libewf_fill_offset_table and libewf_offset_table_read * completed reading dirty chunks from delta segment files * fixed spelling error in unsuported => unsupported in ewftools * rewritten #ifdef to #if defined() and #ifndef to #if !defined() * refactored user input handling code from ewftools to ewfcommon * worked on ewfexport exporting ewf formatted data for delta merge ewfexport no longer exports to stdout specify '-t -' to write to stdout only for continuous raw output * added libewf_get_flags_ function for use of libewf in Phyton with ctypes 20070818 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * completed refactoring of PRINT( "libewf and PRINT( "ewf function names * changed warning strings with 2^ values to value exceeds maximum * write optimalisation: - the data section is cached for multiple writes - refactored libewf_get_chunk_size out of ewfcommon_read_input * removed libewf_write_process_chunk_data no longer needed 20070816 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * removed internal handle passing from libewf_section_start_read, libewf_section_start_write * changed section start allocation in libewf_section_start_read from dynamic to static 20070815 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files 20070814 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * made macros of libewf_date_string_set_month, libewf_date_string_set_day_of_month, etc. in header values 20070813 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files 20070812 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * moved gmtime function from libewf_common to ewfcommon * removed error string from libewf_write_finalize * moved strerror functions from libewf_common to ewfcommon * removed chunk cache passthrough 20070811 * removed external char * removed error string from libewf_check_file_signature, libewf_segment_file_read_open, libewf_segment_file_write_open * merged common code in wide and narrow functions * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files * removed segment_table_build 20070809 * fixed weird progress indiction, changed localtime into gmtime * fixed error in libewf_close comment regarding return value 20070807 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files 20070806 * worked on restructuring to improve internal structure * worked on improved rewrite using delta segment files 20070728 * worked on restructuring to improve internal structure 20070725 * worked on restructuring to improve internal structure 20070723 * worked on allowing to read raw buffers as chunks * worked on restructuring to improve internal structure 20070722 * worked on allowing to write raw buffers as chunks 20070721 * worked on allowing to write raw buffers as chunks * removed is_dll function no need * adjusted seek offset function * added libewf_segment_file to give library improved structure 20070718 * worked on allowing to write raw buffers as chunks 20070717 * worked on allowing to write raw buffers as chunks * refactored function names into static char * * ewfacquire stream made physical default instead of logical just like in ewfacquire * fixed configuration error in MSVS C++ libewf_dll project file wrong DLL compilation mode /MT * added fix for off_t being 32 it in MSVS C++ 20070716 * worked on allowing to write raw buffers as chunks * refactored function names into static char * 20070715 * worked on libtool DLL support * worked on allowing to write raw buffers as chunks * fixed reallocation bug in libewf_internal_handle_add_crc_error_chunk * refactored function names into static char * 20070714 * worked on libtool DLL support * worked on allowing to write raw buffers as chunks * refactored function names into static char * 20070713 * worked on libtool DLL support - changed macros in libewf_extern.h into LIBEWF_DLL_EXPORT and _IMPORT without the S * made libcrypto EVP interface default, use MD5 and SHA1 as fallback * refactored function names into static char * 20070710 * refactored function names into static char * * removed type from configure.ac 20070708 * worked on space in directory issue * added DLL support to configure.ac 20070707 * added fix for missing type definition u64 in linux/fs.h on some platforms * worked on issue with progress indicator, removed usage of difftime time_t B - time_t A should equal difftime without conversion to double 20070526 * removed the advertisement clause from the license 20070512 * changed default order of physical and logical in ewfacquire - makes more sense this way * updated manuals * fixed error in example of ewfacquire manual page 20070407 * minor corrections for Win32 port * fixed error in passing error retry value in ewftools * fixed memory corruption in libewf_internal_handle_set_acquiry_error_sector 20070406 * worked on next stable release * added status print to ewfacquirestream * change to print of type in notify 20070317 * worked on next stable release * changed libcrypto back to the MD5_ and SHA1_ interface still allows for EVP and Windows Crypto API 20070304 * minor type adjustments 20070303 * fixed bug regarding growth of segment file beyond maximum size 20070225 * fixed typo in libewf_handle.h * fixed cause of segmentation error in libcrypto 20070218 * added include of libewf_types to libewf_handle.h 20070210 * worked on changing size and offset types 20070208 * worked on changing size and offset types - fixed some errors while testing 20070207 * worked on changing size and offset types 20070206 * worked on changing size and offset types - updated libewf.3 20070205 * worked on changing size and offset types - fixed issue in section list after adjustments - reduces storage size and fixed issue in fill table 20070204 * worked on changing size and offset types 20070203 * worked on changing size and offset types - changed ewf_string_length, ewf_string_copy and ewf_string_compare into macro's - fixed memory leak in ewf_string_write_compressed * worked on code clean up - rewrote libewf_common_alloc and _realloc to macro's - rewrote libewf_common_read, _lseek, _write and _close to macro's - rewrote ewf_x alloc funtions to macro's - removed ewf_type specific alloc and free macro's - removed ewf_error2_sectors_realloc, was not used and resizing should be handled by libewf_common_realloc - removed ewf_table_offsets_realloc, was not used and resizing should be handled by libewf_common_realloc - removed ewf_string_realloc replaced by libewf_common_realloc - removed ewf_string_wipe replaced by libewf_common_memset - removed libewf_error_sector.c 20070131 * worked on changing size and offset types 20070130 * worked on changing size and offset types - file header now allocated statically - rewrote section type tests functions to macro's 20070129 * worked on changing size and offset types - added sys/types.h to libewf_types.h 20070128 * worked on seperate config header files for library and ewftools to fix installable header issue - removed LIBEWF_CHAR from API, wide functions were added * remove quick refences in header values - breaks compatibility with 0.2.1 version of libmodewf.c - was already broken due to new API design * moved non portable headers back to library path 20070127 * worked on seperate config header files for library and ewftools to fix installable header issue - changed functions containing CHAR_T in library to separate small and wide character functions (for trace-ability) - moved error_string print out of common function - removed open_read and open_write - moved copy from and to char_t functions out of the library into ewfcommon - CHAR_T now removed from library * implemented internal_handle to hide handle representation from outside code - added serveral API functions * renamed handle where used as internal handle to internal_handle 20070125 * worked on seperate config header files for library and ewftools to fix installable header issue 20070120 * now using openssl EVP interface instead of directly accessing MD5 functions * worked on implementation of xhash section - added hash values to handle - added get and set funtions for hash values - updated libewf.3 manual page * created a more generic digest_context and EWF digest hash to support SHA1 - replaces MD5 context and hash by digest context and hash * an option was added to allow for SHA1 calculation from ewfacquire and ewfacquirestream - updated manuals * added print of additional hashes to ewfinfo * added verification of SHA1 hash to ewfverify * seperate generic definitions from libewf_config.h 20070118 * worked on reducing the usage of header values quick references in libewf and ewftools * using equal definitions for CHAR_T as for LIBEWF_CHAR * worked on implementation of xhash section * fixed issue EWXF format not setting GUID in data section 20070117 * worked on reducing the usage of header values quick references in libewf and ewftools 20070116 * added new header values functions to libewf.3 manual * added reverse string search function * changed forward string search to macro * corrected error in split string due to new string search * changed string length function to macro * changed string compare function to macro (return type change) * changed string copy function to macro (return type change) - make sure the string is \0 terminated after copy * now using reverse search in parse xheader function for close tag * fixed error regarding the examiner_name parameter for ewfacquirestream 20070115 * adjusted creation of xheader string * added function to add user defined header value * added acquiry_software xheader value to ewfacquire and ewfacquirestream * changes to spec file to include ewfacquirestream * added function to parse xheader * added random GUID to EWFX * ewfinfo will now print extended header values * xheader: give acquiry date human readable timestamp with time zone * ewfinfo change Software used into Software version used 20070114 * worked on redesign of header values * fixed missing data issue in ewfacquirestream for large block sizes in combination with chunk cache passthrough * added manual for ewfacquirestrema and updated manuals * header values now uses a dynamic array - old pointers left in for compatibility at the moment 20070113 * changed free functions for basic types to macro's allows for optimization * made adjustments due to splint warnings - fixed error regarding buffer_size of ewf_crc_calculated being a signed interger while it should be an unsigned one - fixed error regarding parameter validation due to optimalizations in ewf_string_copy - fixed possible integer overflow in ewf_volume_calculate_chunk_size and ewf_volume_smart_calculate_chunk_size - fixed not checking the return value of close in libewf_common_close - adjusted compression level in header values from uint8_t to int8_t (for consistency) * changed API of libewf_close to return a status value - adjusted ewftools accordingly - most functions return -1 on error (for consistency) * removed STREAMED_WRITE sections * updated manuals 20070111 * fixed issue with unrestricting amount of offsets * media flags are written to volume and data section 20070110 * changed libewf_set_write_media_type to set volume type * added option to set volume type in ewfacquire and ewfacquirestream * fixed error in new header types, two value lines do not contain additional tabs 20070109 * added information about unknown_md and _sn * added libewf_header_value for more generic approach to handling header values * the volume media type in EnCase uses 0x00 for a floppy image and 0x01 for a hard disk image * adjusted library for fixed/removable media type * added error granularity to read and write * added function to set and get error granularity * adjusted ewfinfo and ewfacquire to handle error granularity - not needed in ewfacquirestream cannot compensate errors in streams 20070108 * Fixed error in EWFX format header section should be xheader section * Removed setting value of unknown3 in data section 20070107 * worked on linen6 support * added EnCase6 and linen6 to automated test * added get_version function * fixed errors for handing a write of less data than chunk size * fixed error in EnCase6/linen6 header string creation * added 8192, 16384 or 32768 sectors per block size options * removed signature from hash section * fixed error in strerror for strerror fallback missing return statement * fixed error in test statement in configure.ac 20070104 * worked on automated acquirestream test * fixed error in ewfcommon_read_input for handing a write of less data than chunk size 20070103 * adjusted copyright notice * worked on EnCase6 support * corrected error in writing original EWF, EnCase1 and SMART format 20061231 * Fix for ctime_r detection not allowing for ctime fallback in configure script * Fix for incorrect handling of user provided strings in ewfacquirestream * Added missing sprintf function check and several precompiler definition changes by Christophe Grenier * configure and code now handles ctime_r 3rd argument under Solaris 20061230 * Fix for precompiler handling for gcc 2.95 in header_values * Moved GUID and operating software determination to ewfcommon * Changed autoconf detection of operating software fallback string * Added some options to ewfacquirestream * Fixed error in configure.ac regarding libuuid check * Added macros for tol and toul, with atol fallback support 20061229 * worked on read and write mode * removed chunk size buffer restriction from ewfcommon_read_chunk renamed it to ewfcommon_read_input * removed chunk cache wipe * several platforms tested 20061228 * added write remaining chunk data for streamed write to libewf_write_finalize * worked on read and write mode - added amount_of_chunks to segment table, contains the amount of chunks of a segment file - removed segment_file_offset in handle write, overlap with file_offset in segment table - fill offset table while writing - removed handle->write->offset and ->amount_of_offsets - removed handle->write->create_segment_file 20061227 * added pkg-config file (still expirimental) * added a check to libewf_close to enforce libewf_write_finalize * moved libewf header files to include/libewf - should fix missing header problem * worked on read and write mode - added seek_offset - added read_buffer - added it to API and libewf man page - added ewfalter (expirimental) - rewrote read_chunk not to do its own offset checking - added write_random 20061226 * worked on read and write mode - added seek_chunk 20061225 * worked on read and write correction regarding new insight into table sections * added macro for sprintf fallback * added configure.ac check for Solaris ctime_r * rewrite of ewf_string to calculate the byte size for all lengths * rewrite of common wrapper functions to macro's (memset, memcpy, memcmp, free) - allow for compiler optimization for functions free, memset, memcpy, memcmp * worked on streamed write - added libewf_write_finalize (still expirimental) - created ewfacquirestream - added type to section_list_entry - have write functions set section_list_entries - basic streamed write mode now working - still needs more testing requiring options set by ewfacquirestream * corrected error in comment libewf_write_buffer in libewf.h 20061223 * test: full read & write on multiple platforms * test: different sized buffers for read and write * check into small segment files for a DVD image - more file handles than allowed will add support for this in the future * added make lib/library for libewf compilation only * removed multiple (same) -l<library> from configure * added check for snprintf (djgpp seems to be missing this function) - will add fallback support to snprintf in the future * corrected file rights on source files * added libewf.spec to source package to allow rpmbuild -ta <libewf> * fixed bug in reading header string 1 byte too little * libewf now warns if file exceeds the maximimum amount of offsets in a table section * worked on read and write correction regarding new insight into table sections * added support for the original EWF format 20061219 * Added have config defaulting to libewf.h required for library include * several adjustments thanks to Christophe Grenier - manual/libewf.3 - libewf.spec.in - fix for 4 GiB support for native Windows compilation _lseek => _lseeki64 20061218 * added sys/types for Solaris signal.h include 20061217 * worked on testing for stable release * fix for NetBSD using zlib 1.1.4 missing compressBound function * moved factor 2 buffer size enlargement from ewf_string_uncompress into ewf_uncompress this matches behaviour of ewf_compress * added support for missing ctime_r, localtime_r and strerror_r fallback to ctime, localtime, strerror * manually added INT64_MAX definition - for platforms missing LLONG_MAX definition 20061216 * worked on testing for stable release * fixed bug for buffer passthrough exceeding the buffer boundary for compressed chunks * fixed bug for chunk cache passthrough * fixed reallocation of chunk cache for chunk cache passthrough * disabled -Wextra compiler flag for OpenBSD compilation * removed wcsftime and strftime for platform compatibility - now using snprintf based solution * fixed EnCase1 format error - contains only 1 header section * fixed handling of EnCase1 format in strict error mode * automatic generation of SPEC file thanks to Christophe Grenier 20061213 * worked on testing for stable release * fixed bug regarding too small copy of date strings * fixed bug regarding over correcting uncompressed string length 20061212 * Worked on Windows wide character support * adjusted string copy from/to char to char_t * finished first version of manpage libewf.3 20061211 * fixed typo in ewfacquire man page acquiry -> acquire * removed AC_FUNC_MALLOC and AC_FUN_REALLOC from configure.ac * fixed typo in libewf_includes.h HAVES_ -> HAVE_ * adjusted code for warnings in Windows port * changed segment number to 16 bit value in read and segment table * fixed issue with ewfgetopt * moved utf16 to/from ascii converion functions from ewf_string to libewf_string * added intermediate macros for wide character support under Windows * adjusted static string concats - MVC first executes the macro, after which it tries static string concat - gcc seems to do this in oposite order 20061209 * added stdint.h support to libewf_includes.h * changed $build to $target in configure.ac * added libewf.spec file * libewf version numbers will not contain a release number any more - no additional value other than for development * fixed bug in \r detection in parse_header_string - when string length is 0 * adjusted option order in ewfacquire help function - should be alphabetical * worked on man pages using input provided by Kees Mastwijk * corrected some small output inconsistencies 20061208 * worked on ewfinfo man page using input provided by Kees Mastwijk 20061207 * worked on calculating a GUID for write * added GUID get and set functions to libewf * added GUID check for data section * added GUID write for encase5 and linen5 format * ewfacquire now adds random GUID (uuid) for encase5 and time based GUID for linen5 - only if libuuid is present * ewfacquire added test for block or character device before determining device size * ewfcommon created generic version function - added library version information * changed version() to ewfcommon_copyright_fprint() * worked on ewfacquire man page using input provided by Kees Mastwijk 20061206 * added hypens to GUID output in ewfinfo * worked on calculating a GUID for write 20061204 * changed configure.in to configure.ac * moved CFLAGS to configure.ac * system dection code is now only used to determine the fallback string for ewfacquire - detection of available functions is now based on header detection * moved library code to ./libewf and code for the ewftools to ./ewftools and libewf.h to ./include * removed LIBEWF_H_USED_IN_PACKAGE * added defines to ewfcommon for different buffer size testing 20061201 * added optimalization definitions - for testing * implemented chunk cache passthrough * added configuration parameters for buffer passthrough and chunk cache passthrough - buffer passthrough does not seem to enhance the performance significantly - chunk cache passthrough does not seem to enhance the performance significantly * ewfacquire: ask or determine media type (fixed and removable) * added EWFX format (expirimental) - (basically EWF-E01 based format) - allows for section xheader, which contains header information in XML and is stored in an compressed string 20061130 * problem with media size calculation due to change - note: uint32_t * uint32_t = uint32_t and will not upscale to uint64_t * ewf_string: better solution for size*16 in ewf_string_uncompress - the length starts out with a factor 2 and keeps increasing by a factor 2 until string can be decompressed * moved process status and summary functions to ewfcommon * added process summary to ewfexport * read: will uncompress chunk directly to chunk sized buffers for non compressed chunks * are both the segment table and section list file descriptor value needed - can this be a single value? - the file descriptor in the section list was used as safe guard only - removed * Only use the chunk cache when the input buffer size does not suffice for reading or writing an entire chunk - the chunk cache actually reduces performance for sequential reads due to additional memcpy - completed * ewfverify: show status indicator * ewfverify: when done show time and Mb/s 20061129 * Media size is calculated when not set * Added -Wextra compile flag for addition warning values * fixed: weird floating point exception after recompilation of working versions in callback functions - this was actualy a division by zero in the callback function * read: added improved support for EnCase linen 5 format - adjusted libewf_header_values for more flexible header creation * write: removed the CRC after the offset table for the SMART format * write: added linen5 support * header values: removed trailing \r from last header value * write: fixed error regarding buffer passthrough * read: will read chunk directly to chunk sized buffers for non compressed chunks 20061128 * worked on performance enhancements * lseek is now only used if section data needs to be skipped - in libewf_sections_read_segment - in libewf_read_chunk - added segment number to offset table and file offset to segment table for basic offset tracking * found issues in documentation - EnCase1 (EWF-E01) format stores its chunks in the table sections not in the sectors section it uses an EWF-S01 alike layout - SMART in FTK Imager has a CRC at the end of the offset table * fixed read and write regarding issues in documentation * read: fixed error in recognizing FTK imager format 20061127 * worked on performance enhancements * changed ewf_crc_calculate to make use of zlib's adler32 function instead of algorithm derived of CRC algorithm by Andrew Rosen - this improves the performance significantly ;-) * changed libewf_endian functions for improved error handling * removed memcpy from chunk cache read to data for non compressed data in libewf_read_random 20061126 * worked on performance enhancements * changed iterator to 32 bit in ewf_crc_calculate saves conversion on a 32-bit platform 20061125 * worked on string and char types * changed ewf_sectors.[ch] into ewf_chunk.[ch] - chunks do not only reside in sectors sections therefore the name change * removed ewf_chunk.c - now uses ewf_string functions, moved necessary functions to libewf_string.[ch] * worked on performance enhancements * reduced CRC (de)allocations 20061124 * worked on performance enhancements * added buffer size option to ewfacquire 20061123 * worked on string and char types * added macros for static char or wchar_t type strings * note: fgets and fgetws cannot be used on the same stream after one and other * string: wide character support (wchar support) - Windows also provides tchar, tchar is a wrapper for both char and wchar_t * change char* to EWF_CHAR* or LIBEWF_CHAR* - allow for char and w_char interfacing with library - use LIBEWF_CHAR for char/w_char wrapping and EWF_CHAR for byte strings in EWF file format, CHAR_T required for wchar_t support in basic functions - make internal EWF related strings byte strings (EWF_CHAR) - make string functions safe to be char or uint8_t - use string.x for string functions * string: added length to libewf_string_search * string: added length to libewf_string_split * ewfacquire: added wchar_t support for utsname_buffer.sysname * ltree: changed ewf_tree_data_read * ewfinfo: added stored MD5 hash * ewfacquire: added print read errors on exit * all: in read and write functions add file_descriptor test - not necessary libewf_common functions do check this 20061122 * worked on string and char types * windows has: wmain for wide character arguments * moved getopt code to ewfgetopt for wmain support * moved glob code to ewfglob * changed libewf_open to match main and getopt type arguments * fixed check enable...=no validation - $withval needed to be $enableval * added CHAR_T and INT_T for wrapping character type of support functions like (w)open 20061121 * worked on string and char types * fixed: missing ewf_char.h, ewf_string.h and libewf_config_windows.h in package * changed COPYING and AUTHORS due to license issue * removed: libewf_common_string_to_uint64 and libewf_common_string_to_int64 * fixed: several compilation errors for wide character type support * added: strchr to ewfcommon for getopt support 20061119 * worked on string and char types * changed %s and %c where necessary to PRIs and PRIc 20061118 * worked on string and char types * string: removed LIBEWF_STRING type definition * string: removed string_copy_from/to_char functions * string: added wrapper PRIc for c, lc and PRIs for s, ls * common: removed strdup - no longer needed - libewf_string_duplicate takes care of this functionality * common: removed strchr - no longer needed - libewf_string_search takes care of this functionality * common: removed strncmp - no longer needed - libewf_string_compare takes care of this functionality * fixed: inconsistency in libewf.h and libewf_file.h * common: removed strlen - no longer needed - libewf_string_length takes care of this functionality 20061115 * worked on string and char types * implement libewf_string_copy_(from/to)_header functions * changed utf16/ascii convert to copy functions * libewf_string: allow to set multibyte strings from header values - still need to test this 20061114 * worked on string and char types * implemented non compressed read and write in ewf_string - for ltree tree data * fixed bug in compression buffer reallocation in ewf_string - reallocation pointer was not provided backwards * delay header and header2 conversion to parse function * moved basic ewf_header2 functions to ewf_char - ewf_header2 has become a type wrapper * string: make a more generic ewf_string (use this in ewf_header, ewf_header2, ewf_ltree) also move ASCII and UTF 20061113 * worked on string and char types * ewf_string removed several functions * moved basic ewf_header functions to ewf_char - ewf_header has become a type wrapper 20061112 * worked on string and char types * header_values: rewrite libewf_header_values_set_value to return integer with status code * moved md5hash to string function to libewf_string * moved ewf_section_fprint and ewf_header_fprint to libewf_debug 20061111 * ewfexport: added time estimate * moved byte print function to ewfcommon * added API functions to retrieve header values * string: add string copy * string: add string copy to char/w_char types 20061110 * Fixed strerror_r char * return type on Ubuntu 20061109 * Fixed several logical bugs in write_buffer - incorrect check of chunk cache passthrough - incorrect handling of buffer sizes - incorrect handling of last buffer write * Fixed bug in ewfexport adding 128 bytes - due to print output to stdout * Fixed output write libewf_write_test_segment_file_full * ewfacquire: added time estimate * libewf_common_open: added check for return values _sopen_s 20061029 * Worked on clean up of includes in libewf.h * Created API functions to get and set the header values - this moves the header values dependency out of the ewftools * Moved verbose into library, also added notify stream - windows port: allow error output stream redirection (libewf_notify) requires Visual C/C++ /MD compilation flag * Fixed a memory leak in ewf_header_read - the compressed header was not freed * Added alternative compile time method for platform determination when uname() is missing * Fixed error in handling if AES crypt provider is not available * Moved the error handling values out of the library - no longer contains read chunk function * Added basic globbing code for windows port - should suffice * Fixed memory leak of last section in libewf_read_build_index * Fixed memory leak in ewfacquire bytes_string was never freed 20061028 * Merged the libewf win32 port by George Garner with current working verion - signal handling and memory debug was added to ewfsignal - added libewf.c for MainDLL function 20061026 * moved header_values_fprint to ewfcommon * created libewf_parse_header_values * moved from_ and to_file_descriptor functions out of the library and into ewfcommon * rewrite of from_ and to_file_descriptor functions in ewfcommon and related library functions * moved swap byte pair functions back into library * fixed header value creation is date strings are missing * added function to set media type in handle 20061025 * made one type (error sector) for crc and acquiry read error sectors * Worked on Win32 native port - fix for file open - not using the right parameters for Windows - fix for crypto API calls for MD5 context - rewrote some API functions to pass buffers from the application to the library so allocation and de-allocation is handled within the same program space 20061024 * minor alterations for BSD licensed getopt * added a libewf version of getopt to ewfcommon - it is basically a rewrite of the version by The Regents of the University of California - it should suffice for platforms without getopt * prefixed functions in ewfcommon with ewfcommon - this distinguishes them from the libewf functions * created acquiry_error to move error2 and endian conversion in ewfcommon into library * fixed missing read error retry reset after sector skip * fixed 1024 kb human readable size will now become 1.0 Mb * default amount of read error retries is now 2 (will result in 3 read attempts) * fixed error regarding read error retry one off 20061023 * Reduced input_file_size and input_write_size to 1 parameter: input_write_size * Renamed ewf_file_size to segment_file_size * Looked at generic character/string wrapper - for wide char support 20061022 * Fixed media type mismatch in data section in EWF file from ewfacquire for EWF-E01 format * Fixed empty section start size in EnCase (EWF-E01) format for read and write - FTK Imager * Fixed error in read with byte swap, the MD5 hash must be calculated over the non swapped data * Clean up in libewf.h * Worked on Win32 native port - added LIBEWF_EXTERN macro for DLL import/export - changed ctime to libewf_common function using the thread safe variant * Added libewf_set_write_input_size function * libewf and tools are now compilable natively on Windows 20061021 * Worked on Win32 native port - changed libewf_common_strncmp return to signed as it should be - changed strerror to libewf_common function using the thread safe variant - changed localtime to libewf_common function using the thread safe variant - requires some type casts from unsigned to signed - the libewf_common read and write function do the check if the size value exceeds INT32_MAX - rewrote ewf_md5hash_to_string() not to use snprintf - rewrote libewf_md5 to wrap multiple implementations is now libewf_md5_context - added Windows Crypto API support to libewf_md5_context * Reduced maximum amount in offset table to 32-bit value * Reduced segment values to a 16-bit value * Changed libewf_notify to use autoconf/make header check 20061020 * Worked on rewriting libewf_write - when header values are empty a default is created - better fill EWF-S01 segment file - recalculate the chunks per segment after the table section is written 20061019 * Block is only required to be wiped when offset is 0 * Worked on rewriting libewf_write - moved header values set and create to libewf_handle - removed set_parameter function * Fixed mismatch in segment size and chunks section size calculation for the EWF-S01 format * Fixed invalid amount of chunks per segment for 2 GiB segment file for the EWF-S01 and EWF-E01 format * Added maximum input size check * Added a generic set function for enabling byte swap * Completed redesign write and parameter functions to fallback to a default 20061018 * fixed error catching negative remaining segment size * worked on: redesign write and parameter functions to fallback to a default * Worked on rewriting libewf_write 20061017 * fixed error handling multiple segment files - the write_buffer loop now leaves the segment file in a state of an open chunks section * changed space left function into test full functions * implemented compressBound() for determing the required size a too small compression buffer * allow for a variable buffer size in write_buffer by using a chunk cache size and offset * ewf_header_compress: is there a better way to determine the size of the compressed buffer - compressBound fixes this * done: redesign handle, refactor certain aspects to sub structs like chunk_cache * worked on: redesign write and parameter functions to fallback to a default * Worked on rewriting libewf_write 20061016 * at last done rewritting libewf_write_from_file_descriptor to use new function libewf_write_buffer * changed handle->write->chunks_per_segment and handle->write->maximum_chunks_per_segment * progressive method of amount of chunks per section/segment is required for EWF-E01 fill method * calculative method of amount of chunks per section/segment is required for EWF-S01 pre-write offset table size determination * Worked on rewriting libewf_write 20061015 * corrected typo in src/Makefile.am * fixed libewf.h to be used from within the libewf package and outside * fixed maximum ewf file size in ewfacquire was 1 byte too large - due to new restriction in libewf * Worked on rewriting libewf_write * fixed remainder > 9 issue - using a naive solution but adequate 20061014 * ewfinfo: move error2 list print code into library - to ewfcommon * ewfverify: move crc list print code into library - to ewfcommon * write: fixed incorrect implementation of EnCase1 header * ewfinfo: move format detection code into library - basic file format detection is now in library a small part still in ewfinfo, this because EnCase2 and EnCase3 format look a lot each other * added function to create original header format * rewritten function to create headers to 3 more generic functions - for header2 not needed yet * Worked on rewriting libewf_handle * Worked on rewriting libewf_write * Added API get function for certain information * Renamed sector_count => amount_of_sectors * Renamed chunk_count => amount_of_chunks * Renamed error_count => amount_of_errors * fixed textual error in ewf_sectors_chunk_compress 20061012 * moved EWF definitions to ewf_definitions.h * moved PRIx fixes to libewf_includes.h 20061011 * ewfinfo: add date format in ewfinfo to month in text - no interpretation differences possible ISO8601 date string support added - based on patches/adjustments by Rob Meijer * Rewritten part of header_values for new date format * Added date format support to ewfinfo * fixed a space in configure output * Worked on rewriting libewf_write * Worked on rewriting libewf_handle - introduced new read and write specific subhandles * removed compression_used from handle - no longer needed * added error_granularity_bytes to write subhandle 20061010 * Worked on rewriting includes to use libewf_includes.h * Removed __attribute__((packed)) from structs for Win32 port - they do not seem neccessary anymore * Added the header file installation - based on patches/adjustments by Rob Meijer * read: warn when maximum offsets in table of S01 format is exceeded * Worked on rewriting libewf_write 20061009 * Added libtool support - based on patches/adjustments by Rob Meijer * Changed config.h to src/libewf_config.h * Added libewf_includes.h to wrap libewf_config.h for beter autoconf/automake integration * Worked on rewriting includes to use libewf_includes.h 20061008 * Changed program banner and version information * Version released 20061007 * Fix for missing header definitions for OpenBSD * Fix for missing INTx_MAX definitions for OpenBSD * Fix for compilation warnings for SunOS - moved libewf_common.h to be first include * Bug in reallocating chunk cache - initial reallocation was removed by rewrite * change chunk cache allocated_size to 32 bit value - also chunk size in read function 20061004 * Tested ewfacquire with disk with 0 sector error - success * Bug in MacOS-X reading a floppy with bad block - read with -1 could alter current file offset (determined by lseek) Added lseek check to check and correct for offset drift 20061003 * fixed one-too-many read error retry * fixed bug not correcting bytes_to_read in read error handling - this surfaced on MacOS-X (Linux read behavior is different) * ewfacquire: minor adjustment in output - removed dot 20061002 * fixed error in libewf_section.h - this surfaced on MacOS X 20061001 * disabled lvf support * fixed error in read error handling in write functionality - this surfaced under FreeBSD 20060929 * did some refactoring of write function 20060928 * did some refactoring of write function * ewfacquire: print MD5 hash when completed - added removed index build check from libewf_data_md5hash function - this function checks if hash is set ananyway 20060927 * minor adjustment to verbose logging configure options - fixed error with variable names containing '-' * all: human readable size add .0 for single digit values - implemented * fixed bug with missing config.h for sleuthkit integration * fixed some formatting issues * did some refactoring of write function * defaulted handle values to unknowns * added function to determine header length instead of strlen - this is more appropiate 20060926 * minor adjustment to verbose logging configure options * added program version to output * did some refactoring of write function - added more checks for write_count returns * write: warn before hand if segment file amount exceeds limit - implemented * all: human readable size add .[1-9] for single digit values - implemented 20060922 * worked on ltree * fixed error in verbose output CRC value libewf_read_random - checked if bug resides in other CRC output - could not find any * changed values in volume definition 20060916 * worked on code clean up and improved error handling * ewf_verify now generates CRC error list for sectors (also for compressed chunks) * verbose and debug prints are now optional (defaults are off) 20060912 * worked on code clean up and improved error handling * worked on skip beyond media size in write 20060911 * worked on code clean up and improved error handling * changed hardcoded max values to predifined macros 20060910 * worked on code clean up and improved error handling * renamed file_read and file_write to read and write * ewfaquire: add offset and size question * write: add offset and size support in write function * added lseek to common, removed off_t from code * ewfacquire: added nice byte print for status * ewfexport: added nice byte print for status 20060908 * worked on code clean up and improved error handling * worked on ltree implementation * added simple byte order detection to UTF16 to ASCII conversion * added offset and size question to ewfexport * added size and offset to read to and write from file descriptor functions * read: look at libewf_section_volume_read: volume chunk count is 0 - compensating - check removed no longer required due to LVF support 20060906 * worked on code clean up and improved error handling * ewf tooling returns the error status no exit * worked on improving automated test scripts * corrected user input inconsistency in ewfacquire * fixed free bug with zlib_crc and calculated_crc in write * fixed pointer bug with zlib_crc in write 20060905 * worked on code clean up and improved error handling * added large file support to configure.in for converting raw images > 4 GiB to EWF files * ewfacquire added total acquire time and bytes/second 20060904 * worked on code clean up and improved error handling * fixed bug regarding setting chunk size in handle from volume - this got somehow removed due to clean up * ewfacquire: add start and finish time 20060903 * worked on code clean up and improved error handling * moved section reading and writing code to libewf_section * fixed bug in libewf_read_random when offset is too large * wraped basic library calls in preperation of thread safety of library calls * added prefix to functions in libewf_common with common_ * enhanced error handling - no program exit but a nice return * using typedefs instead of defines * due to 20060505 fix, gave all value definitions a default value * removed a large amount of unrequired includes 20060902 * worked on code clean up and improved error handling * libewf_handle_cache_realloc removed from read volume section function * endian functions are prepended with libewf_endian_ * the secondairy offset table in handle for S01 format will no longer be allocated for read * started on error tollerance levels for recovery * moved file descriptor check in last_offset calculation to do one check per section list - section list was altered to be used for a single segment file only - reduces memory requirements 20060831 * worked on code clean up and improved error handling * created seperate structure for chunk cache 20060830 * worked on code clean up and improved error handling * allow to set clean value in libewf_(re)alloc_cleared functions 20060829 * worked on code clean up and improved error handling * worked on libewf_string - moved split code to it 20060828 * worked on code clean up and improved error handling * introduced and fixed new bug - reminder do not free result from localtime() 20060826 * worked on code clean up and improved error handling * fixed realloc calculation bug in file_read * moved definitions from .h files * changed headers in all files 20060824 * worked on code clean up and improved error handling * move crc check from file_read into different EWF read methods? no embedding this check in the segment types makes it more difficult to generate an CRC error list for ewfinfo 20060823 * no need for fatal warnings if code becomes re-entrant after error * added a wrapper of basic library calls * worked on code clean up and improved error handling * renamed notify.* to libewf_notify.* prevents name clashes * ewf_crc function now use a dynamic allocated CRC - this helps with error propagation * added big endian support to ascii to utf16 routine 20060822 * added byte swap (equivalent of dd conv=swab) functionality in both read and write * changed sys/types.h to inttypes.h all: check if sys/types definitions still needed in ewf_*.h files ? - not under linux will do a cross platform test anyway * started with implementing improved error handling and re-entry after error, combined with code clean up, better error control, revision of header to allow for one place to maintain acknowledgements 20060821 * read: added basic support for L01 files, which are basically EWF files * renamed ewf_file_signature to evf_file_signature - closer to the truth * ewfacquire: compensate for maximum S01 file size in ewf file size question - determine maximum - not relevant because there is a maximum of chunks within the file but the other data could grow to the 2 GiB 20060820 * ewfacquire: small change to confirmation 20060819 * lifted the 255 segment file limit on write, however it uses an (horrible) increment based naming scheme much like EnCase write: allow more than 255 segment files - completed * write: worked on SMART (EWF-S01) support * write: SMART (EWF-S01) - build in support for table2 * all: add SMART support - complete * worked on - all: due to 20060505 fix give all value definitions a default value - looks nicer * due to changes to the read and write logic the library was retested * read: error in percentage in libewf_read_random - works on FC5 * table size limitation does not seem present in EWF-E01 only in EWF-S01 * use autoconf/automake cross compilation parameters for platform determination - completed 20060818 * read: worked on SMART (EWF-S01) support * alternative read method was removed, the assumption it was based on is no longer valid read: remove alternative read method the assumption behind is fails for the SMART format - completed * renamed alternative write method to wipe block on read error write: rename the alternative write method to wipe_block_on_error (or something) - completed * read random: chunk based size check now is a buffer based size check * removed handle->chunk_crc no longer needed * for the EWF-S01 format the entries in table2 are appended to the offset table - have yet to test a file with a table2 section * write: worked on SMART (EWF-S01) support 20060817 * read: worked on SMART (EWF-S01) support 20060816 * ewfacquire: add overview to confirm user input, otherwise restart input query - completed * ewfacquire: make encase5 file option default - completed * fixed incorrect order for values in header2 on write - also in documentation 20060812 * made the amount of read error retries flexible and user adjustable through ewfacquire * correction of "int result" in file_write to be C89 code compliant * new file size algorithm to fill up closer to max file size when compressing write: change algorithm to fill files upto file size - completed * added empty block compression write: always compress empty chunks - completed as an option 20060809 * fixed size bug for large images on Cygwin - fix of 20060610 not sufficient for Cygwin * fixed invalid value in printf volume read verbose messages * added autoconf/automake structure 20060708 * renamed endian.h to libewf_endian.h for compatibility issues 20060617 * put conditions around debug code in eqfacquire 20060611 * fixed - one off bug in header value end of string 20060610 * ewfacquire test on multiple platforms * added support for SMART format volume section - equals the original EWF volume section definition * fixed - type casting error in data size * fixed - missing header for encase1 format in write * fixed - bug in writing encase4 and encase5 header2 in write - error in ascii to utf16 routine * fixed - bug in writing encase4 and enacse5 header in write - logical formatting error * write: timestamp is now generated only once * write: fixed incorrect free in header values * write: fixed memory corruption bug in ewfacquire - required explicit zero of string 20060605 * fix of data corruption bug - one off * ewfacquire: sanitize input provided by user * ewfinfo/eqwfacquire ? 1970 date when no case data is provided - bug in split function regarding first empty value * removed file cache - no longer required 20060527 * started analysis of a data corruption bug 20060526 * fixed write bug when read is successful after error with small error granualirity * fixed write bug with error granularity 1 * ewfacquire: add chunk size input possibility * ewfacquire: add error granularity size input possibility * ewfacquire: memory corruption bug in user input - repaced some code - looks OK now - but hard to reproduce * fixed write bug with block size 128 error granularity 16 in test * write: improve reading of bad sectors and writing a error2 section to file for encase5 file option 20060520 * fixed media size bug - old method of calculation was still in there :-( * worked on ewfacquire read on error * added alternative write method to test acquired images against existing tooling * ewfaquire: able to produce exact media data as linen * write: what if read error is in last chunk and it is smaller than chunk size !? 20060517 * removed duplicate include from notify.c 20060516 * added media size to ewfinfo * worked on ewfacquire read on error 20060513 * minor adjustment in libewf.h - ewf_close renamed to libewf_close 20060505 * Fix for older compilers like gcc 2.95 - rewrite to older C statements 20060424 * added warning macro to allow overriding some fatal errors * allow overriding invalid CRC's * refactored crc check in ewf_section to file_read - for scope of handle and uniformity within the code * further analysis of unknown values in hash section - also found difference in signature value Encase4 and Encase5 20060423 * Fix for Solaris in definitions.h 20060422 * Fixed missing PRI definitions on OpenBSD - now defines in definitions.h * changed sprintf to snprintf * added device size determination for OpenBSD * fixed bug in header values parsing for empty first value empty * added compression level definition * ewfinfo: add compression media information in ewfinfo - Encase5 format only * write: moved compression type functionality from ewfacquire into library 20060419 * Adjusted write method - to fix filesize problem * Correction of verbose print of last chunk number * the write function works only when a data section is at the start of the file - why ? not a bug in write but in read the first offset in the segment table was filled with 0 instead of 13 which is the size of the file header 20060418 * Tested on FreeBSD 6.0 needed to add include header in ewf_sectors.h * Adjusted Make to be more generic and to work on FreeBSD 6.0 20060415 * changed u_int to uint * removed LIBEWF_ types * zlib uses a long which varies per 32 and 64 bit architecture using an intermediate variable fixes not able to read compressed images on a x86_64 architecure * Memory corruption bug in segment table filename fixed 20060414 * Fixed previous offset size * removed memcpy assignments * type fixed malloc assignments * removed (void *) from memset * reduced the amount of int definions * changed printf formaters * added status indication to ewfexport using callback function in read_from_file_descriptor * added quiet option to ewfexport and ewfacquire * removed dependency on libiconv - created a naive utf16 to ascii conversion * moved header string generation code to header_values * added time string generation code to header_values * added acquire options for compression and file type to ewfacquire * code now partially fixed for x86_64 systems fixed malloc statement, printf sizes, and some type definitions * additional changes to memcpy statements made * Use header_values for write * ewfacquire fix error print on correct fixed value * ewfacquire fix for empty input values * ewfacquire fix strange image file rights * ewfacquire fix image filename weird characters - one byte off allocation problem in ewfacquire * ewfacquire allow for a default value - for fixed values * ewfacquire can now acquire devices on works on Mac OS-X/Darwin * fix write crc error in chunk on mac os x * ewfacquire add EWF file size input possibility - check upper bound 2 GiB, lower bound 1440k * fix write bug with small file size 1440k - for floppy image - this has to do if both the filesize and the ewf size are the same - write will adjust with one additional segment file 20060413 * Used LIBEWF_VERSION in executables * Added file signature function to library for integration in The SleuthKit * Added md5.h for allowing to do with different MD5 calculation code bases like the one integrated in the The SleuthKit 20060412 * Created separate file for header value logic - moved code from ewfinfo 20060411 * Nearing release of first version, so started logging relevant changes * Removed memory leak with duplicate header assignment to handle * Renamed ewfmd5sum to ewfverify - still have to enhance functionality * Renamed ewfcat to ewfexport - still have to enhance functionality * Added time parsing functionality to ewfinfo - date format is currently fixed in MM/DD/YYYY * Enhanced password and compression header value output in ewfinfo |