How analyze the content of E01?

libyal / libewf

Libewf is a library to access the Expert Witness Compression Format (EWF)

GNU Lesser General Public License v3.0

263 stars 76 forks source link

How analyze the content of E01? #161

Closed pipizhao-2020 closed 3 years ago

pipizhao-2020 commented 3 years ago

i want to analysis the file information that contains in the E01 file.

joachimmetz commented 3 years ago

The content of an E01 depends on what you put into it. If it is a hard disk you need to analyze it with tooling that understand partition tables, volume systems and files systems. If it is process memory, you need tooling that can help debug/analyze process memory.

pipizhao-2020 commented 3 years ago

is a hard disk，i want to analyze it by myself with c/c++.

joachimmetz commented 3 years ago

Then you need to write the tooling to analyze it. Start doing research on different partition tables, volume system and files system format. Maybe there is existing tooling out there you can use. This is out of scope for this project, I'll consider this question answered and close this issue.