search

onekey-sec / unblob

Extract files from any kind of container formats
https://unblob.org
Other
2.09k stars 80 forks source link

Add support for EWF / E01 disk image format #419

Open jgrover opened 1 year ago

jgrover commented 1 year ago

This is a common disk image format found in the digital forensics domain. Would bring a whole new set of users for unblob if this were added.

qkaiser commented 1 year ago

Standard reference documented here: https://github.com/libyal/libewf/blob/main/documentation/Expert%20Witness%20Compression%20Format%20(EWF).asciidoc

Format is made of segments containing sections. We can get to the end offset by browsing through sections.

I didn't find third party extractors so far. What we could do is use ewfexport to translate from ewf to raw data and get other handlers (e.g. extfs, ntfs) pick up chunks from raw.