ewf

package module
v0.0.0-...-04f60de Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 19, 2024 License: MIT Imports: 15 Imported by: 0

README

go-ewf

ewf parser

Documentation

Index

Constants

View Source 
const (
	EVFSignature = "EVF\x09\x0d\x0a\xff\x00"
	LVFSignature = "LVF\x09\x0d\x0a\xff\x00"
)
View Source 
const (
	DefaultChunkSize = 32768
	ChecksumSize     = 4
)
View Source 
const (
	EWF_SECTION_TYPE_HEADER  = "header"
	EWF_SECTION_TYPE_HEADER2 = "header2"
	EWF_SECTION_TYPE_VOLUME  = "volume"
	EWF_SECTION_TYPE_DISK    = "disk"
	EWF_SECTION_TYPE_TABLE   = "table"
	EWF_SECTION_TYPE_TABLE2  = "table2"
	EWF_SECTION_TYPE_DATA    = "data"
	EWF_SECTION_TYPE_SECTORS = "sectors"
	EWF_SECTION_TYPE_ERRORS2 = "errors2"
	EWF_SECTION_TYPE_NEXT    = "next"
	EWF_SECTION_TYPE_SESSION = "session"
	EWF_SECTION_TYPE_HASH    = "hash"
	EWF_SECTION_TYPE_DIGEST  = "digest"
	EWF_SECTION_TYPE_DONE    = "done"
)
View Source 
const (
	EWF_HEADER_VALUES_INDEX_COMPRESSION_BEST    = "b"
	EWF_HEADER_VALUES_INDEX_COMPRESSION_FASTEST = "f"
	EWF_HEADER_VALUES_INDEX_COMPRESSION_NO      = "n"
)

Variables

View Source 
var AcquiredMediaIdentifiers = map[EWFMediaInfo]string{
	EWF_HEADER_VALUES_INDEX_DESCRIPTION:              "Description",
	EWF_HEADER_VALUES_INDEX_CASE_NUMBER:              "Case Number",
	EWF_HEADER_VALUES_INDEX_EVIDENCE_NUMBER:          "Evidence Number",
	EWF_HEADER_VALUES_INDEX_EXAMINER_NAME:            "Examiner Name",
	EWF_HEADER_VALUES_INDEX_NOTES:                    "Notes",
	EWF_HEADER_VALUES_INDEX_MODEL:                    "Media model",
	EWF_HEADER_VALUES_INDEX_SERIAL_NUMBER:            "Serial number",
	EWF_HEADER_VALUES_INDEX_DEVICE_LABEL:             "Device label",
	EWF_HEADER_VALUES_INDEX_ACQUIRY_SOFTWARE_VERSION: "Version",
	EWF_HEADER_VALUES_INDEX_ACQUIRY_OPERATING_SYSTEM: "Platform",
	EWF_HEADER_VALUES_INDEX_ACQUIRY_DATE:             "Acquired Date",
	EWF_HEADER_VALUES_INDEX_SYSTEM_DATE:              "System Date",
	EWF_HEADER_VALUES_INDEX_PASSWORD:                 "Password Hash",
	EWF_HEADER_VALUES_INDEX_PROCESS_IDENTIFIER:       "Process Identifiers",
	EWF_HEADER_VALUES_INDEX_UNKNOWN_DC:               "Unknown",
	EWF_HEADER_VALUES_INDEX_EXTENTS:                  "Extents",
	EWF_HEADER_VALUES_INDEX_COMPRESSION_TYPE:         "Compression level",
}
View Source 
var CompressionLevels = map[string]string{
	EWF_HEADER_VALUES_INDEX_COMPRESSION_BEST:    "Best",
	EWF_HEADER_VALUES_INDEX_COMPRESSION_FASTEST: "Fastest",
	EWF_HEADER_VALUES_INDEX_COMPRESSION_NO:      "No compression",
}
View Source 
var DescriptorSize = uint64(binary.Size(&EWFSectionDescriptorData{}))

Functions

func ToMap 

func ToMap[K comparable, T any](keys []K, vals []T) map[K]T

func UTF16ToUTF8 

func UTF16ToUTF8(in []byte) string

func WriteWithSum 

func WriteWithSum(dest io.Writer, obj interface{}) (n int, sum uint32, err error)

WriteWithSum specifically objects which ends with Checksum field and writes to target by calculating adler32 sum

Types

type CompressionLevel 

type CompressionLevel uint8
const (
	None CompressionLevel = 0x00
	Good CompressionLevel = 0x01
	Best CompressionLevel = 0x02
)

type EWFDataSection 

type EWFDataSection struct {
	MediaType        uint8
	Unknown1         [3]uint8
	ChunkCount       uint32
	SectorPerChunk   uint32
	BytesPerSector   uint32
	Sectors          uint64
	CylindersCHS     uint32
	HeadesCHS        uint32
	SectorsCHS       uint32
	MediaFlags       uint8
	Uknown2          [3]uint8
	PALM             uint32
	Unkown3          [4]uint8
	SMART            uint32
	CompressionLevel uint8
	Unknown4         [3]uint8
	SectorErrorGr    [4]uint8
	Unknown5         [4]uint8
	GUID             [16]uint8
	Pad              [963]uint8
	Signature        [5]uint8
	Checksum         uint32
}

func (*EWFDataSection) Decode 

func (d *EWFDataSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFDataSection) Encode 

func (d *EWFDataSection) Encode(ewf io.WriteSeeker) error

type EWFDigestSection 

type EWFDigestSection struct {
	MD5      [16]uint8
	SHA1     [20]uint8
	Padding  [40]uint8
	Checksum uint32
}

func (*EWFDigestSection) Decode 

func (d *EWFDigestSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFDigestSection) Encode 

func (d *EWFDigestSection) Encode(ewf io.WriteSeeker) error

type EWFDoneSection 

type EWFDoneSection struct {
}

func (*EWFDoneSection) Decode 

func (d *EWFDoneSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFDoneSection) Encode 

func (d *EWFDoneSection) Encode(ewf io.WriteSeeker) (err error)

type EWFHashSection 

type EWFHashSection struct {
	MD5      [16]uint8
	Unknown  [16]uint8
	Checksum uint32
}

func (*EWFHashSection) Decode 

func (d *EWFHashSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFHashSection) Encode 

func (d *EWFHashSection) Encode(ewf io.WriteSeeker) error

type EWFHeader 

type EWFHeader struct {
	Signature     [8]byte
	FieldsStart   uint8
	SegmentNumber uint16
	FieldsEnd     uint16
}

func (*EWFHeader) Decode 

func (e *EWFHeader) Decode(fh io.Reader) error

func (*EWFHeader) Encode 

func (e *EWFHeader) Encode(ewf io.WriteSeeker) error

type EWFHeaderSection 

type EWFHeaderSection struct {
	NofCategories string
	CategoryName  string
	MediaInfo     map[string]string
}

func (*EWFHeaderSection) Decode 

func (ewfHeader *EWFHeaderSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFHeaderSection) Encode 

func (ewfHeader *EWFHeaderSection) Encode(ewf io.WriteSeeker) error

type EWFMediaInfo 

type EWFMediaInfo string
const (
	EWF_HEADER_VALUES_INDEX_DESCRIPTION              EWFMediaInfo = "a"
	EWF_HEADER_VALUES_INDEX_CASE_NUMBER              EWFMediaInfo = "c"
	EWF_HEADER_VALUES_INDEX_EXAMINER_NAME            EWFMediaInfo = "e"
	EWF_HEADER_VALUES_INDEX_EVIDENCE_NUMBER          EWFMediaInfo = "n"
	EWF_HEADER_VALUES_INDEX_NOTES                    EWFMediaInfo = "t"
	EWF_HEADER_VALUES_INDEX_ACQUIRY_SOFTWARE_VERSION EWFMediaInfo = "av"
	EWF_HEADER_VALUES_INDEX_ACQUIRY_OPERATING_SYSTEM EWFMediaInfo = "ov"
	EWF_HEADER_VALUES_INDEX_ACQUIRY_DATE             EWFMediaInfo = "m"
	EWF_HEADER_VALUES_INDEX_SYSTEM_DATE              EWFMediaInfo = "u"
	EWF_HEADER_VALUES_INDEX_PASSWORD                 EWFMediaInfo = "p"
	EWF_HEADER_VALUES_INDEX_PROCESS_IDENTIFIER       EWFMediaInfo = "pid"
	EWF_HEADER_VALUES_INDEX_UNKNOWN_DC               EWFMediaInfo = "dc"
	EWF_HEADER_VALUES_INDEX_EXTENTS                  EWFMediaInfo = "ext"
	EWF_HEADER_VALUES_INDEX_COMPRESSION_TYPE         EWFMediaInfo = "r"
	EWF_HEADER_VALUES_INDEX_MODEL                    EWFMediaInfo = "md"
	EWF_HEADER_VALUES_INDEX_SERIAL_NUMBER            EWFMediaInfo = "sn"
	EWF_HEADER_VALUES_INDEX_DEVICE_LABEL             EWFMediaInfo = "l"
)

type EWFReader 

type EWFReader struct {
	Segments       []*EWFSegment
	First          *EWFSegment
	SegmentOffsets []uint32
	ChunkSize      uint32
	Size           int64
	// contains filtered or unexported fields
}

func OpenEWF 

func OpenEWF(fhs ...io.ReadSeeker) (*EWFReader, error)

func (*EWFReader) Read 

func (ewf *EWFReader) Read(p []byte) (n int, err error)

func (*EWFReader) ReadAt 

func (ewf *EWFReader) ReadAt(p []byte, off int64) (n int, err error)

func (*EWFReader) Seek 

func (ewf *EWFReader) Seek(offset int64, whence int) (ret int64, err error)

Seek implements vfs.FileDescriptionImpl.Seek.

type EWFSectionDescriptor 

type EWFSectionDescriptor struct {
	Descriptor *EWFSectionDescriptorData
	Type       string
	Next       uint64
	Size       uint64
	Checksum   uint32
	DataOffset int64
	// contains filtered or unexported fields
}

func NewEWFSectionDescriptor 

func NewEWFSectionDescriptor(fh io.ReadSeeker) (*EWFSectionDescriptor, error)

func (*EWFSectionDescriptor) String 

func (esd *EWFSectionDescriptor) String() string

type EWFSectionDescriptorData 

type EWFSectionDescriptorData struct {
	Type     [16]byte
	Next     uint64
	Size     uint64
	Pad      [40]byte
	Checksum uint32
}

func NewEWFSectionDescriptorData 

func NewEWFSectionDescriptorData(typeStr string) *EWFSectionDescriptorData

type EWFSectorsSection 

type EWFSectorsSection struct {
	// contains filtered or unexported fields
}

func (*EWFSectorsSection) Decode 

func (d *EWFSectorsSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFSectorsSection) Encode 

func (d *EWFSectorsSection) Encode(ewf io.WriteSeeker, dataSize, next uint64) (err error)

type EWFSegment 

type EWFSegment struct {
	EWFHeader *EWFHeader
	Header    *EWFHeaderSection
	Volume    *EWFVolumeSection
	Sectors   *EWFSectorsSection
	Tables    []*EWFTableSection
	Digest    *EWFDigestSection
	Hash      *EWFHashSection
	Data      *EWFDataSection
	Done      *EWFDoneSection

	SectionDescriptors []*EWFSectionDescriptor
	// contains filtered or unexported fields
}

func NewEWFSegment 

func NewEWFSegment(fh io.ReadSeeker) (*EWFSegment, error)

func (*EWFSegment) Decode 

func (seg *EWFSegment) Decode(vol *EWFVolumeSection) error

func (*EWFSegment) ReadSectors 

func (seg *EWFSegment) ReadSectors(sector int64, count int) ([]byte, error)

type EWFTableSection 

type EWFTableSection struct {
	Section      *EWFSectionDescriptor
	Segment      *EWFSegment
	Header       *EWFTableSectionHeader
	BaseOffset   int64
	SectorCount  int64
	SectorOffset int64
	Size         int64
	Offset       int64
	// contains filtered or unexported fields
}

func (*EWFTableSection) Decode 

func (d *EWFTableSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFTableSection) Encode 

func (d *EWFTableSection) Encode(ewf io.WriteSeeker) error

type EWFTableSectionHeader 

type EWFTableSectionHeader struct {
	NumEntries     uint32
	Pad            uint32
	BaseOffset     uint64
	Pad2           uint32
	Checksum       uint32
	Entries        []uint32
	FooterChecksum uint32
}

type EWFVolume 

type EWFVolume interface {
	GetSectorSize() uint32
	GetSectorCount() uint32
	GetChunkCount() uint32
	IncrementChunkCount()
	GetChecksum() uint32
	SetChecksum(uint32)
}

type EWFVolumeSection 

type EWFVolumeSection struct {
	Data EWFVolume
	// contains filtered or unexported fields
}

func (*EWFVolumeSection) Decode 

func (v *EWFVolumeSection) Decode(fh io.ReadSeeker, section *EWFSectionDescriptor, segment *EWFSegment) error

func (*EWFVolumeSection) Encode 

func (vol *EWFVolumeSection) Encode(ewf io.WriteSeeker) error

type EWFVolumeSectionData 

type EWFVolumeSectionData struct {
	MediaType        MediaType
	Reserved1        [3]byte
	ChunkCount       uint32
	SectorCount      uint32
	SectorSize       uint32
	TotalSectorCount uint64
	NumCylinders     uint32
	NumHeads         uint32
	NumSectors       uint32
	MediaFlags       MediaFlags
	Unknown1         [3]byte
	PalmStartSector  uint32
	Unknown2         uint32
	SmartStartSector uint32
	CompressionLevel CompressionLevel
	Unknown3         [3]byte
	ErrorGranularity uint32
	Unknown4         uint32
	UUID             [16]byte
	Pad              [963]byte
	Signature        [5]byte
	Checksum         uint32
}

func DefaultVolume 

func DefaultVolume() *EWFVolumeSectionData

func (*EWFVolumeSectionData) GetChecksum 

func (e *EWFVolumeSectionData) GetChecksum() uint32

func (*EWFVolumeSectionData) GetChunkCount 

func (e *EWFVolumeSectionData) GetChunkCount() uint32

func (*EWFVolumeSectionData) GetSectorCount 

func (e *EWFVolumeSectionData) GetSectorCount() uint32

func (*EWFVolumeSectionData) GetSectorSize 

func (e *EWFVolumeSectionData) GetSectorSize() uint32

func (*EWFVolumeSectionData) IncrementChunkCount 

func (e *EWFVolumeSectionData) IncrementChunkCount()

func (*EWFVolumeSectionData) SetChecksum 

func (e *EWFVolumeSectionData) SetChecksum(c uint32)

type EWFVolumeSectionSpecData 

type EWFVolumeSectionSpecData struct {
	Reserved         uint32
	ChunkCount       uint32
	SectorCount      uint32
	SectorSize       uint32
	TotalSectorCount uint32
	Reserved1        [20]byte
	Pad              [45]byte
	Signature        [5]byte
	Checksum         uint32
}

func (*EWFVolumeSectionSpecData) GetChecksum 

func (e *EWFVolumeSectionSpecData) GetChecksum() uint32

func (*EWFVolumeSectionSpecData) GetChunkCount 

func (e *EWFVolumeSectionSpecData) GetChunkCount() uint32

func (*EWFVolumeSectionSpecData) GetSectorCount 

func (e *EWFVolumeSectionSpecData) GetSectorCount() uint32

func (*EWFVolumeSectionSpecData) GetSectorSize 

func (e *EWFVolumeSectionSpecData) GetSectorSize() uint32

func (*EWFVolumeSectionSpecData) IncrementChunkCount 

func (e *EWFVolumeSectionSpecData) IncrementChunkCount()

func (*EWFVolumeSectionSpecData) SetChecksum 

func (e *EWFVolumeSectionSpecData) SetChecksum(c uint32)

type EWFWriter 

type EWFWriter struct {
	Segment       *EWFSegment
	SegmentOffset uint32
	ChunkSize     uint32
	TotalWritten  int64
	// contains filtered or unexported fields
}

EWFWriter is helper for creating E01 images. Data is always compressed

func CreateEWF 

func CreateEWF(dest io.WriterAt) (*EWFWriter, error)

func (*EWFWriter) AddMediaInfo 

func (ewf *EWFWriter) AddMediaInfo(key EWFMediaInfo, value string)

func (*EWFWriter) Close 

func (ewf *EWFWriter) Close() error

func (*EWFWriter) Seek 

func (ewf *EWFWriter) Seek(offset int64, whence int) (ret int64, err error)

Seek implements vfs.FileDescriptionImpl.Seek.

func (*EWFWriter) Start 

func (ewf *EWFWriter) Start() error

func (*EWFWriter) Write 

func (ewf *EWFWriter) Write(p []byte) (n int, err error)

func (*EWFWriter) WriteData 

func (ewf *EWFWriter) WriteData(p []byte) (n int, err error)

type MediaFlags 

type MediaFlags uint8
const (
	Image    MediaFlags = 0x01
	Physical MediaFlags = 0x02
	Fastbloc MediaFlags = 0x04
	Tablaeu  MediaFlags = 0x08
)

type MediaType 

type MediaType uint8
const (
	Removable MediaType = 0x00
	Fixed     MediaType = 0x01
	Optical   MediaType = 0x03
	Logical   MediaType = 0x0e
	RAM       MediaType = 0x10
)

type WriterAtSeeker 

type WriterAtSeeker interface {
	io.Writer
	io.WriterAt
	io.Seeker
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.