libewf and ewfacquire
Joachim Metz · libyal · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source library and tool set for the Expert Witness Compression Format (E01/Ex01), including ewfacquire to create images, ewfverify to check their integrity hashes, ewfinfo to read the metadata, and ewfmount to expose an image as a raw device. The repository remains actively maintained.
Who it is for, and when
libewf is the reason E01 is an interoperable format rather than a vendor lock-in: it lets a Linux examiner acquire, verify, and mount evidence in the format the rest of the field expects, and it underpins imaging in several other tools and distributions. ewfverify is the practical way to demonstrate that an image still hashes to what the acquisition log recorded — a routine and important step when evidence has moved between custodians. ewfmount plus a loop device gives you a read-only raw view for any tool that cannot read E01 natively.
What it does not cover
These are format tools, not a forensic workflow: nothing here write-blocks the source device, manages chain of custody, or analyses content. Support for the newer Ex01 variants and for vendor-specific metadata extensions lags the commercial tools that wrote them, so verify round-tripping before relying on it, and note that a successful hash verification proves the image is unchanged since acquisition — not that the acquisition was sound.
Go to the source
Open at github.com (opens in a new tab)https://github.com/libyal/libewf/wiki
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Joachim Metz
- Publisher
- libyal
- Year
- 2026
- Topics
- imaging, evidence-handling, linux, validation, open-source
- Checked at source
Related entries
Two maintained live Linux distributions assembled for digital forensics. CAINE 14 'Lightstream' is built on Ubuntu 24.04 and is notable for a write-blocking system that locks all block devices read-only by default, with a GUI to unblock deliberately. Tsurugi Linux ships a LAB analysis edition, a lighter Acquire edition for imaging, and the BENTO portable live-response toolkit; its current LAB release is version 26.03.
The acquisition half of the job done properly with Linux command-line tools: write protection, image formats, attaching subject media, image management and transfer, integrity by cryptographic and piecewise hashing, PKI signatures and RFC 3161 timestamping, drive security (ATA passwords, Opal self-encrypting drives, BitLocker, FileVault), and difficult cases such as RAID, VM images and damaged media.
A C library and a set of command-line tools (fls, icat, istat, mmls, blkls, tsk_recover and others) that read volume systems and file systems directly from a disk image. It is the engine underneath Autopsy and a component in many other tools.
Cyber5W Free DFIR Courses
Partly freeA DFIR training company that publishes a substantial block of genuinely free self-paced courses alongside its paid catalogue. Confirmed free titles include C5W-100 Introduction to Digital Forensics, Linux Forensics Distributions, Intro to Linux from a Forensics Perspective (Ubuntu and Tsurugi), Writing Forensics Reports, Computer Data Representation, Working with Files, Prepare Your Forensic Environment, Working with Virtual Hard Disk, several Spanish-language courses on evidence acquisition and Windows forensics, and a set of case-study workshops.
A 65-page manual from ENFSI's Forensic Information Technology working group covering personnel, equipment, accommodation, peer review, examination protocols, validation and uncertainty of measurement, proficiency testing, handling items, case assessment and prioritisation. It is one of ten ENFSI best practice manuals issued in November 2015 under the EU-funded TEFSBPM project.