Getting and installing EWF support for CarvFs
After installing CarvFS you will be able to mount raw images, both single file and multi file, as the 'raw' module is build and installed together with the CarvFS tool. If however your images were created with encase or ftk, it is likely your images will be in EWF format. The carvfs-modewf module is a loadable module for CarvFS that uses LibEWF for access to EWF files. CarvFS-ModEWF allows you to mount EWF files with CarvFS.
Before installing carvfs-modewf, please make sure you have the following prerequisites installed on your system:
- The CMake build system.
- The development files for LibEWF. Note: The LibEwf API seems to be rather fluid, the libewf-20100126 release is one that is known to work.
- LibCarvPath (consult Getting and installing LibCarvpath for installing LibCarvPath)
You can download CarvFs-ModEWF here.
To build CarvFS-ModEWF, go to the command prompt, cd to the directory where you put your download, unpack the source package:
tar xzf carvfs-modewf0.9.0.tgz
Given that cmake has excelent support for out-of-tree builds, we now create a directory for building CarvFS-ModEWF, and go into that directory for building.
mkdir carvfs-modewf0.9.0-build cd carvfs-modewf0.9.0-build
Now we let cmake create our native build system files.
We conclude with building the library.
To install CarvFS-ModEWF after having build it, simply run the following two commands.
sudo make install sudo /sbin/ldconfig