Marc Bown

What's happening?

Comment: libewf 20090927 (and earlier) cannot open some EWF files

Build 20091001 works perfectly, thanks. I'll go ahead and raise a ticket with Helix now and point them to this thread to see if they can get to the bottom of things on their end. Thanks again for the help.

2009-10-02 08:54:45 UTC in libewf
Comment: libewf 20090927 (and earlier) cannot open some EWF files

Brilliant, thanks. I'll test this today. The images were created with Helix's own acquisition application (new to Helix Pro 3). I'd wrongly assumed that this used libewf, but I guess they have written their own libraries to do this. Thanks for the information about the error - I'll raise a bug report with Helix too.

2009-10-01 07:47:52 UTC in libewf
libewf 20090927 (and earlier) cannot open some EWF files

I've noticed that EWF files created with Helix Pro cannot be opened with libewf. The files work with FTK Imager and Encase without a problem. Errors follow: ewfinfo evidence1.E01 ewfinfo 20090927 (libewf 20090927, libuna 20090901, libbfio 20090927, zlib 1.2.3, libcrypto 0.9.7) libewf_section_data_read: amount of chunks: 2240231 does not match amount in data section: 0...

2009-09-30 08:51:47 UTC in libewf