Python development

libewf comes with Python-bindings named pyewf.

Below are examples how use pyewf. They assume you have a working version of pyewf on your system. To build pyewf see Building.

Import

To be able to use pyewf in your Python scripts add the following import:

import pyewf

Get version

The get_version() module function can be used to retrieve the version of the pyewf.

pyewf.get_version()

This will return a textual string (Unicode) that contains the libewf version. Since pyewf is a wrapper around libewf it does not have a separate version.

Open handle

ewf_handle = pyewf.handle()

ewf_handle.open(["image.E01"])

ewf_handle.close()

The explicit call to ewf_handle.close() is not required.

ewf_handle.open() requires a list of all the necessary filenames. You can use the pyewf.glob() to obtain a list of available filenames from "image.E01", e.g.

filenames = pyewf.glob("image.E01")

ewf_handle.open(filenames)

Open handle using a file-like object

file_object = open("image.E01", "rb")

ewf_handle = pyewf.handle()

ewf_handle.open_file_objects([file_object])

ewf_handle.close()

The explicit call to ewf_handle.close() is not required.

ewf_handle.open_file_objects() requires a list of all the necessary file objects.

Examples

Combining pyewf with pytsk3

The following additional import is required:

import pytsk3

class ewf_Img_Info(pytsk3.Img_Info):
  def __init__(self, ewf_handle):
    self._ewf_handle = ewf_handle
    super(ewf_Img_Info, self).__init__(
        url="", type=pytsk3.TSK_IMG_TYPE_EXTERNAL)

  def close(self):
    self._ewf_handle.close()

  def read(self, offset, size):
    self._ewf_handle.seek(offset)
    return self._ewf_handle.read(size)

  def get_size(self):
    return self._ewf_handle.get_media_size()


filenames = pyewf.glob("image.E01")

ewf_handle = pyewf.handle()

ewf_handle.open(filenames)

img_info = ewf_Img_Info(ewf_handle)

fs_info = pytsk3.FS_Info(img_info, offset=63 * 512)

Also see

import pyewf

help(pyewf)
help(pyewf.handle)