types

package
v0.2.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 8, 2026 License: MIT Imports: 1 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	FormatUnknown         uint8 = 0x00
	FormatEncase1         uint8 = 0x01
	FormatEncase2         uint8 = 0x02
	FormatEncase3         uint8 = 0x03
	FormatEncase4         uint8 = 0x04
	FormatEncase5         uint8 = 0x05
	FormatEncase6         uint8 = 0x06
	FormatEncase7         uint8 = 0x07
	FormatSmart           uint8 = 0x0e
	FormatFTKImager       uint8 = 0x0f
	FormatLogicalEncase5  uint8 = 0x10
	FormatLogicalEncase6  uint8 = 0x11
	FormatLogicalEncase7  uint8 = 0x12
	FormatLinen5          uint8 = 0x25
	FormatLinen6          uint8 = 0x26
	FormatLinen7          uint8 = 0x27
	FormatV2Encase7       uint8 = 0x37
	FormatV2LogicalEncase uint8 = 0x47
	FormatEWF             uint8 = 0x70
	FormatEWFX            uint8 = 0x71
)

Format values map EWF format identifiers.

View Source 
const (
	CompressionMethodNone    uint16 = 0
	CompressionMethodDeflate uint16 = 1
	CompressionMethodBzip2   uint16 = 2
)

Compression methods map enum LIBEWF_COMPRESSION_METHODS.

View Source 
const (
	MediaTypeRemovable   uint8 = 0x00
	MediaTypeFixed       uint8 = 0x01
	MediaTypeOptical     uint8 = 0x03
	MediaTypeSingleFiles uint8 = 0x0e
	MediaTypeMemory      uint8 = 0x10
)

Media types map enum LIBEWF_MEDIA_TYPES.

View Source 
const (
	MediaFlagPhysical uint8 = 0x02
	MediaFlagFastbloc uint8 = 0x04
	MediaFlagTableau  uint8 = 0x08
)

Media flags map enum LIBEWF_MEDIA_FLAGS.

View Source 
const (
	SectionTypeDeviceInformation uint32 = 0x00000001
	SectionTypeCaseData          uint32 = 0x00000002
	SectionTypeSectorData        uint32 = 0x00000003
	SectionTypeSectorTable       uint32 = 0x00000004
	SectionTypeErrorTable        uint32 = 0x00000005
	SectionTypeSessionTable      uint32 = 0x00000006
	SectionTypeIncrementData     uint32 = 0x00000007
	SectionTypeMD5Hash           uint32 = 0x00000008
	SectionTypeSHA1Hash          uint32 = 0x00000009
	SectionTypeRestartData       uint32 = 0x0000000a
	SectionTypeEncryptionKeys    uint32 = 0x0000000b
	SectionTypeMemoryExtents     uint32 = 0x0000000c
	SectionTypeNext              uint32 = 0x0000000d
	SectionTypeFinalInformation  uint32 = 0x0000000e
	SectionTypeDone              uint32 = 0x0000000f
	SectionTypeAnalyticalData    uint32 = 0x00000010
	SectionTypeSingleFilesData   uint32 = 0x00000020
)

Section types map enum LIBEWF_SECTION_TYPES.

View Source 
const (
	SectionDataFlagHasIntegrityHash uint32 = 0x00000001
	SectionDataFlagEncrypted        uint32 = 0x00000002
)

Section data flags map enum LIBEWF_SECTION_DATA_FLAGS.

View Source 
const (
	ChunkDataFlagCompressed uint32 = 0x00000001
	ChunkDataFlagChecksum   uint32 = 0x00000002
	ChunkDataFlagPattern    uint32 = 0x00000004
)

Chunk data flags map enum LIBEWF_CHUNK_DATA_FLAGS from public definitions.

Variables

View Source 
var (
	// SignatureEVFv1 is the EWF v1 EVF file signature.
	SignatureEVFv1 = [8]uint8{0x45, 0x56, 0x46, 0x09, 0x0d, 0x0a, 0xff, 0x00}

	// SignatureLVFv1 is the logical EWF v1 LVF file signature.
	SignatureLVFv1 = [8]uint8{0x4c, 0x56, 0x46, 0x09, 0x0d, 0x0a, 0xff, 0x00}

	// SignatureEVFv2 is the EWF v2 EVF2 file signature.
	SignatureEVFv2 = [8]uint8{0x45, 0x56, 0x46, 0x32, 0x0d, 0x0a, 0x81, 0x00}

	// SignatureLEFv2 is the logical EWF v2 LEF2 file signature.
	SignatureLEFv2 = [8]uint8{0x4c, 0x45, 0x46, 0x32, 0x0d, 0x0a, 0x81, 0x00}
)

Functions

This section is empty.

Types

type FileHeaderV1 

type FileHeaderV1 struct {
	Signature     [8]uint8
	FieldsStart   uint8
	SegmentNumber [2]uint8
	FieldsEnd     [2]uint8
}

FileHeaderV1 represents an on-disk EWF v1 file header.

func (FileHeaderV1) SegmentNumberValue 

func (h FileHeaderV1) SegmentNumberValue(order binary.ByteOrder) uint16

SegmentNumberValue returns the little-endian segment number.

type FileHeaderV2 

type FileHeaderV2 struct {
	Signature         [8]uint8
	MajorVersion      uint8
	MinorVersion      uint8
	CompressionMethod [2]uint8
	SegmentNumber     [4]uint8
	SetIdentifier     [16]uint8
}

FileHeaderV2 represents an on-disk EWF v2 file header.

func (FileHeaderV2) CompressionMethodValue 

func (h FileHeaderV2) CompressionMethodValue(order binary.ByteOrder) uint16

CompressionMethodValue returns the little-endian compression method.

func (FileHeaderV2) SegmentNumberValue 

func (h FileHeaderV2) SegmentNumberValue(order binary.ByteOrder) uint32

SegmentNumberValue returns the little-endian segment number.

type SectionDescriptorV1 

type SectionDescriptorV1 struct {
	TypeString [16]uint8
	NextOffset [8]uint8
	Size       [8]uint8
	Padding    [40]uint8
	Checksum   [4]uint8
}

SectionDescriptorV1 represents an on-disk EWF v1 section descriptor.

func (SectionDescriptorV1) ChecksumValue 

func (d SectionDescriptorV1) ChecksumValue(order binary.ByteOrder) uint32

func (SectionDescriptorV1) NextOffsetValue 

func (d SectionDescriptorV1) NextOffsetValue(order binary.ByteOrder) uint64

func (SectionDescriptorV1) SizeValue 

func (d SectionDescriptorV1) SizeValue(order binary.ByteOrder) uint64

type SectionDescriptorV2 

type SectionDescriptorV2 struct {
	Type              [4]uint8
	DataFlags         [4]uint8
	PreviousOffset    [8]uint8
	DataSize          [8]uint8
	DescriptorSize    [4]uint8
	PaddingSize       [4]uint8
	DataIntegrityHash [16]uint8
	Padding           [12]uint8
	Checksum          [4]uint8
}

SectionDescriptorV2 represents an on-disk EWF v2 section descriptor.

func (SectionDescriptorV2) ChecksumValue 

func (d SectionDescriptorV2) ChecksumValue(order binary.ByteOrder) uint32

func (SectionDescriptorV2) DataFlagsValue 

func (d SectionDescriptorV2) DataFlagsValue(order binary.ByteOrder) uint32

func (SectionDescriptorV2) DataSizeValue 

func (d SectionDescriptorV2) DataSizeValue(order binary.ByteOrder) uint64

func (SectionDescriptorV2) DescriptorSizeValue 

func (d SectionDescriptorV2) DescriptorSizeValue(order binary.ByteOrder) uint32

func (SectionDescriptorV2) PaddingSizeValue 

func (d SectionDescriptorV2) PaddingSizeValue(order binary.ByteOrder) uint32

func (SectionDescriptorV2) PreviousOffsetValue 

func (d SectionDescriptorV2) PreviousOffsetValue(order binary.ByteOrder) uint64

func (SectionDescriptorV2) TypeValue 

func (d SectionDescriptorV2) TypeValue(order binary.ByteOrder) uint32

type TableEntryV1 

type TableEntryV1 struct {
	ChunkDataOffset [4]uint8
}

TableEntryV1 represents an on-disk EWF v1 table entry.

func (TableEntryV1) ChunkDataOffsetValue 

func (e TableEntryV1) ChunkDataOffsetValue(order binary.ByteOrder) uint32

type TableEntryV2 

type TableEntryV2 struct {
	ChunkDataOffset [8]uint8
	ChunkDataSize   [4]uint8
	ChunkDataFlags  [4]uint8
}

TableEntryV2 represents an on-disk EWF v2 table entry.

func (TableEntryV2) ChunkDataFlagsValue 

func (e TableEntryV2) ChunkDataFlagsValue(order binary.ByteOrder) uint32

func (TableEntryV2) ChunkDataOffsetValue 

func (e TableEntryV2) ChunkDataOffsetValue(order binary.ByteOrder) uint64

func (TableEntryV2) ChunkDataSizeValue 

func (e TableEntryV2) ChunkDataSizeValue(order binary.ByteOrder) uint32

type TableHeaderV1 

type TableHeaderV1 struct {
	NumberOfEntries [4]uint8
	Padding1        [4]uint8
	BaseOffset      [8]uint8
	Padding2        [4]uint8
	Checksum        [4]uint8
}

TableHeaderV1 represents an on-disk EWF v1 table header.

func (TableHeaderV1) BaseOffsetValue 

func (h TableHeaderV1) BaseOffsetValue(order binary.ByteOrder) uint64

func (TableHeaderV1) ChecksumValue 

func (h TableHeaderV1) ChecksumValue(order binary.ByteOrder) uint32

func (TableHeaderV1) NumberOfEntriesValue 

func (h TableHeaderV1) NumberOfEntriesValue(order binary.ByteOrder) uint32

type TableHeaderV2 

type TableHeaderV2 struct {
	FirstChunkNumber [8]uint8
	NumberOfEntries  [4]uint8
	Unknown1         [4]uint8
	Checksum         [4]uint8
	Padding          [12]uint8
}

TableHeaderV2 represents an on-disk EWF v2 table header.

func (TableHeaderV2) ChecksumValue 

func (h TableHeaderV2) ChecksumValue(order binary.ByteOrder) uint32

func (TableHeaderV2) FirstChunkNumberValue 

func (h TableHeaderV2) FirstChunkNumberValue(order binary.ByteOrder) uint64

func (TableHeaderV2) NumberOfEntriesValue 

func (h TableHeaderV2) NumberOfEntriesValue(order binary.ByteOrder) uint32

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.