EWF content and format

Hello,
IS it possible to view the content of the EWF(Disk) partition ?Could
anyone tell me in what format the content in the EWF partition is stored ?

Thanks & Regards,
Shiju

Hi Shiju,

Why do you need that?

You can open it by using CreateFile on disk name or perhaps by opening that volume by its GUID.

About format you are on your own.

Regards,
Slobodan

"Shiju" <shiju.mathew@samsung.com> wrote in message news:e0RNAmaXEHA.952@TK2MSFTNGP10.phx.gbl...
> Hello,
> IS it possible to view the content of the EWF(Disk) partition ?Could
> anyone tell me in what format the content in the EWF partition is stored ?
>
> Thanks & Regards,
> Shiju

Shiju,

You can get the content either progragramatically (see Slobodan's reply)
or using a 3rd party tool that will allow you to view disk sectors.

I used Paragon Partition Manager to view EWF config partition content.

Only MS will be able to answer your second question. Currently the format is
undocumented.
Some good info you can, however, pick up from EwfAPI.h file (download
appropriate (EwfAPI) QFE).

KM

> Hello,
> IS it possible to view the content of the EWF(Disk) partition ?Could
> anyone tell me in what format the content in the EWF partition is stored ?
>
> Thanks & Regards,
> Shiju

Hi,
I was wondering is it possible to protect the EWF partition by any
antivirus programs? Are there any antivirus programs available that
would take into account of the EWF partition too?

Thanks & Regards,
Shiju

KM wrote:
> Shiju,
>
> You can get the content either progragramatically (see Slobodan's reply)
> or using a 3rd party tool that will allow you to view disk sectors.
>
> I used Paragon Partition Manager to view EWF config partition content.
>
> Only MS will be able to answer your second question. Currently the format is
> undocumented.
> Some good info you can, however, pick up from EwfAPI.h file (download
> appropriate (EwfAPI) QFE).
>
> KM
>
>
>>Hello,
>>IS it possible to view the content of the EWF(Disk) partition ?Could
>>anyone tell me in what format the content in the EWF partition is stored ?
>>
>>Thanks & Regards,
>>Shiju
>
>
>

Shiju,

> Hi,
> I was wondering is it possible to protect the EWF partition by any
> antivirus programs? Are there any antivirus programs available that
> would take into account of the EWF partition too?

I am not aware of any.

However, if you really need this feature, you can develop it yourself.
Just make a persistent copy of the EWF partition at some point
(programmatically). Then with an agent app (by timer or by user request)
check if the partition content is changed (binary compare) .

KM