EWF content and format

  • Thread starter Thread starter Shiju
  • Start date Start date
S

Shiju

Hello,
IS it possible to view the content of the EWF(Disk) partition ?Could
anyone tell me in what format the content in the EWF partition is stored ?

Thanks & Regards,
Shiju
 
Hi Shiju,

Why do you need that?

You can open it by using CreateFile on disk name or perhaps by opening that volume by its GUID.

About format you are on your own.

Regards,
Slobodan
 
Shiju,

You can get the content either progragramatically (see Slobodan's reply)
or using a 3rd party tool that will allow you to view disk sectors.

I used Paragon Partition Manager to view EWF config partition content.

Only MS will be able to answer your second question. Currently the format is
undocumented.
Some good info you can, however, pick up from EwfAPI.h file (download
appropriate (EwfAPI) QFE).

KM
 
Hi,
I was wondering is it possible to protect the EWF partition by any
antivirus programs? Are there any antivirus programs available that
would take into account of the EWF partition too?

Thanks & Regards,
Shiju
 
Shiju,
Hi,
I was wondering is it possible to protect the EWF partition by any
antivirus programs? Are there any antivirus programs available that
would take into account of the EWF partition too?
Click to expand...

I am not aware of any.

However, if you really need this feature, you can develop it yourself.
Just make a persistent copy of the EWF partition at some point
(programmatically). Then with an agent app (by timer or by user request)
check if the partition content is changed (binary compare) .

KM
 
Back
Top