forked from libyal/libewf
-
Notifications
You must be signed in to change notification settings - Fork 1
/
ChangeLog
4655 lines (3825 loc) · 149 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
TODO
* be able to handle large chunk tables for version 2
- move chunk list access into chunk group
- throttle maximum chunk group size
* pattern fill chunk support (set chunk table entry, test)
* complete: libewf_chunk_table_fill_v2
* refactor libewf_internal_data_chunk_set_chunk_data not to clone ?
* ewfacquire error when both secondary output and resume are set
* pass zero byte empty block compressed data cache as a pointer
do not copy data to compressed chunk cache
* allow to set the number of values in the queue, thread pools and list
* memory usage of acquisition of Ex01 file? - chunk group size?
* memory usage of acquisition of Ex01 file? - -x versus non-x
* speed of verification of Ex01 file? - debug outout related?
* clean up TODO refactor notes
* refactor libewf_hash_sections_set_digest_from_hash_values move into hash_values?
* look into issues with high speed variations between chunk and non-chunk modes
* process status change the code to have to determine decimal point only once
* add multi threaded tool support
- ewfmount - fuse multi thread support ?
* chunk table get chunk from chunk_table->corrupted_chunks_list
* throttle the size of the sections list?
* ewfacquire allow to set the the maximum number of table entries?
Threat safety
* libewf_metadata
- libewf_handle_copy_header_values (write lock)
- libewf_handle_copy_media_values
- use on_error (continue from libewf_handle_get_header_value_identifier_size)
- write lock libewf_handle_get_ ... _hash_values
- refactor libewf_handle_set_format
- refactor libewf_handle_set_md5_hash
- refactor libewf_handle_set_sha1_hash
Multi-threading:
* make process by chunks the default
Tests:
* extend ewf_test_handle_get_values with
- session informatation
- tracks
- acquiry_errors
- checksum_errors? (needs read)
- libewf_handle_set_md5_hash
- libewf_handle_set_sha1_hash
- header value date and time formats?
* clean up ewf_test_read_chunk.c to match ewf_test_read.c
* write resume from volume/disk section - basically re-image
* ewfacquire:
- add non-unattended tests
- add option sets for single/multi threaded, chunks
* ewfacquire_optical:
- add non-unattended tests
* ewfexport:
- add non-unattended tests
- add option sets for single/multi threaded, chunks
- export of split RAW
- test writing to stdout and catch https://github.com/libyal/libewf/issues/23
* ewfexport_logical:
- add non-unattended tests
* ewfinfo:
- add DFXML output tests
*ewfverify
- add option sets for single/multi threaded, chunks
Error tolerance:
* add setting to be less strict
- non matching data section (set identifier)
- expand number of chunks
Roadmap:
* lvf support
- add support for permissions
- thread aware support (check)
* error tollerance
- allow for missing segment file(s)
- allow for missing section(s)
- allow for missing chunk(s). Can the chunks be shifted to match up with the
last segment file.
* bindings
- Python (partial)
- .Net (partial)
- Java/JNI
* improve device handle (libsmdev)
- audio track support - libsmdev
* libbfio API extensions (partial)
* low and high level API
- to allow low level access to sections etc. (for recovery)
- allow access to segment table
- allow access to offset/chunk table
- ewfdebug
* internationalisation/localization (i18n/l10n)
- Unicode support (added)
- locale support (partial)
- multi language string support (gettext)
need WINAPI version of gettext without libiconv dependency
* library/tools enhancements
- getoptlong
* ewfx enhancements
- xsignature section to sign xhash and/or hash
Code clean up:
* clean up configure.ac and acinclude.m4
- refactor dfxml check
* ewfinfo
- move DFXML code to separate code files, what about separate library ?
- implement a statefull XML writer e.g. open/close_section, open/close_value
* check TODO in code, mainly regarding improvements
BFIO support:
* improve open file io pool (set basename ?)
Further analysis of the EWF format:
* password hash
* volume/disk section (EWF-E01)
- do EnCase 5 or earlier versions support 64-bit number of sectors?
- unknowns
* hash section (EWF-E01)
- 16 byte unknown
* values in EnCase5/6 header2 (+/-)
* values in ltree strings (EWF-L01 LVF)
* values in session section (+/-)
* number of sectors in volume/data section has changed to a 64-bit value
but what about error2/sessions ? (sessions can be 32-bit)
* does newer linen6 has sha1 support?
* LVF: single file entry:
- are flags similar to file attribute flags ?
- parse first entries differently ? for file hierarchy
* FTK Imager: support for "Use AD Encryption"
- requires support for ADCRYPT file format
Features
* add bzip2 support and tests
* resume write support for ENCASE1/SMART table sections ?
* implement low memory usage option
- trade off IO versus memory use
* disk full check
- how to detect this condition (cross-platform) ?
- solution (A) at creation time of the segment file:
linux/unix posix_fallocate(), does not provide the desired result
windows SetFileInformationByHandle()
- solution (B) on write (backtrack last chunk)
implemented close segment file on LIBERROR_OUTPUT_ERROR_INSUFFICIENT_SPACE
although if linux write fails (write_count != write_size) before ENOSPC is set
there is still room left on the device, but cannot be claimed by libewf
* what about header values parsing with preservation of timestamps?
- change localtime to gmtime in libewf_date_time_values_copy_to_string ? (NO!)
- force set header value to require string formatted in the date format ?
Recovery and analysis:
* imaging: detect disk full and ask for new segment file location?
- have libewf allow to set the segment file path during write (done)
- have separate function to preallocate segment file?
- like alternative segment file path in EnCase
however EnCase seems to fully test if the segment file upfront by
allocating the necessary disk space
how to detect the destination has no available space ?
* recovering corrupt EWF files (missing segment file, corrupt sections, etc.)
- can the values in data be used to correct a corrupted volume ?
* check into resume write error for 32-bit compile (different zlib sizes)
* detect consistent number of chunks in table sections
Error handling/tollerance
* what about a function that translates error into an equivalent errno?
* have wchar error messages for WINAPI?
* improve offset table correction
- if not correctable skip chunk while reading and mark as crc error
or try to determine offset/size of chunk somehow
* handle corruption in both table and table2 sections
- non-overlapping corruption
- overlapping corruption
* handle missing sections
* handle missing segment files
* handle corrupt segment files
* write resume
- add support for ENCASE1/SMART table section
Additional (integrity) checks:
* read: check if successive headers match first header
* read: add check for next and done segment
- really the last segment in the file
- offset pointing at themselves
- correct size
Possible performance improvements:
* libewf_device_info_parse do this directly from the UTF16 stream ?
* libewf_case_data_parse do this directly from the UTF16 stream ?
* tune read and write buffer sizes
- read/write block size seems to have little effect for dd on average
- buffered bfio ?
* reduce alloc, realloc and free (this reduces breaks) use strace to analyze
- pass values as parameters or use of handle
- what allocation causes the break in strace of ewfacquire with compression libewf? zlib?
* optimize string functions
- pass length/size as much as possible
* do not write section start on data update
- performance improvement is insignificant
* read certain section data on demand ?
Python bindings (pyewf)
* add WINAPI wide character support for open() and glob()
* add more functions
- sessions
- acquiry errors
- read errors
.Net bindings (ewf.net)
* handle
- add more functions
* file entry
- add more functions
* mono support ?
API changes
* low level API
- segment file access
- section access
- chunk table access
- add function to retrieve EWFX xml header/hash directly
* chunk table access
- rewrite read/write chunk functions, pass chunk index
* add wide character functions definitions by default?
- not necessary on most platforms
* libbfio API extension
- add means to obtain libbfio handle of media data in ewf
- add means to set narrow string codepage
- export libewf_glob_file_io_handle
refactor glob functions to use libbfio handle input and return libbfio pool?
think about libewf_glob_file_io_handle and abstration of file io handle get/set name
* LVF support
- add LVF write support: libewf_add/remove_file
- add support for single file entry with "no content"
* file structure API extension (idea)
Debug
* print offsets of segment files
Tools:
* if one option available just print and continue
* if set by command lien just print and continue
* port multi threaded ewfacquirestream
* add multi threading support
* allow to set date and time
* locale support
- print output convert to system string
- reduce string conversions, use as much as possible the system string type in the tools
* when writing check getrlimit( RLIMIT_FSIZE )
* check char/wchar in/output
* add getoptlong support
* make compilation resilient for missing crypto library
- compile on system without libcrypto
- remove the cryptographic options if crypto library is missing
* have failed on open return a more sensible error (extract from error)
* process status
- improve and remove "This could take a while." ?
* libsystem path implement GetVolumeInformation
* ewfacquire:
- print status info without confirmation in unattended mode
- restrict error granularity and amount per sectors to > encase5 and > linen5 format ?
no, although not set in EWF file, the granualarity is still used in handling read errors
- warn if values exceed maximum segment count
- adjust error granularity if error granularity < process buffer size
should not matter for libsmdev
- warn if media does not fit using chunk size or APIv1
a (32-bit) chunks size of ( 64 * 512 ) will allow up to 128 TiB
- for EnCase 6 format request serial number and model if not set ?
- add support to manually provide sessions for optical images ?
- add support for unattended write resume ?
- improve output when encountering a read error
- add support to set device label header value
- allow for multi stage imaging, where user suspends and resumes
imaging process?
- add multi threading support
* ewfacquirestream
- implement stream handle
- add multi threading support
* ewfdebug
- create a tool to analyse a single segment file
- implement low and high level api separation
* ewfexport:
- if EWF file is empty still write an emtpy file
- add support for multi threaded logical export
- EnCase7 L01 ignore root entry like ewfmount
- support for volume letter in -t argument
- add support for different output chunk mode
- implement more ewfacquire acquiry parameters?
- handle different input and ouput chunk sizes in low level functions build
- allow different input and output header codepages?
- handle ewf/raw like in smioexport
- creates write only raw export file with msvscpp compilation
- limit output formats for input types (lvf vs ewf)
- add information and media values to raw output
- improve -f files error tollerability
- add multi threading support
- add multi threading support for logical images
* ewfmount
- Windows finish Dokan implementation
- Windows add ImDisk implementation ?
- MacOS native API support ?
- add multi threading support
- add multi threading support for logical images
* ewfverify:
- allow for multi stage verification, where user suspends and resumes?
- for multi threading measure: number of items queued, number of items
requeued, number of threads
- add multi threading support for logical images
- add support for multi threaded logical verify
Unsorted:
* libewf:
- empty caches on close
* check if empty block check or equiv is always done (except for no compression).
* user header and header2 time difference to calculate the timezone
* fix last_chunk_data_offset calculation for table2
in combination with libewf_chunk_group_correct_v1
* chunk data
- related calculation into chunk data
- change API to have chunk type
* libewf_chunk_data_check_for_empty_block
- use memcmp instead?
- write a test at configure time to determine which approach is faster
- same for adler32 ?
- sections list on write: cache section descriptors instead of free-ing them?
- segment files cache on write set to 1 ?
- create a single chunk groups cache ? instead per segment file ?
- check if chunks groups list is filled in on demand scenario
- only use backup range (table2) during initial phase?
- nope also necessary during reread
- use mapped offset to determine first chunk index (+/-)
- what about base offset ?
- make mapped offsets absolute ?
- refactor chunk table to:
- optimize use of libewf_chunk_table_chunk_exists_for_offset and
successive calls to fdata types
- refactor libewf_chunk_table_get_chunk_data_by_offset chunk data part
back to read IO handle ?
- handle: replace chunk_index calcuations by current_chunk_index tracking ?
- libewf_filename_create: change to accept ( segment_number - 1 )
- libewf_write_io_handle_initialize_resume: re-map mapped offset ranges ?
- write_io_handle->number_of_table_entries still needed ?
- add write support to the various fdata lists ?
and refactor it to have a generic solution if range list is not set fall back
* pyewf
- change header and hash values into sequence objects
* add function to retrieve:
- compression values
* add support for set identifier change ?
* check alignment of:
section_data_read CHS cylinders, SMART logs start sector
* check behavior of ewfacquire resume and specified offset
* complete ewfrecover
- max segment size
- try to read the chunks by calculating the checksums and see where they align
* corruption scenarios
- libewf_segment_file_read deal with corrupted segment file header ?
- add strict chunk data flag handling
- document how libewf deals with corruption scenarios
- valid table and table2 with different information
(for now use table if number of entries is not 0)
- tainted table and table2
- tainted table or table2 (use the one that is not tainted)
* add stream write support for EWF-S01 use fill space solution in table section
* fix double _FILE_OFFSET_BITS=64
* fix output: number of entries: 19175 exceeds maximum: 16375
* add light-weight function to determine byte frequency ? to check if compression is viable ?
* work on deduplication support
* allow zlib to be replaced by alternative back-end
* libewf_filename_create split off wide variant ?
* check if compression level none is passed for EWF-S01
- validate SMART forced compression of uncompressed chunks
* Ex01/Lx01 format
- encryption support (read/write)
- analytical data
- parse (read)
- case data (write)
- compression method support
- write blocker type support
- device information
- check TODO (read/write)
* Ex01/Lx01 test images
- memory image -> winen and encase ?
- resumed ?
- encrypted
- open single files ?
* Ex01/Lx01 read support
- add generic way to parse file object data ?
- make sure to correctly deal with aligment padding (should only affect one of the Lx01 tables)
* Ex01 write support
- enable secion data integrity hash support
- add support for write resume
* Lx01 write support
- make sure to correctly deal with aligment padding (should only affect one of the Lx01 tables)
* Ex01/Lx01 extensions
- implement SHA256 hash section
- allow pattern fill to have a size
- hash based imaging?
* pyewf
- update (+/-)
- file entry data ? instead of file entry
* ewfmount
- check access rights on fuse mount point
- add stat info on readdir (see regfmount)
- provide means to have a similar naming approach as mount_ewf.py
* check performance
Performance:
* map full RAW storage media data into memory?
- libsigsegv?
- mmap?
Deployment:
* spec file
- make flex, yacc include flexible ?
* add BORLANDC deprecated function support, unable to find suitable macro
#pragma deprecated( function )
__declspec(deprecated)
* windows build
- some of the CRT functions are MVC 2005 or later specific
- figure out a way to warn about the compiler used
- add VC_EXTRALEAN to msvscpp config
* integrating libewf.rc into mingw dll ?
Known issues:
* error acquiring USB floppy with bad blocks under FreeBSD - no problem with internal floppy drive
virtualisation could be part of the problem
* check chunk size for > 2 GiB table offsets
the current assumption is that these chunks only can be uncompressed
because the MSB is normally used to mark if the chunk is compressed
This actually is a bug in EnCase 6.7.1 the behavior is gone in EnCase 6.8
* MS Visual Studio C++ does not allow pre compiler macro in macro definitions
* Cygwin compilation missing __xpg_strerror_r - bug in recent Cygwin 1.7.8
Closed:
* libewf_single_files refactor to use UTF-16 split string
- does not really matter still need to do conversion to runtime UTF-16
* write resume, allow resume from volume/disk section
- why bother no media data has been written anyway
* EWF2 can handle more then UINT16_MAX segment files - add support for this?
- having more than 65000 segment files is a bit overkill,
also the naming schema does not support this without creating odd names
for now not adding support for this, unless there is a good reason to do so
20160918
* worked on tests
20160424
* worked on tests
* worked on chunk group
* refactored pack and unpack functions
20160411
* worked on tests
20160410
* worked on version 2 format support
* worked on new read/write chunk API
20160409
* worked on multi threading support in ewfacquirestream
* worked on tests
20160404
* disabled bzip2 support for now
* add check to see if target file can be written in ewfacquire,
ewfacquirestream, ewfexport, ewfrecover
* created a queue of storage media buffers
- this blocks the reader thread if the queue is empty
- this limits the maximum size of output list
20160403
* worked on deployment
20160402
* worked on multi threading support in ewfacquirestream
* fixes for Python-bindings tests
* fixes for ewfexport writing notification messsages to stdout
* changes for deployment
* increased granularity of process status
20160401
* worked on tests
* worked on thread locking support
* worked on multi threading support in ewfverify and ewfacquire
20160331
* worked on tests
* worked on thread locking support
20160330
* worked on thread locking support
20160329
* worked on thread locking support
20160328
* worked on tests
* worked on thread locking support
20160326
* changes for segment files read issue
* implement table2 fallback support in libewf_chunk_group_fill_v1
20160325
* fixed leaks libewf_chunk_table_get_chunk_data_by_offset
* worked on v2 support
20160320
* worked on tests
* fix for printing sha256 in ewfexport
20160319
* worked on tests
* fix for deployment using synclibs.sh
* removed v1 API
* removed delta file support
- outside the concern of this library
* removed "random" functions from:
- libewf
- ewf.net
- pyewf
20160318
* applied updates
* worked on tests
20160124
* worked on refactor
20160119
* worked on combined Python 2 and 3 build support
20160110
* 2016 update
20150126
* fix in ewf.net
20150107
* 2015 update
20141229
* updated dpkg files
* updated dependencies
* updated .gitignore
20141226
* changes for updated dependencies
20141225
* worked on Python 3 support
20141210
* fix in spec file for zlib-static
20141204
* small changes in progress status output
* moved chunk groups cache into handle
* moved libewf_chunk_table_chunk_exists_for_offset out of write-only code path
20141201
* code clean up
* removed unrestrict_offset_table, added maximum of 128 M to size of offset table
* removed ewf_definitions.h
20141129
* code clean up
20141102
* bug fixes
* ewf.net added FileEntry::GetType
20141030
* bug fix in Python-bindings
* changes for updated dependencies
20141021
* changes for deployment
20141012
* bug fixes
20141007
* updated dependencies and corresponding changes
* worked on autogen.sh and synclibs.sh scripts
20141002
* removed README.macosx
* changes for project site move
20140801
* bug fix in Python-bindings
20140608
* worked on tests
* updated msvscpp files
* bug fix for utf16 header functions
20140602
* bug fix in ewfmount regarding logical files date and time values
* fix for Lx01 files, device information section needs to be read before the
sector table section to determine the chunk size
20140601
* updated dependencies
* deprecated random functions
* worked on Python bindings
* worked on tests
* worked on EWF2 refactor
20140424
* fixes to build static library with mingw and cygwin
20140406
* bug fixes in m4 files
* worked on Python bindings
20140216
* bug fix in recent process status changes
20140201
* updated libcdatetime
20140126
* fixed multi file caching bug in libfdata
20140119
* 2014 update
* updated dependencies
* added libcdatetime
* bug fix in writing original ewf format, due to EWF2 refactor
20131230
* small updates
20131222
* moved low-level function support from compile time to run time
* worked on experimental features
20131211
* worked on Python bindings
20131210
* updated dependencies
* worked on Python bindings
* fix in DFXML output for size values
* removed codegear project files
* worked on ewfmount
20130901
* updated dependencies
* worked on Python bindings
* worked on tests
20130831
* updated dependencies
* replaced libcmulti by libcthreads
20130411
* changes for libmfdata and libfdata merge
20130410
* changes for libmfdata and libfdata merge
20130409
* changes for libmfdata and libfdata merge
20130408
* changes for libmfdata and libfdata merge
20130407
* changes for libmfdata and libfdata merge
20130406
* changes for libmfdata and libfdata merge
20130405
* changes for libmfdata and libfdata merge
20130404
* fixes for local library Makefiles
* changes for libmfdata and libfdata merge
* textual changes
* updated dependencies
* remove libewf_segment_file_handle
20130403
* changes for libmfdata and libfdata merge
- replaced libmfdata_file_list_t (delta) segment files list by libfdata_list_t
- replaced libcdata_list_t section list by libfdata_list_t sections list
* bug fixes for delta segment file handling
20130402
* changes to zlib.m4 for adler32 detection
* moved README.mingw to wiki
* changes for libmfdata and libfdata merge
20130331
* updated codegear files
20130330
* updated dependencies
* updates for libsmdev
* added error tolerance for Logicube image with missing checksum in data section
* code clean up
* worked on libcdata integration
* update msvscpp files
20130305
* fixed missing file in libcmulti distribution
* small build fixes
20130303
* updated python configure scrips
* updated macosx files
* worked on libcmulti
20130302
* updated types.h
* small changes in comment
20130128
* updated docstrings in pyewf
* fix for corruption scenario
20130126
* fixes in pyewf examples
20130120
* replaced mfcache by new fcache
20130119
* 2013 update
* updated Python bindings
* added pyewf/setup.py with thanks to Michael Cohen
20130105
* bug fix for 31th day of the month issue
20120916
* added detection of empty ha value containing "00000000000000000000000000000000"
* worked on bzip2 compression
* worked on chunk data rewrite
* ewfmount: worked on Dokan sub system support
20120915
* added -X option to ewfmount
20120902
* code clean up
20120815
* Changes to zlib location in msvscpp and codegear project files
20120809
* minor changes, updated python version in dpkg/rules
20120807
* updated codegear files
* fix for writing Ex01 SHA1 hash section
* worked on libewf_section_ltree_write
* worked on support for sector table first chunk number
20120806
* worked on ewfrecover man page
* updated codegear files
* added ewfrecover to codegear and msvscpp files
* added codepages 949 and 950
* bug fixes for xhash
20120805
* refactored libewf_section_last_write functionality from section to segment file
* added libcaes support
* added support to ewftools to throttle number of open file descriptors used
by library about 50% of the available descriptor is currently claimed
* code clean up
* worked on compression method support for ewftools
* fixes for recent changes
* worked on tests for EWF2
20120804
* worked on libewf_section_write_data
* worked on section data integrity hash support
* worked on encryption support
* worked on EWF1 ltree header
20120802
* code clean up
* worked on encryption support
* internal library default format is now EnCase 6
* improved debug output
* added support for 64-bit number of chunks, this allows for >= 8 TiB storage
media with the default chunk size
* added chunk data alignment support for write
20120801
* code clean up
* removed --enable-guid replaced by --with-libuuid=no
* updated package maker files
* worked on TODOs
* worked on pattern fill write support
* fixes for recent changes
* worked on encryption support
20120731
* added configure option to disable adler32 in zlib
20120730
* fixes for mingw build
* fixes for codegear build
* replaced Adler32
20120729
* code clean up
* fixes for recent changes
* preparations for replacing Adler32 calculation
* worked on Ex01 write support
20120728
* code clean up
* fixes for recent changes
* worked on Ex01 write support
* added pattern test fill functions and refactored empty block test
20120727
* code clean up
20120725
* code clean up
* added zlib.m4
* update libuuid.m4
* worked on Ex01 write support
* worked on Ex01 pattern fill read support
20120724
* fixed issue regarding pack flags not being set on initialization
* moved pack flags to write IO handle
* added compression method debug description
* moved chunk data options into flags
* worked on compression method support
20120722
* code clean up
* worked on writing Ex01 files
20120721
* code clean up
* fix in spec file
* worked on writing Ex01 files
20120719
* worked on codegear files
* changes for codegear static build of ewftools
20120718
* removed builder5 files
* fixed .so library version number
* worked on codegear files
20120717
* worked on codegear files
20120715
* fixes and improvements for recent changes
* fixes for osxfuse detection requiring FUSE_USE_VERSION
20120714
* changes for Lx01 support
20120712
* fixes and improvements for recent changes
20120711
* fixes and improvements for recent changes
20120709
* fixes and improvements for recent changes
* v1 api no longer enabled by default
20120706
* fixes and improvements for recent changes
20120705
* fixes and improvements for recent changes
20120704
* worked on Ex01 and Lx01 support
20120703
* worked on Ex01 and Lx01 support
20120702
* worked on Ex01 and Lx01 support
20120701
* changes due to updates
* code clean up in export handle
* added support for exporting EnCase 7 L01 files
* worked on Ex01 and Lx01 support
20120630
* worked on EnCase 7 and linen 7 support
* applied updates
20120629
* changes to debug output
* improved L01 support
20120603
* bug fix for MinGW in liberror
* updates for zlib-1.2.7
20120504
* bug fix for setting media size of L01 file
20120421
* small changes to dpkg files
20120416
* added fuse destroy function to ewfmount
* bug fix in libewf_utf8_string_day_of_month_copy_to_time_elements
* changes to debug output
20120414
* ewfverify: fixed printing the same segment filename multiple times for CRC errors
* worked on pyewf
* bug fix in libewf_utf16_string_month_copy_from_time_elements
* updated libuna: fix in codepage 932
20120304
* small changes to debug error output
* small changes for error tolerability
* updated libfvalue
20120225
* promoted to stable
20120213
* small changes to ewftools
* pyewf: added -avoid-version to Makefile.am
* updated macosx package maker files
20120212
* update for zlib-1.2.6
* added API functions for file entry data offset, data size and
duplicate data offset
* added file entry flags and media data value functions to ewf.net
* updated libnotify, libodraw, libfvalue, libsmraw
20120209
* small changes
20120208
* added dpkg files
20120122
* bug fix in write finalize
20120118
* updated gettext files
* updated libbfio
* preparations for beta testing