This is a GUI (for Windows 64 bit) for a procedure to virtualize your EWF(E01), DD (raw), AFF disk image file without converting it, directly with VirtualBox, forensically proof.
-
Updated
Oct 15, 2019 - Pascal
#
ewf
Here are 17 public repositories matching this topic...
⤳ Moved to SecurityRonin/ewf-forensic — EWF/E01 reader, now the core/ member there. Crate 'ewf' still published.
-
Updated
Jul 11, 2026 - Rust
🕵️♂️ Unlock the story hidden in data - Your digital investigation partner. TheSleuthKit (TSK) Python Wrapper.
python wrapper analysis python3 forensics dfir python-wrapper disk-image image-forensics python-security sleuthkit tsk forensic regripper ewf dfir-automation disk-forensics image-forensic forensic-software thesleuthkit
-
Updated
Mar 20, 2025 - Python
SwiftBeaver is a high-speed file and artefact carver written in Rust that recovers files (JPEG, PNG, PDF, ZIP, SQLite, MP4, and many more) and Windows artefacts from raw and E01 disk images. It emphasizes reproducibility, read-only evidence handling, and rich JSONL/CSV/Parquet metadata, with optional OpenCL/CUDA acceleration.
-
Updated
May 13, 2026 - Rust
-
Updated
Sep 1, 2026 - Shell
Real-world guides for wrapping forensic disk image libraries into Swift Packages on macOS. Built on Apple Silicon, errors and all.
x86-64 forensics arm64 vhd digital-forensics static-library vmdk cross-compilation ewf universal-binary libewf aff4 forensic-imaging raw-dd libaff4 c-aff4
-
Updated
May 17, 2026
ZFF review
rust security compression disk container forensics partition acquisition imaging preservation evidence e01 ewf fuse3 zff
-
Updated
Nov 4, 2025 - PowerShell
Forensic imager in Rust with FTK Imager-compatible output — bit-for-bit E01/raw acquisition, targeted logical collection, read-back verification of image and source, resume.
-
Updated
Aug 29, 2026 - Rust
Swift Package for mounting forensic and general-purpose disk images on macOS.
macos swift fuse swift-package-manager forensics disk-image spm vhd vmdk hdiutil ewf forensic-tools disk-forensics aff4
-
Updated
Aug 18, 2026 - Swift
Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileSystemOpen — with recursive PathSpec locators. The contract crate every fleet reader implements.
rust encryption filesystem incident-response forensics dfir archive vfs disk-image ntfs digital-forensics luks bitlocker apfs e01 ewf
-
Updated
Aug 24, 2026 - Rust
A Swift Package (SPM) that wraps [libewf](https://github.com/libyal/libewf) by Joachim Metz as a universal static library for reading Expert Witness Format (EWF / EnCase) forensic disk images on macOS, with bundled mount and info tools.
-
Updated
Aug 5, 2026 - C
Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
-
Updated
Aug 20, 2026 - Rust
SUPERSEDED — merged into sltcnb/MemoryLane, which is now the Rust implementation and a strict superset of this repo.
-
Updated
Aug 31, 2026 - Rust
Add this topic to your repo
To associate your repository with the ewf topic, visit your repo's landing page and select "manage topics."