Acquire a Stream into an EWF Evidence Image

The source is a live stream, not a device you can point a tool at directly, and ewfacquirestream is built for exactly that. It reads stdin and writes an E01 evidence image, with metadata on the command line and a hash you can verify with ewfinfo. The examples use the installed ewf-tools package, version 20140814-1build3, whose program reports version 20140814.

Allow about fifteen minutes for a small test, plus the time needed to read the real source. You need ewfacquirestream, ewfinfo, enough storage for the output, and a byte stream you are authorised to acquire. The examples use printf first, so you can check the workflow without touching a disk.

Safety checkpoint: An acquisition can create a large, forensically significant file. Confirm the input, target directory, available storage, case details and access permissions before using a real source. Do not experiment against a device when a regular test file will do. The command normally needs no elevated privilege, but reading a protected device may require the privilege granted by your operating procedure. Review the exact command before adding sudo.

1. Check the installed tools

Confirm which binaries will run and record the package version. These are ordinary read-only checks:

$ command -v ewfacquirestream
/usr/bin/ewfacquirestream
$ command -v ewfinfo
/usr/bin/ewfinfo
$ ewfacquirestream -V
ewfacquirestream 20140814
$ dpkg-query -W -f='${Package} ${Version}\n' ewf-tools
ewf-tools 20140814-1build3

Keep this version information with the case record. The local manpage describes the legacy libewf interface, and the installed output is the contract to follow on this machine.

2. Choose a target and metadata

The -t option takes a target name without an extension. With the default format, the command adds .E01. Metadata options include -C for the case number, -D for the description, -E for the evidence number, -e for the examiner, and -N for notes.

Make the target unique. Do not point it at an existing evidence image unless your procedure explicitly permits replacement. A collision or a mistaken path can turn a simple command into a difficult evidence-handling problem.

$ target=/var/tmp/CASE-2026-001-stream
$ log_file=/var/tmp/CASE-2026-001-stream.log
$ case_number='CASE-2026-001'
$ evidence_number='1'
$ examiner='Examiner Name'

These assignments change only shell variables. Replace every placeholder, and check that the destination filesystem has enough free space before starting.

3. Run a harmless smoke test

First prove the pipeline with known input. The -B option limits the number of bytes acquired; it is useful for a bounded test and for a source where the required acquisition length is known. The command below writes fifteen bytes and sends acquisition errors and the digest to a log:

$ printf 'sample evidence\n' | ewfacquirestream \
    -B 15 \
    -C 'GUIDE-CASE' \
    -D 'stdin test' \
    -E '1' \
    -e 'Guide Test' \
    -N 'local smoke test' \
    -l /tmp/ewfacquirestream-guide.log \
    -t /tmp/ewfacquirestream-guide
ewfacquirestream 20140814
...
Written: 1.3 KiB (1332 bytes) in 0 second(s).
MD5 hash calculated over data: 60a87536cf3513461d696ed3959e489c
ewfacquirestream: SUCCESS

The number of bytes written to the EWF container is larger than the input because it includes format metadata. The useful success signals are the final status, the zero shell exit status, and the recorded hash. Output formatting and timing vary with the host.

Checkpoint: Confirm that the target exists before moving to real input:

$ printf 'exit status: %s\n' "$?"
exit status: 0
$ ls -lh /tmp/ewfacquirestream-guide.E01 /tmp/ewfacquirestream-guide.log
-rw-r--r-- 1 user user 3.5K ... /tmp/ewfacquirestream-guide.E01
-rw-r--r-- 1 user user   65 ... /tmp/ewfacquirestream-guide.log

4. Acquire a bounded stream

Once the smoke test works, replace the producer with the approved source. For a regular file, this might be a previously prepared stream:

$ input=/path/to/approved-source.bin
$ target=/path/to/CASE-2026-001.EWF
$ printf '%s\n' 'Review the input and target paths above before continuing.'
$ cat -- "$input" | ewfacquirestream \
    -B 1048576 \
    -C 'CASE-2026-001' \
    -D 'Approved source stream' \
    -E '1' \
    -e 'Examiner Name' \
    -N 'Captured from approved source' \
    -l /path/to/CASE-2026-001.log \
    -t /path/to/CASE-2026-001

The target in this example is still supplied without .E01; the format determines the segment suffix. The input is read from stdin, not as a positional argument. Do not put the source path after ewfacquirestream and expect it to be opened automatically.

If the whole input should be acquired, omit -B. The manpage says the command reads stdin until a read error. That is not the same as a clean end-of-file in every failure scenario, so monitor the producer and retain its exit status where your acquisition procedure requires it.

5. Select format, compression and hashing deliberately

The default output is EnCase 6, written as .E01, with deflate compression and no compression level. The -f option supports several EWF formats, including encase6 and ewfx; streamed writes are not supported for every listed format. Use the format required by the receiving tool, not one chosen by guesswork.

Use -c only when the receiving workflow has a defined compression requirement. Its value is a level or method:level, with methods such as deflate; bzip2 is supported only by EWF2 formats. The documented levels include none, empty-block, fast and best.

MD5 is calculated by the program. Add -d sha1 or -d sha256 when the case procedure requires an additional digest. Do not describe an additional digest as replacing the default MD5; it is calculated alongside it.

6. Verify the image and metadata

Run ewfinfo against the first segment. This is a read-only verification step and does not need elevated privileges:

$ ewfinfo /tmp/ewfacquirestream-guide.E01
ewfinfo 20140814

Acquiry information
        Case number:           GUIDE-CASE
        Description:           stdin test
        Examiner name:         Guide Test
        Evidence number:       1
        Notes:                  local smoke test
        Software version used: 20140814

EWF information
        File format:           EnCase 6
        Compression method:    deflate

Digest hash information
        MD5:                   60a87536cf3513461d696ed3959e489c

Compare the case number, description, examiner, evidence number, notes, format, compression and digest with your acquisition record. The exact spacing, dates and media-size display depend on the input and host.

If verification fails, stop. Preserve the output and log according to your evidence procedure, record the command and error, and do not silently rerun over the same target. For a new attempt, choose a new target and document why it is a separate acquisition. There is no undo operation that makes a bad or incomplete image evidentially sound.

7. Avoid the common traps

Most of the ways this goes wrong are boring, which is exactly why they catch people out.

Wrong direction: the command reads stdin. Check the pipeline with printf before using a device or another process.
Wrong target: -t is a basename, not a complete extension-bearing filename. List the resulting segment and check its size.
Unbounded test: without -B, the stream continues until the input ends or a read error occurs. Use a byte limit for a controlled smoke test.
False success: a printed progress message is not enough. Check the command exit status, the target, the log and ewfinfo.
Metadata drift: case details are part of the image record. Copy them from the case system and check spelling before acquisition.
Unnecessary privilege: do not use sudo for the ordinary tool and verification commands. Add it only where access to the approved source genuinely requires it.

Done means

The installed ewfacquirestream and ewf-tools versions are recorded.
The source was reviewed, the target was unique, and the storage location was checked.
The stream was acquired with the intended byte limit, format and metadata.
The exit status, output segment and acquisition log were retained.
ewfinfo confirmed the metadata, format and digest.
Any failed attempt was preserved and documented rather than overwritten.