Recover a Corrupt EWF Image with ewfrecover

You will finish with a recovered output file from an Expert Witness Compression Format (EWF) image, plus a recorded digest and a clear result showing whether the source was actually damaged. The examples use the installed ewfrecover from the ewf-tools package. This machine reports version 20140814.

Allow about fifteen minutes for preparation, with the recovery itself taking longer for a large image. You need read access to every EWF segment, enough free space for the recovered target, and a shell. Recovery writes a new target. It does not repair the source segments in place.

1. Check the installed command

Confirm the binary and version before relying on examples. This is an ordinary, read-only check and does not need elevated privileges:

$ command -v ewfrecover
/usr/bin/ewfrecover
$ ewfrecover -V
ewfrecover 20140814

Copyright (C) 2006-2021, Joachim Metz.

The local manual describes ewfrecover as a utility for recovering corrupt EWF files. Its input argument is the first segment or the entire set of segment files. The command can ask for information interactively, so keep the terminal available while it runs.

Checkpoint: if command -v finds nothing, stop and install or enable the package through your normal system administration process. Do not copy a different binary into the working directory and assume it has the same behaviour.

2. Prepare a safe working directory

Make a destination directory on storage with enough capacity for the recovered data and its log. The following changes local filesystem state, but does not touch the evidence:

$ mkdir -p /srv/ewf-recovery/case-001
$ cd /srv/ewf-recovery/case-001
$ df -h .

Copying or moving evidence is outside this command's job. Keep the original EWF segments read-only if your evidence-handling procedure requires that, and work from a verified copy when policy permits. Never use the same path for the source and recovered target.

Checkpoint: you should be able to name the first segment, for example /evidence/case-001/image.E01, and a separate target path such as /srv/ewf-recovery/case-001/recovered.raw. The names are placeholders; replace them with paths that exist on your host.

3. Recover the image

Run the command with the first EWF segment as its input. The -t option sets the recovered target instead of the default target name, recover. The -l option records recovery errors and the digest in a separate log:

$ ewfrecover \
    -t /srv/ewf-recovery/case-001/recovered.raw \
    -l /srv/ewf-recovery/case-001/ewfrecover.log \
    /evidence/case-001/image.E01

The command prints progress and may say that the operation could take a while. Let it finish. Do not interrupt it merely because output pauses while a large section is processed. A normal successful run ends with an MD5 digest over the recovered data and a success message similar to:

MD5 hash calculated over data:    d41d8cd98f00b204e9800998ecf8427e
ewfrecover: SUCCESS

The exact digest, timestamps and progress output will differ. Check the exit status and output files immediately after the command returns:

$ printf 'exit status: %s\n' "$?"
exit status: 0
$ ls -lh /srv/ewf-recovery/case-001/recovered.raw /srv/ewf-recovery/case-001/ewfrecover.log

Exit status 0 and a success line are the useful completion signals. Keep the log with the case record. If the target already exists, stop and inspect it before retrying. Choosing a new target is safer than silently overwriting a result.

4. Handle an image that is not corrupt

A clean source is not a failed recovery. Run the same command against a non-corrupt image and the tool may report:

EWF file(s) are not corrupted.

The wording and prefix can vary with the build, so rely on the command's actual output and exit status. Record that the source was checked and reported clean. Do not treat the absence of a new target as permission to delete the original evidence.

5. Investigate a failed run

If the command reports errors, retain the terminal output and inspect the log named with -l. Recheck the first segment path, all segment files, permissions, available space and the target filesystem. A missing later segment can make an apparently valid first filename unusable.

For more diagnostic output, add -v. Verbose and debug messages are written to standard error when enabled by the build:

$ ewfrecover -v \
    -t /srv/ewf-recovery/case-001/recovered-debug.raw \
    -l /srv/ewf-recovery/case-001/ewfrecover-debug.log \
    /evidence/case-001/image.E01

Use a fresh target for this retry. The -x option selects chunk data rather than the buffered read and write functions, and -p changes the process buffer size from its default of the chunk size. Leave both at their defaults unless the local recovery procedure gives you a reason to change them.

6. Understand the other input option

The -A option selects the codepage for the header section. ASCII is the default; the manual also lists Windows codepages including 874, 932, 936, 949, 950 and 1250 through 1258. Change it only when the image's header metadata requires a different interpretation. It does not repair damaged data.

Some recoveries may ask for information interactively. Answer from the case record, not from guesses. If you need to stop, use the shell's normal interrupt handling and preserve the partial target separately; there is no command in this tool that rolls back a partial output. Remove an unwanted partial file only after confirming its path and recording that it is disposable.