macOS
Homebrewverified · 100%
brew install libewflocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install libewfMacPorts ports tree · security/libewf/Portfile · source: api.github.com
brew
Install libewf with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper
Library for support of the Expert Witness Compression Format. Version 20140816 via Homebrew; verified from local package data.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add libewfAlpine Linux edge package indexes · libewf · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install ewf-toolsDebian stable package indexes · ewf-tools · source: deb.debian.org
Fedora dnfverified · 92%
sudo dnf install ewftoolsFedora Rawhide package metadata · ewftools · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#libewfnixpkgs package indexes · pkgs/by-name/li/libewf/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S libewfArch Linux sync databases · libewf · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install libewf-developenSUSE Tumbleweed package metadata · libewf-devel · source: download.opensuse.org
overview
Package summary
Library for support of the Expert Witness Compression Format
Project links
Commands and aliases
- ewfacquire
- ewfacquirestream
- ewfdebug
- ewfexport
- ewfinfo
- ewfmount
- ewfrecover
- ewfverify
history
Project history and usage
libewf is the libyal library and tool suite for reading, writing, acquiring, verifying, exporting, and mounting Expert Witness Compression Format evidence files. Its package-manager identity is tied to digital forensics because EWF/E01 images are common interchange artifacts between acquisition tools, forensic suites, and open-source analysis workflows.
Project history
Joachim Metz began documenting the EWF file format in March 2006, with libewf's legacy ChangeLog recording release-preparation work in April 2006. The project grew alongside a public working specification for the format, covering SMART, EnCase E01, logical evidence files, and later EWF2 variants.
The libyal repositories split the actively experimental libewf tree from a stable legacy tree. Homebrew's curation points at the legacy repository, while the project documentation and README describe the broader libewf effort.
Adoption history
EWF became important because forensic images produced by EnCase, FTK Imager, SMART, and related tools needed open readers and converters. libewf gave Unix package ecosystems a reusable C library plus tools such as ewfacquire, ewfinfo, ewfexport, ewfmount, and ewfverify.
Distribution packages under names such as libewf, ewf-tools, and ewftools made E01 handling available outside proprietary forensic workstations.
How it is used
Package users commonly install libewf for command-line acquisition and conversion, for mounting or inspecting EWF images, or as a dependency of forensic applications that need E01/S01/L01 support.
Why package nerds care
libewf is package-nerd useful because it turns a proprietary-forensics file family into a normal Unix library and set of small tools. It also carries one of the clearest public format documents for EWF, making it useful to preservation, incident response, and forensic packaging work.
Timeline
- 2006-03: Initial public EWF specification revisions for the libewf project.
- 2006-04: Legacy ChangeLog records first-release preparation and tool renames such as ewfcat to ewfexport and ewfmd5sum to ewfverify.
- 2014: Legacy ChangeLog records stabilization work and synchronization with the experimental libewf tree.
- 2026: The EWF specification document records maintenance through 2006-2026.
Related projects
- Related projects include the libyal family of forensic libraries, The Sleuth Kit integrations, EnCase, FTK Imager, and forensic package sets that ship ewf-tools.
Sources
security posture
Risk level: green
library-like package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- library-like package without higher-risk signals
Signals
- metadata:library-like
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Installs with 1 runtime dependencies.
- Build metadata lists 1 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
ewfacquire | cli | global executable | |
ewfacquirestream | cli | global executable | |
ewfdebug | cli | global executable | |
ewfexport | cli | global executable | |
ewfinfo | cli | global executable | |
ewfmount | cli | global executable | |
ewfrecover | cli | global executable | |
ewfverify | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version20140816
manager updated
local dataok
upstreamnot checked
latest detectednot detected
https://github.com/libyal/libewf-legacy
- infoNo package-manager update timestamp was available.low confidence
- infoNo cached GitHub release or tag data was available.https://github.com/libyal/libewf-legacynone confidence
install metadata
Package metadata
| Package key | brew:libewf |
|---|---|
| Version | 20140816 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/libewf |
| Homepage | https://github.com/libyal/libewf |
| Repository | https://github.com/libyal/libewf |
| Upstream docs | https://github.com/libyal/libewf#readme |
| License | LGPL-3.0-or-later |
| Source archive | https://github.com/libyal/libewf-legacy/releases/download/20140816/libewf-20140816.tar.gz |
| Dependencies | openssl@3 |
| Build dependencies | pkgconf |
| Uses from macOS | bzip2 |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | libewf |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
ewf-tools 20140816-1+b1
collection of tools for reading and writing EWF files
https://github.com/libyal/libewf-legacy
sudo apt install ewf-tools- Section: admin
- Architecture: amd64
- Source Package: libewf
- 4 dependencies
- normalized package name match
- Matched by: Libewf
Debian apt95%
libewf-dev 20140816-1+b1
support for Expert Witness Compression format (development)
https://github.com/libyal/libewf-legacy
sudo apt install libewf-dev- Section: libdevel
- Architecture: amd64
- Source Package: libewf
- 3 dependencies
- normalized package name match
- Matched by: Libewf
Debian apt95%
libewf2 20140816-1+b1
library with support for Expert Witness Compression Format
https://github.com/libyal/libewf-legacy
sudo apt install libewf2- Section: libs
- Architecture: amd64
- Source Package: libewf
- 2 dependencies
- normalized package name match
- Matched by: Libewf
Debian apt95%
python3-libewf 20140816-1+b1
support for Expert Witness Compression format -- Python 3 bindings
https://github.com/libyal/libewf-legacy
sudo apt install python3-libewf- Section: python
- Architecture: amd64
- Source Package: libewf
- 3 dependencies
- normalized package name match
- Matched by: Libewf
Nix95%
libewf
nix profile install nixpkgs#libewf- normalized package name match
- Matched by: Libewf
Ubuntu apt95%
ewf-tools 20140814-1build3
collection of tools for reading and writing EWF files
https://github.com/libyal/libewf-legacy
sudo apt install ewf-tools- Section: universe/admin
- Architecture: amd64
- Source Package: libewf
- 4 dependencies
- normalized package name match
- Matched by: Libewf
Ubuntu apt95%
libewf-dev 20140814-1build3
support for Expert Witness Compression format (development)
https://github.com/libyal/libewf-legacy
sudo apt install libewf-dev- Section: universe/libdevel
- Architecture: amd64
- Source Package: libewf
- 3 dependencies
- normalized package name match
- Matched by: Libewf
Ubuntu apt95%
libewf2 20140814-1build3
library with support for Expert Witness Compression Format
https://github.com/libyal/libewf-legacy
sudo apt install libewf2- Section: universe/libs
- Architecture: amd64
- Source Package: libewf
- 2 dependencies
- normalized package name match
- Matched by: Libewf
Ubuntu apt95%
python3-libewf 20140814-1build3
support for Expert Witness Compression format -- Python 3 bindings
https://github.com/libyal/libewf-legacy
sudo apt install python3-libewf- Section: universe/python
- Architecture: amd64
- Source Package: libewf
- 3 dependencies
- normalized package name match
- Matched by: Libewf
apk95%
libewf 20240506-r0
Library to support the Expert Witness Compression Format
https://libewf.sourceforge.net/
sudo apk add libewf- License: LGPL-2.0-or-later
- Architecture: x86_64
- Source Package: libewf
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Libewf
apk95%
libewf-dev 20240506-r0
Library to support the Expert Witness Compression Format (development files)
https://libewf.sourceforge.net/
sudo apk add libewf-dev- License: LGPL-2.0-or-later
- Architecture: x86_64
- Source Package: libewf
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Libewf
apk95%
libewf-doc 20240506-r0
Library to support the Expert Witness Compression Format (documentation)
https://libewf.sourceforge.net/
sudo apk add libewf-doc- License: LGPL-2.0-or-later
- Architecture: x86_64
- Source Package: libewf
- normalized package name match
- Matched by: Libewf
apk95%
libewf-libs 20240506-r0
Library to support the Expert Witness Compression Format (libraries)
https://libewf.sourceforge.net/
sudo apk add libewf-libs- License: LGPL-2.0-or-later
- Architecture: x86_64
- Source Package: libewf
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Libewf
dnf95%
ewftools 20140608-33.fc44
Utilities for the Expert Witness Compression Format (EWF)
http://sourceforge.net/projects/libewf/
sudo dnf install ewftools- License: LGPL-3.0-or-later
- Category: Unspecified
- Architecture: x86_64
- Source Package: libewf
- 7 dependencies
- 2 provides
- normalized package name match
- Matched by: Libewf
dnf95%
libewf 20140608-33.fc44
Library for the Expert Witness Compression Format (EWF)
http://sourceforge.net/projects/libewf/
sudo dnf install libewf- License: LGPL-3.0-or-later
- Category: Unspecified
- Architecture: i686
- Source Package: libewf
- 3 dependencies
- 2 provides
- normalized package name match
- Matched by: Libewf
dnf95%
libewf-devel 20140608-33.fc44
Development files for libewf
http://sourceforge.net/projects/libewf/
sudo dnf install libewf-devel- License: LGPL-3.0-or-later
- Category: Unspecified
- Architecture: i686
- Source Package: libewf
- 5 dependencies
- 2 provides
- normalized package name match
- Matched by: Libewf
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment