Metadata-Version: 2.1
Name: py-ewf-mount
Version: 1.0.0
Summary: A cli wrapper script to mount EWF files.
Home-page: https://github.com/wahlflo/pyEWFmount
Author: Florian Wahl
Author-email: florian.wahl.developer@gmail.com
License: UNKNOWN
Platform: UNKNOWN
Classifier: Programming Language :: Python :: 3
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: Unix
Description-Content-Type: text/markdown
Requires-Dist: cli-formatter

# pyEWFmount
A python cli wrapper script for mounting ewf files

## Installation

### Install requirement ewfmount
Install libewf with pacman:
```
sudo pacman -S libewf
```
or ewf-tools with apt:
```
sudo apt install ewf-tools
```

### Install requirement dislocker:
Install dislocker from GitHub:
```
git clone https://github.com/Aorimn/dislocker
cd dislocker
cmake .
make dislocker-fuse;
sudo make install
```


### Install pyEWFmount
```
pip3 install py_ewf_mount
```

## Usage
Type ```pyEWFmount --help``` or ```pyMountEWF --help``` to view the help.
```
pyEWFmount by Florian Wahl, 03.08.2020

usage: pyMountEWF [-h] [-i INPUT] [-o OUTPUT]

optional arguments:
  -h, --help            show this help message and exit
  -i INPUT, --input INPUT
                        path to a EWF file which should be mounted
  -o OUTPUT, --output OUTPUT
                        Specify the name of the mounted directory (default: /mnt/YYYY.MM.DD_hh.mm)
```

## Example
```
$ sudo pyMountEWF -i forensic_image.E01
pyEWFmount by Florian Wahl, 02.08.2020

[+] ewf file mounted to "/mnt/2020.08.03_18.49/.ewf"
[+] Select Partition to mount:
Disk /dev/loop6: 1011 MiB, 1060110336 bytes, 2070528 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x24677b2d

Device       Boot Start     End Sectors  Size Id Type
/dev/loop6p1       2048 2070527 2068480 1010M  7 HPFS/NTFS/exFAT

select number of partition (0 for complete disk) [1] >
[+] selected partition "/dev/loop6p1"
Bitlocker Recovery Key (if encrypted otherwise empty) > 493625-443036-224400-065417-708741-624547-702218-359777
Mount in readonly mode (y/n) [y]: y
Mount as NTFS filesystem (y/n) [y]: y
[+] Partition 1 was mounted under "/mnt/2020.08.03_18.49/partition_1_decrypted"

Press ENTER to mount another partition
```

