Add EWF evidence type(s)

Open aarontp opened this issue 6 years ago • 2 comments

We should add a new evidence type for EWF along with pre/post-processors that know how to create a loop device and mount them so that other Tasks besides Plaso can also process them.

Apr 17 '19 00:04 aarontp

FYI EWF can be multiple evidence types: disk, memory, optical, logical

Apr 17 '19 01:04 joachimmetz

Yeah, the intention here would be to support just the E01 disk format to start.

Apr 17 '19 04:04 aarontp

Fixed by https://github.com/google/turbinia/pull/1112

Aug 17 '22 20:08 aarontp