Wednesday, October 3, 2012

Libewf Installation

I ran into a few issues installing the latest libewf release (libewf-experimental-20120809.tar.gz) yesterday on a fresh Ubuntu 11.04 x64 VM. Before you say anything, yes I know that 12.04 is the latest Ubuntu release, however Log2Timeline does not official support it yet (according to and trying to fix all the dependencies by hand sucks - BAD.

If you are download the latest version of libewf and try to do a simple ./configure, make, make install, you may be greeted with the following message when you go to use ewfmount:
Unable to open EWF file(s).
libewf_decompress_data: missing support for deflate compression
libewf_section_compressed_string_read: unable to decompress string.
libewf_handle_open_read_section_data: unable to read header file object string.
libewf_handle_open_read_segment_files: unable to read section data from segment file: 1.
libewf_handle_open_file_io_pool: unable to read segment files.
libewf_handle_open: unable to open handle using a file IO pool.
I exchanged e-mails with the project's developer who responded in less than 12 hours and suggested I check  the output of .configure for missing packages (apologies in advance if this is obvious knowledge). I found it was missing multiple:
ADLER32 checksum support:                       NO
DEFLATE compression support:                    NO
BZIP2 compression support:                      NO
FUSE support:                                   NO
Well, the FUSE one is obvious - Joachim clearly states in his documentation that it's required ( The other three are not so obvious.

Running the following should resolve those dependencies:
apt-get update
apt-get install zlib1g-dev
apt-get install libbz2-dev
apt-get install libfuse-dev
The last line may be unnecessary. After this, you should be able to navigate to your unTARed libewf directory and perform a ./configure, make, make install (followed by ldconfig or you will receive messages about a missing dependancy!) and begin mounting E01s.

Again this may be common knowledge but I hope this helps some other investigators out there.

Happy forensicating!


  1. Umm... what'cha got to say 'bout Ubuntu?!

  2. This comment has been removed by the author.