Supported Formats¶
The information below is based of version 20200920
Storage media types¶
EWF (EWF-E01, EWF-Ex01, EWF-S01) (Requires: libewf/pyewf)
QCOW version 1, 2, 3 (Requires: libqcow/pyqcow)
currently no differential image support
Storage Media device (Requires: libsmdev/pysmdev)
(split) Storage Media RAW (Requires: libsmraw/pysmraw)
VHD and VHDX (Requires: libvhdi/pyvhdi)
VMDK (Requires: libvmdk/pyvmdk)
currently no differential image support
Volume systems¶
Apple File System (APFS) container version 2 (Requires: libfsapfs/pyfsapfs)
BitLocker Disk Encryption (BDE) (Requires: libbde/pybde)
FileVault Disk Encryption (FVDE) (or FileVault 2) (Requires: libfvde/pyfvde)
LVM (Requires: libvslvm/pyvslvm)
At the moment only single physical volume LVM support
Volume Shadow Snapshots (VSS) (Requires: libvshadow/pyvshadow)
File systems¶
Apple File System (APFS) version 2 (Requires: libfsapfs/pyfsapfs)
ext version 2, 3, 4 (Requires: libfsext/pyfsext or libtsk/pytsk)
HFS+, HFSX (Requires: libfshfs/pyfshfs or Requires: libtsk/pytsk)
NTFS version 3 (Requires: libfsntfs/pyfsntfs or libtsk/pytsk)
XFS version 4, 5 (Requires: libfsxfs/pyfsxfs)
TODO add more detail here regarding FAT and other supported FS
Compressed stream file types¶
bzip2
gzip
lzma
xz
zlib (both zlib-DEFLATE and raw-DEFLATE)
Encoded stream file types¶
base16
base32
base64
Encrypted stream file types¶
AES-CBC, AES-CFB, AES-ECB, AES-OFB (Requires: Cryptography.io)
Blowfish (Requires: Cryptography.io)
DES3 (Requires: Cryptography.io)
RC4 (Requires: Cryptography.io)
Archive file types¶
cpio
tar
zip
Other file types¶
blob stored in SQlite