Library and tooling to access the Windows XML Event Log (EVTX) format. For the Windows pre-XML Event Log (EVT) format see: libevt

libewf is a library for support of the Expert Witness Compression Format (EWF). libewf allows you to read media information of EWF files in the SMART (EWF-S01)format and the EnCase (EWF-E01) format. libewf allows to read files created by EnCase 1 to 6, linen and FTK Imager

Library to provide generic file data cache functions for the libyal family of libraries.

Library to provide generic file data functions for the libyal family of libraries.

A library for date and time data types.

A library for GUID/UUID data types.

libfole is a library for Object Linking and Embedding (OLE) data types.

Part of the libyal family of libraries.

libfsapfs is a library to access the Apple File System (APFS).

Project information:

* Status: experimental
* Licence: LGPLv3+

Read-only supported APFS formats:

* version 2

Supported APFS format features:

* ZLIB (DEFLATE) compression
* LZVN compression
* encryption

Unsupported APFS format features:

* APFS version 1
* Fusion drive (NX_INCOMPAT_FUSION)
* snapshots
* LZFSE compression, compression methods 11 and 12
* "uncompressed", compression methods 1, 9 and 10
* T2 encryption

Library and tools to access the New Technology File System (NTFS).

Note that this project currently only focuses on the analysis of the format.

Library to access the Windows Shell Item format for the libyal family of libraries.
libyal is typically used in digital forensic tools.

A library to support various Hash-based Message Authentication Codes
(HMAC).

Library to access the Windows Shortcut File (LNK) Format files.

Library and tooling to access the QEMU Copy-On-Write (QCOW) image format.