diff --git a/app-forensics/libewf/Manifest b/app-forensics/libewf/Manifest
new file mode 100644
index 0000000..0bb9768
--- /dev/null
+++ b/app-forensics/libewf/Manifest
@@ -0,0 +1,3 @@
+DIST libewf-experimental-20171104.tar.gz 2243405 BLAKE2B 86e69eba5313dadbfe2cc63639e96cf964b5d72e3c98299c0262547b2d900b7a8a4a5938435bdafac3890ee05ea0079ef68809086234ff486c985d557d2c4897 SHA512 610174971b8e09385f1f51c02e7be36e7a18d21f8b22ddeb7ba7d5c20e7df97591a70de3523b2d63bed8deb5a2a170a14e825f6a80aeb0937553ecae5925ee0b
+EBUILD libewf-20171104.ebuild 1371 BLAKE2B 835af206cc9caff062fb27c23ac8842dbc990dfbeacb753e4a72d0e89546f6cc96f297d5240c46e314ce4ccce99e86fd71c0d1e9ae0c6a18779fc0da46229d85 SHA512 443e456f3d8e01cefb2daab260ce02979fb9b01bcca4aee1da82d9d54894e3c426ebf21d1da8cfbe5f1339259a5b9962ddf0c026cb31a776b3d84c6bf9e49477
+MISC metadata.xml 592 BLAKE2B df867eebad382402c6ab30afef7b720828f1c86dcfb33a6c4136c4e926631575ae7c608990e8a5c77ff58436a0b1209e0622b22bbba81f415ee7230a298bbc17 SHA512 38e687f6fd838bb2cc389db59176f6cdf80aa8a4bf6376f0ba675735588806958acbc7ca9da9f38da198f065b2ed250d27ea1c7821ef4075b19c5175bbe2947d
diff --git a/app-forensics/libewf/libewf-20171104.ebuild b/app-forensics/libewf/libewf-20171104.ebuild
new file mode 100644
index 0000000..8269e43
--- /dev/null
+++ b/app-forensics/libewf/libewf-20171104.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+AUTOTOOLS_AUTORECONF=1
+AUTOTOOLS_IN_SOURCE_BUILD=1
+inherit eutils
+
+DESCRIPTION="Implementation of the EWF (SMART and EnCase) image format"
+HOMEPAGE="https://github.com/libyal/libewf"
+SRC_URI="https://github.com/libyal/libewf/releases/download/${PV}/libewf-experimental-${PV}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0/2"
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+# upstream bug #2597171, pyewf has implicit declarations
+#IUSE="debug python unicode"
+IUSE="bfio debug ewf +fuse +ssl static-libs +uuid unicode zlib"
+
+DEPEND="
+	sys-libs/zlib
+	bfio? ( =app-forensics/libbfio-0.0.20120425_alpha )
+	fuse? ( sys-fs/fuse:= )
+	uuid? ( sys-apps/util-linux )
+	ssl? ( dev-libs/openssl:0= )
+	zlib? ( sys-libs/zlib )"
+RDEPEND="${DEPEND}"
+
+DOCS=( AUTHORS ChangeLog NEWS README documents/header.txt documents/header2.txt )
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable debug debug-output)
+		$(use_enable debug verbose-output)
+		$(use_enable ewf v1-api)
+		$(use_enable unicode wide-character-type)
+		$(use_with zlib)
+		# autodetects bzip2 but does not use
+		--without-bzip2
+		$(use_with bfio libbfio)
+		$(use_with ssl openssl)
+		$(use_with uuid libuuid)
+		$(use_with fuse libfuse)
+	)
+	autotools_src_configure
+}
+
+src_install() {
+	autotools_src_install
+	doman manuals/*.1 manuals/*.3
+}
diff --git a/app-forensics/libewf/metadata.xml b/app-forensics/libewf/metadata.xml
new file mode 100644
index 0000000..5ab6ff4
--- /dev/null
+++ b/app-forensics/libewf/metadata.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>canutethegreat@gmail.com</email>
+		<name>Ronald Farrer</name>
+	</maintainer>
+	<use>
+		<flag name="bfio">Enables libbfio for chaining file in file handling</flag>
+		<flag name="ewf">Enables the v1 API</flag>
+		<flag name="fuse">Enable fuse support for ewfmount</flag>
+		<flag name="uuid">Enable UUID support in the ewftools</flag>
+	</use>
+	<upstream>
+		<remote-id type="github">libyal/libewf</remote-id>
+	</upstream>
+</pkgmetadata>