Format

Encase Image File/Expert Witness Compression File

Summary

Name

Encase Image File/Expert Witness Compression File

Identifiers

• MIME: application/encase
• PUID: fmt/803

Description

Expert Witness was the original name for EnCase, as such this format can be referred to as either Expert Witness Compression Format or Encase Image File Format. The format is used to store media images for forensic purposes. They are a type of disk image containing the contents and structure of an entire data storage device, disk volume or even a computer's physical memory. This format creates segments which have different file extensions, the first will have the extension '.e01'. this increases first numerically upto '.e99' the next extension will be '.eaa' increasing to an estimated limit of '.zzz'.

File extensions

e01

Submitted by

Digital Preservation Department / The National Archives

Relationships

Has priority over

• ISO 9660 Disk Image File

Internal signatures

Changelog

• V112

  Release date

  10 May 2023

  • Updated

    Encase Image File/Expert Witness Compression File: Updated name, added priority over ISO 9660 Disk Image File. Submitted by Brigham Young University.

• V97

  Release date

  1 October 2020

  • Updated

    Encase Image File Format/Expert Witness Compression Format: Media type added. Submitted by The University of North Carolina at Charlotte.

• V83

  Release date

  17 December 2015

  • Added format

    Encase Image File Format/Expert Witness Compression Format: Full entry added.

  • Added signature

    Encase Image File Format/Expert Witness Compression Format: Signature developed through PRONOM Research.