Format

Encase Image File/Expert Witness Compression File

Summary

Name

Encase Image File/Expert Witness Compression File

Identifiers

• MIME: application/encase
• PUID: fmt/803

Description

Expert Witness was the original name for EnCase, as such this format can be referred to as either Expert Witness Compression Format or Encase Image File Format. The format is used to store media images for forensic purposes. They are a type of disk image containing the contents and structure of an entire data storage device, disk volume or even a computer's physical memory. This format creates segments which have different file extensions, the first will have the extension '.e01'. this increases first numerically upto '.e99' the next extension will be '.eaa' increasing to an estimated limit of '.zzz'.

File extensions

e01

Source

Digital Preservation Department / The National Archives

Relationships

Has priority over

• ISO 9660 Disk Image File

Internal signatures

Changelog

• Updated in V112

  Release date

  10 May 2023

  Encase Image File/Expert Witness Compression File: Updated name, added priority over ISO 9660 Disk Image File. Submitted by Brigham Young University.

• Updated in V97

  Release date

  1 October 2020

  Encase Image File Format/Expert Witness Compression Format: Media type added. Submitted by The University of North Carolina at Charlotte.

• Added in V83

  Release date

  17 December 2015

  Encase Image File Format/Expert Witness Compression Format: Signature developed through PRONOM Research.

  Encase Image File Format/Expert Witness Compression Format: Full entry added.