E01 (EnCase Evidence) Image Format.

A forensic disk image format originally introduced by Guidance Software for EnCase, storing acquired data in compressed, segmented files with embedded metadata and checksums. It belongs to the Forensics & IR category of cybersecurity.

A forensic disk image format originally introduced by Guidance Software for EnCase, storing acquired data in compressed, segmented files with embedded metadata and checksums.

E01, also called the Expert Witness Compression Format (EWF), is the de facto standard container for forensic disk images on Windows-centric DFIR workflows. Created by Guidance Software (now OpenText) for EnCase, it stores the bit-for-bit copy of a source drive in one or more numbered segments (E01, E02, ...) together with case metadata, examiner name, hash values (MD5/SHA-1) and per-block CRCs that detect tampering. The format supports compression and is read by virtually every commercial and open-source forensic suite, including FTK, X-Ways, Autopsy and libewf-based tools. Investigators favour E01 when chain-of-custody, integrity verification and tool interoperability are required.

Defences for E01 (EnCase Evidence) Image Format typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: EWF, Expert Witness Format, EnCase image.