Sustainability of Digital Formats: Planning for Library of Congress Collections

Introduction | Sustainability Factors | Content Categories | Format Descriptions | Contact
Format Description Categories >> Browse Alphabetical List

Expert Witness Disk Image, EnCase L01 Logical

>> Back
Table of Contents
Format Description Properties Explanation of format description terms

Identification and description Explanation of format description terms

Full name Expert Witness Compression Format, EnCase L01 Logical
Description

First version of the EWF logical evidence file image format from Guidance Software (EnCase brand), generally similar to the description offered in EWF_Family. This and the counterpart EWF_E01 format offer three levels of compression: "no," "good," and "best."

EWF_L01 files contain 13 sections; the first four are carried over from EWF_SMART; the next nine are shared with EWF_E01; and the final two are new additions:

  • Header section
  • Volume section
  • Table section
  • Next and Done section
  • Header2 section
  • Disk section
  • Sectors section
  • Table2 section
  • Data section
  • Errors2 section
  • Session section
  • Hash section
  • Digest section
  • Ltree section
  • Ltypes section
Production phase Typically used for data analysis and not part of a process to create new content. May be used to archive data.
Relationship to other formats
    Subtype of EWF_Family, Expert Witness Format (EWF) Family
    Has later version EWF_Lx01, Expert Witness Format, Encase Lx01 Logical

Local use Explanation of format description terms

LC experience or existing holdings  
LC preference  

Sustainability factors Explanation of format description terms

Disclosure Open documentation produced via reverse engineering by Joachim Metz.
    Documentation EWF specification: Expert Witness Compression Format specification
Adoption In archives (as distinct from legal and law enforcement settings), where tools like Bit Curator and FTK Imager are in wide use, user comments suggest that bitstream formats like EWF_E01 and AFF (description forthcoming) are more widely used than logical formats like EWF_L01.
    Licensing and patents Not investigated at this writing.
Transparency See EWF_family
Self-documentation See EWF_family
External dependencies None
Technical protection considerations See EWF_family

Quality and functionality factors Explanation of format description terms


File type signifiers and format identifiers Explanation of format description terms

Tag Value Note
Filename extension L01
Filename extensions for the first 99 content segments are .L01, .L02, through .L99; followed by .LAA, .LAB, and so on.
Magic numbers Hex: 4C 56 46 09 0D 0A FF 00
ASCII: LVF...ΓΏ.
From Gary Kessler's File Signatures Table.
Pronom PUID fmt/804
 

Notes Explanation of format description terms

General

Joachim Metz's analysis highlights the details of this format, including variation in the structure of .L01 headers, in part depending on the version of the EnCase tool used to create the file (pp. 5-15, esp. p. 8-9 and 15), and variations in the volume section according to the creating application (pp. 18-20).

History  

Format specifications Explanation of format description terms


Useful references

URLs


Last Updated: 07/27/2017