Expert Witness - Revision history

Anonymoususer852: /* Software */ Update links for (Exterro) FTK Imager.

2025-08-16T05:06:17Z

‎Software: Update links for (Exterro) FTK Imager.

Anonymoususer852: Typo fix; Encase → EnCase

2025-08-16T03:38:13Z

Typo fix; Encase → EnCase

Dan Tobias at 23:33, 1 October 2020

2020-10-01T23:33:57Z

Thorsted: Created page with "{{FormatInfo |formattype=electronic |subcat=Disk Image Formats |extensions={{ext|e01}} |pronom={{PRONOM|fmt/803}} |wikidata={{wikidata|Q50339410}} |locfdd={{LoCFDD|fdd000408}}..."

2020-10-01T22:34:54Z

Created page with "{{FormatInfo |formattype=electronic |subcat=Disk Image Formats |extensions={{ext|e01}} |pronom={{PRONOM|fmt/803}} |wikidata={{wikidata|Q50339410}} |locfdd={{LoCFDD|fdd000408}}..."

New page

{{FormatInfo
|formattype=electronic
|subcat=Disk Image Formats
|extensions={{ext|e01}}
|pronom={{PRONOM|fmt/803}}
|wikidata={{wikidata|Q50339410}}
|locfdd={{LoCFDD|fdd000408}}
}}
The Encase Image File Format or Expert Witness Disk Image format is a forensic disk image which includes evidentiary metadata.<ref>https://en.wikipedia.org/wiki/EnCase#Expert_Witness_File_Format</ref> The file format includes a "case info" header.<ref>https://www.forensicsware.com/blog/e01-file-format.html#:~:text=The%20E01%20(Encase%20Image%20File,of%20the%20data%20is%20produced.</ref>

The EWF format has been reversed engineered.<ref>https://github.com/libyal/libewf/blob/master/documentation/Expert%20Witness%20Compression%20Format%20%28EWF%29.asciidoc</ref>

==Software==
* [https://accessdata.com/products-services/forensic-toolkit-ftk/ftkimager FTK Imager]

== References ==
<references/>

← Older revision		Revision as of 23:33, 1 October 2020
Line 16:		Line 16:
	== References ==		== References ==
	<references/>		<references/>
		+
		+	[[Category:Forensics and Law Enforcement]]

@@ Line 11: / Line 11: @@
 The EWF format has been reversed engineered.<ref>https://github.com/libyal/libewf/blob/master/documentation/Expert%20Witness%20Compression%20Format%20%28EWF%29.asciidoc</ref>
-==Software==
+== Software ==
-* [https://accessdata.com/products-services/forensic-toolkit-ftk/ftkimager FTK Imager]
+* [https://www.exterro.com/digital-forensics-software/ftk-imager Exterro FTK Imager]
 == References ==

@@ Line 7: / Line 7: @@
 |locfdd={{LoCFDD|fdd000408}}
 }}
-The Encase Image File Format or Expert Witness Disk Image format is a forensic disk image which includes evidentiary metadata.<ref>https://en.wikipedia.org/wiki/EnCase#Expert_Witness_File_Format</ref> The file format includes a "case info" header.<ref>https://www.forensicsware.com/blog/e01-file-format.html#:~:text=The%20E01%20(Encase%20Image%20File,of%20the%20data%20is%20produced.</ref>
+The EnCase Image File Format or Expert Witness Disk Image format is a forensic disk image which includes evidentiary metadata.<ref>https://en.wikipedia.org/wiki/EnCase#Expert_Witness_File_Format</ref> The file format includes a "case info" header.<ref>https://www.forensicsware.com/blog/e01-file-format.html#:~:text=The%20E01%20(Encase%20Image%20File,of%20the%20data%20is%20produced.</ref>
 The EWF format has been reversed engineered.<ref>https://github.com/libyal/libewf/blob/master/documentation/Expert%20Witness%20Compression%20Format%20%28EWF%29.asciidoc</ref>