<?xml version="1.0" encoding="utf-8"?>
<PRONOM-Report xmlns="http://pronom.nationalarchives.gov.uk">
  <report_format_detail>
    <FileFormat>
      <FormatID>1603</FormatID>
      <FormatName>Encase Image File/Expert Witness Compression File</FormatName>
      <FormatVersion>
      </FormatVersion>
      <FormatAliases>
      </FormatAliases>
      <FormatFamilies>
      </FormatFamilies>
      <FormatTypes>
      </FormatTypes>
      <FormatDisclosure>
      </FormatDisclosure>
      <FormatDescription>Expert Witness was the original name for EnCase, as such this format can be referred to as either Expert Witness Compression Format or Encase Image File Format. 
The format is used to store media images for forensic purposes. They are a type of disk image containing the contents and structure of an entire data storage device, disk volume or even a computer's physical memory. This format creates segments which have different file extensions, the first will have the extension '.e01'. this increases first numerically upto '.e99' the next extension will be '.eaa' increasing to an estimated limit of '.zzz'.</FormatDescription>
      <BinaryFileFormat>
      </BinaryFileFormat>
      <ByteOrders>
      </ByteOrders>
      <ReleaseDate>
      </ReleaseDate>
      <WithdrawnDate>
      </WithdrawnDate>
      <ProvenanceSourceID>1</ProvenanceSourceID>
      <ProvenanceName>Digital Preservation Department / The National Archives</ProvenanceName>
      <ProvenanceSourceDate>27 Nov 2015</ProvenanceSourceDate>
      <ProvenanceDescription>
      </ProvenanceDescription>
      <LastUpdatedDate>09 May 2023</LastUpdatedDate>
      <FormatNote>
      </FormatNote>
      <FormatRisk>
      </FormatRisk>
      <TechnicalEnvironment>
      </TechnicalEnvironment>
      <FileFormatIdentifier>
        <Identifier>application/encase</Identifier>
        <IdentifierType>MIME</IdentifierType>
      </FileFormatIdentifier>
      <FileFormatIdentifier>
        <Identifier>fmt/803</Identifier>
        <IdentifierType>PUID</IdentifierType>
      </FileFormatIdentifier>
      <ExternalSignature>
        <ExternalSignatureID>1696</ExternalSignatureID>
        <Signature>e01</Signature>
        <SignatureType>File extension</SignatureType>
      </ExternalSignature>
      <InternalSignature>
        <SignatureID>1168</SignatureID>
        <SignatureName>EO1</SignatureName>
        <SignatureNote>Header - EVF...ÿ.</SignatureNote>
        <ByteSequence>
          <ByteSequenceID>1412</ByteSequenceID>
          <PositionType>Absolute from BOF</PositionType>
          <Offset>0</Offset>
          <MaxOffset>0</MaxOffset>
          <IndirectOffsetLocation>
          </IndirectOffsetLocation>
          <IndirectOffsetLength>
          </IndirectOffsetLength>
          <Endianness>
          </Endianness>
          <ByteSequenceValue>455646090D0AFF00</ByteSequenceValue>
        </ByteSequence>
      </InternalSignature>
      <RelatedFormat>
        <RelationshipType>Has priority over</RelationshipType>
        <RelatedFormatID>1255</RelatedFormatID>
        <RelatedFormatName>ISO 9660 Disk Image File</RelatedFormatName>
        <RelatedFormatVersion>
        </RelatedFormatVersion>
      </RelatedFormat>
    </FileFormat>
    <SearchCriteria>Criteria</SearchCriteria>
  </report_format_detail>
</PRONOM-Report>
