{"success":true,"data":{"ext":"cas","name":"EnCase case file","description":"EnCase case file is a forensic evidence container format created by Guidance Software and maintained through the EnCase digital investigation platform. It is used to store disk images, collected artifacts, and investigation data for computer forensics, incident response, and legal discovery. Because it preserves acquired evidence, the format is typically handled in trusted forensic tools; case files may contain sensitive data, and older EnCase versions are associated with legacy investigative workflows.","mime":[],"risk_level":"Safe","signatures":[{"hex":"5F 43 41 53 45 5F","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["cbk"],"usage":{"python":"def is_cas(file_path: str) -> bool:\n    \"\"\"Check if file is a valid CAS by magic bytes.\"\"\"\n    signature = bytes([0x5F, 0x43, 0x41, 0x53, 0x45, 0x5F])\n    with open(file_path, \"rb\") as f:\n        return f.read(6) == signature","node":"function isCAS(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x5F, 0x43, 0x41, 0x53, 0x45, 0x5F]);\n  return buffer.subarray(0, 6).equals(signature);\n}","go":"func IsCAS(data []byte) bool {\n    signature := []byte{0x5F, 0x43, 0x41, 0x53, 0x45, 0x5F}\n    if len(data) < 6 {\n        return false\n    }\n    return bytes.Equal(data[:6], signature)\n}"}}}