{"success":true,"data":{"ext":"e01","name":"E01","description":"E01 is the EnCase Expert Witness Format, a disk image container originally developed by Guidance Software and now maintained as part of OpenText EnCase tooling. It is used in digital forensics to preserve hard drives, removable media, and other storage devices for investigation, analysis, and courtroom presentation. The format is widely supported in forensic software; its contents may include metadata and compressed evidence data, so files should be handled as forensic artifacts rather than executed.","mime":[],"risk_level":"Safe","signatures":[{"hex":"45 56 46","offset":0,"sources":[{"name":"Wikipedia","url":"https://en.wikipedia.org/wiki/List_of_file_signatures"}]}],"related":["aff"],"usage":{"python":"def is_e01(file_path: str) -> bool:\n    \"\"\"Check if file is a valid E01 by magic bytes.\"\"\"\n    signature = bytes([0x45, 0x56, 0x46])\n    with open(file_path, \"rb\") as f:\n        return f.read(3) == signature","node":"function isE01(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x45, 0x56, 0x46]);\n  return buffer.subarray(0, 3).equals(signature);\n}","go":"func IsE01(data []byte) bool {\n    signature := []byte{0x45, 0x56, 0x46}\n    if len(data) < 3 {\n        return false\n    }\n    return bytes.Equal(data[:3], signature)\n}"},"category":"Disk Images"}}