{"success":true,"data":{"ext":"enn","name":"Expert Witness Compression Format","description":"Expert Witness Compression Format (EWF) is a disk image and evidence container format originally developed by Guidance Software for the EnCase forensic platform and later maintained through its associated specifications. It is used to store compressed copies of storage media for digital forensics, evidence preservation, and incident response workflows. The format is long established and may be considered legacy in some environments, but it remains widely supported by forensic tools.","mime":[],"risk_level":"Safe","signatures":[{"hex":"45 56 46 09 0D 0A FF 00","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["snn"],"usage":{"python":"def is_enn(file_path: str) -> bool:\n    \"\"\"Check if file is a valid ENN by magic bytes.\"\"\"\n    signature = bytes([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00])\n    with open(file_path, \"rb\") as f:\n        return f.read(8) == signature","node":"function isENN(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00]);\n  return buffer.subarray(0, 8).equals(signature);\n}","go":"func IsENN(data []byte) bool {\n    signature := []byte{0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00}\n    if len(data) < 8 {\n        return false\n    }\n    return bytes.Equal(data[:8], signature)\n}"}}}