{"success":true,"data":{"ext":"exnn","name":"EnCase® Evidence File Format Version 2","description":"EnCase Evidence File Format Version 2 (EXNN) is a forensic evidence container format developed by Guidance Software, now maintained by OpenText. It is used to store disk images and related case data in digital investigations, allowing examiners to preserve and analyze acquired media in EnCase and compatible forensic tools. The format is a legacy variant of the EnCase evidence family; it is generally safe to inspect, but files should be handled as evidentiary material and verified for integrity.","mime":[],"risk_level":"Safe","signatures":[{"hex":"45 56 46 32 0D 0A 81","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["ex01"],"usage":{"python":"def is_exnn(file_path: str) -> bool:\n    \"\"\"Check if file is a valid EXNN by magic bytes.\"\"\"\n    signature = bytes([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81])\n    with open(file_path, \"rb\") as f:\n        return f.read(7) == signature","node":"function isEXNN(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81]);\n  return buffer.subarray(0, 7).equals(signature);\n}","go":"func IsEXNN(data []byte) bool {\n    signature := []byte{0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81}\n    if len(data) < 7 {\n        return false\n    }\n    return bytes.Equal(data[:7], signature)\n}"}}}