{"success":true,"data":{"ext":"snn","name":"Expert Witness Compression Format","description":"Expert Witness Compression Format (EWF) is a forensic disk image and evidence container format originally developed by Guidance Software and defined by the Expert Witness File Format specification. It is used to store compressed, segmented copies of storage media for computer forensics, incident response, and courtroom evidence handling, and is supported by tools such as EnCase and other forensic utilities. The format is largely legacy, but it remains important in archival investigations and should be treated as sensitive evidence data.","mime":[],"risk_level":"Safe","signatures":[{"hex":"45 56 46 09 0D 0A FF 00","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["enn"],"usage":{"python":"def is_snn(file_path: str) -> bool:\n    \"\"\"Check if file is a valid SNN by magic bytes.\"\"\"\n    signature = bytes([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00])\n    with open(file_path, \"rb\") as f:\n        return f.read(8) == signature","node":"function isSNN(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00]);\n  return buffer.subarray(0, 8).equals(signature);\n}","go":"func IsSNN(data []byte) bool {\n    signature := []byte{0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00}\n    if len(data) < 8 {\n        return false\n    }\n    return bytes.Equal(data[:8], signature)\n}"}}}