Skip to content

Expert Witness Compression Format magic bytes (.enn)

.enn file signature: 45 56 46 09 0D 0A FF 00 | application/octet-stream

Expert Witness Compression Format (EWF) is a disk image and evidence container format originally developed by Guidance Software for the EnCase forensic platform and later maintained through its associated specifications. It is used to store compressed copies of storage media for digital forensics, evidence preservation, and incident response workflows. The format is long established and may be considered legacy in some environments, but it remains widely supported by forensic tools.

Safe

Magic Bytes

Offset 0
45 56 46 09 0D 0A FF 00

Sources: Gary Kessler

Extension

.enn

MIME Type

application/octet-stream

Byte Offset

0

Risk Level

Safe

Validation Code

How to validate .enn files in Python

Python 
def is_enn(file_path: str) -> bool:
    """Check if file is a valid ENN by magic bytes."""
    signature = bytes([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00])
    with open(file_path, "rb") as f:
        return f.read(8) == signature

How to validate .enn files in Node.js

Node.js 
function isENN(buffer: Buffer): boolean {
  const signature = Buffer.from([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00]);
  return buffer.subarray(0, 8).equals(signature);
}

How to validate .enn files in Go

Go 
func IsENN(data []byte) bool {
    signature := []byte{0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00}
    if len(data) < 8 {
        return false
    }
    return bytes.Equal(data[:8], signature)
}

API Endpoint

GET /api/v1/enn
curl https://filesignature.org/api/v1/enn

See the full API documentation for all endpoints and parameters.

Related Formats

.snn

Frequently Asked Questions

What is a .enn file?

A .enn file is an Expert Witness Compression Format. Expert Witness Compression Format (EWF) is a disk image and evidence container format originally developed by Guidance Software for the EnCase forensic platform and later maintained through its associated specifications. It is used to store compressed copies of storage media for digital forensics, evidence preservation, and incident response workflows. The format is long established and may be considered legacy in some environments, but it remains widely supported by forensic tools.

What are the magic bytes for .enn files?

The magic bytes for Expert Witness Compression Format (.enn) files are 45 56 46 09 0D 0A FF 00 at byte offset 0. These bytes identify the file format more reliably than the extension alone.

How do I validate a .enn file?

To validate a .enn file, read the first bytes of the file and compare them against the known magic bytes (45 56 46 09 0D 0A FF 00) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.

What is the MIME type for .enn files?

There is no officially registered MIME type for .enn files. Systems typically use application/octet-stream as a generic fallback when handling this format.

Is it safe to open .enn files?

Expert Witness Compression Format (.enn) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.