Expert Witness Compression Format
application/octet-stream
Magic Bytes
Offset: 0
45 56 46 32 0D 0A 81
The Expert Witness Compression Format, identified by the .enn extension, is a proprietary forensic disk imaging container developed by Guidance Software (now OpenText). Primarily used in digital investigations, it facilitates the capture of bit-stream copies of storage media while preserving data integrity through internal hashing and optional compression. Although it supports encryption to secure sensitive evidence, the format is now considered a legacy standard, having been mostly replaced by more advanced Ex01 and E01 formats.
Validation Code
How to validate .enn files in Python
def is_enn(file_path: str) -> bool:
"""Check if file is a valid ENN by magic bytes."""
signature = bytes([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81])
with open(file_path, "rb") as f:
return f.read(7) == signatureHow to validate .enn files in Node.js
function isENN(buffer: Buffer): boolean {
const signature = Buffer.from([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81]);
return buffer.subarray(0, 7).equals(signature);
}How to validate .enn files in Go
func IsENN(data []byte) bool {
signature := []byte{0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81}
if len(data) < 7 {
return false
}
return bytes.Equal(data[:7], signature)
}API Endpoint
/api/v1/enn
curl https://filesignature.org/api/v1/enn
Related Formats
Frequently Asked Questions
What is a .enn file?
A .enn file is a Expert Witness Compression Format file. The Expert Witness Compression Format, identified by the .enn extension, is a proprietary forensic disk imaging container developed by Guidance Software (now OpenText). Primarily used in digital investigations, it facilitates the capture of bit-stream copies of storage media while preserving data integrity through internal hashing and optional compression. Although it supports encryption to secure sensitive evidence, the format is now considered a legacy standard, having been mostly replaced by more advanced Ex01 and E01 formats.
What are the magic bytes for .enn files?
The magic bytes for Expert Witness Compression Format files are 45 56 46 32 0D 0A 81 at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.
How do I validate a .enn file?
To validate a .enn file, read the first bytes of the file and compare them against the known magic bytes (45 56 46 32 0D 0A 81) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.
What is the MIME type for .enn files?
The primary MIME type for .enn files is application/octet-stream.
Is it safe to open .enn files?
Expert Witness Compression Format (.enn) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.