Expert Witness Compression Format
application/octet-stream
Magic Bytes
Offset: 0
45 56 46 32 0D 0A 81
The Expert Witness Compression Format, identified by the .enn extension, is a proprietary forensic disk imaging container developed by Guidance Software (now OpenText). Primarily used in digital investigations, it facilitates the capture of bit-stream copies of storage media while preserving data integrity through internal hashing and optional compression. Although it supports encryption to secure sensitive evidence, the format is now considered a legacy standard, having been mostly replaced by more advanced Ex01 and E01 formats.
Validation Code
How to validate .enn files in Python
Python
def is_enn(file_path: str) -> bool:
"""Check if file is a valid ENN by magic bytes."""
signature = bytes([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81])
with open(file_path, "rb") as f:
return f.read(7) == signatureHow to validate .enn files in Node.js
Node.js
function isENN(buffer: Buffer): boolean {
const signature = Buffer.from([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81]);
return buffer.subarray(0, 7).equals(signature);
}
Go
func IsENN(data []byte) bool {
signature := []byte{0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81}
if len(data) < 7 {
return false
}
return bytes.Equal(data[:7], signature)
}API Endpoint
GET
/api/v1/enn
curl https://filesignature.org/api/v1/enn