Logical File Evidence Format
application/octet-stream
Magic Bytes
Offset: 0
4C 49 53 54
The Logical File Evidence Format is a proprietary digital forensic container developed by Guidance Software, now a subsidiary of OpenText, for the EnCase forensic suite. It is primarily used by investigators to preserve and transport specific logical files extracted from a storage device without acquiring a full physical disk image. This format ensures data integrity through internal hashing and compression, serving as a critical standard for maintaining chain of custody during legal and criminal proceedings.
Validation Code
How to validate .lxnn files in Python
Python
def is_lxnn(file_path: str) -> bool:
"""Check if file is a valid LXNN by magic bytes."""
signature = bytes([0x4C, 0x49, 0x53, 0x54])
with open(file_path, "rb") as f:
return f.read(4) == signatureHow to validate .lxnn files in Node.js
Node.js
function isLXNN(buffer: Buffer): boolean {
const signature = Buffer.from([0x4C, 0x49, 0x53, 0x54]);
return buffer.subarray(0, 4).equals(signature);
}
Go
func IsLXNN(data []byte) bool {
signature := []byte{0x4C, 0x49, 0x53, 0x54}
if len(data) < 4 {
return false
}
return bytes.Equal(data[:4], signature)
}API Endpoint
GET
/api/v1/lxnn
curl https://filesignature.org/api/v1/lxnn