Expert Witness Compression Format (.snn)

.snn file signature | application/octet-stream

Expert Witness Compression Format (EWF) file, including EWF-E01and EWF-S01, as used in EnCase and SMART evidence files. Byteoffset 9 (i.e., byte #10) contains the segment number, starting with 0x01.nnare the segment sequence number, taking on values 00..99, AA, AB...AZ, BA, BB...BZ, etc.See theEWF specification.

Safe

Magic Bytes

Offset 0


              45 56 46 09 0D 0A FF 00

Sources: Gary Kessler

Extension

.snn

MIME Type

application/octet-stream

Byte Offset

Risk Level

Safe

Validation Code

How to validate .snn files in Python

Python

def is_snn(file_path: str) -> bool:
    """Check if file is a valid SNN by magic bytes."""
    signature = bytes([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00])
    with open(file_path, "rb") as f:
        return f.read(8) == signature

How to validate .snn files in Node.js

Node.js

function isSNN(buffer: Buffer): boolean {
  const signature = Buffer.from([0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00]);
  return buffer.subarray(0, 8).equals(signature);
}

How to validate .snn files in Go

func IsSNN(data []byte) bool {
    signature := []byte{0x45, 0x56, 0x46, 0x09, 0x0D, 0x0A, 0xFF, 0x00}
    if len(data) < 8 {
        return false
    }
    return bytes.Equal(data[:8], signature)
}

API Endpoint

GET /api/v1/snn


              curl https://filesignature.org/api/v1/snn

See the full API documentation for all endpoints and parameters.

Frequently Asked Questions

What is a .snn file?

A .snn file is a Expert Witness Compression Format file. Expert Witness Compression Format (EWF) file, including EWF-E01and EWF-S01, as used in EnCase and SMART evidence files. Byteoffset 9 (i.e., byte #10) contains the segment number, starting with 0x01.nnare the segment sequence number, taking on values 00..99, AA, AB...AZ, BA, BB...BZ, etc.See theEWF specification.

What are the magic bytes for .snn files?

The magic bytes for Expert Witness Compression Format files are 45 56 46 09 0D 0A FF 00 at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.

How do I validate a .snn file?

To validate a .snn file, read the first bytes of the file and compare them against the known magic bytes (45 56 46 09 0D 0A FF 00) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.

What is the MIME type for .snn files?

There is no officially registered MIME type for .snn files. Systems typically use application/octet-stream as a generic fallback when handling this format.

Is it safe to open .snn files?

Expert Witness Compression Format (.snn) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.