Expert Witness Compression Format
application/octet-stream
Magic Bytes
Offset: 0
45 56 46 32 0D 0A 81
The Expert Witness Compression Format is a proprietary digital forensic imaging standard developed by Guidance Software, now maintained by OpenText. It is primarily used by investigators to store bit-stream copies of storage media while facilitating data compression and embedded metadata storage for legal proceedings. While replaced by newer iterations, it remains an established legacy format used to maintain the cryptographic hash integrity of evidence during long-term archival and analysis.
Validation Code
How to validate .snn files in Python
Python
def is_snn(file_path: str) -> bool:
"""Check if file is a valid SNN by magic bytes."""
signature = bytes([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81])
with open(file_path, "rb") as f:
return f.read(7) == signatureHow to validate .snn files in Node.js
Node.js
function isSNN(buffer: Buffer): boolean {
const signature = Buffer.from([0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81]);
return buffer.subarray(0, 7).equals(signature);
}
Go
func IsSNN(data []byte) bool {
signature := []byte{0x45, 0x56, 0x46, 0x32, 0x0D, 0x0A, 0x81}
if len(data) < 7 {
return false
}
return bytes.Equal(data[:7], signature)
}API Endpoint
GET
/api/v1/snn
curl https://filesignature.org/api/v1/snn