EWF Acquisition
| Format | EWF Acquisition |
|---|---|
| Short name | EWF |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Expert Witness Format (EWF) — the .E01 forensic disk image format written and read by many acquisition tools (EnCase, FTK Imager, ewfacquire/libewf, X-Ways, and others). EWF-E01 (version 1) is reportedly based on ASR Data's earlier Expert Witness Compression Format; EnCase itself was originally named 'Expert Witness' before a trademark dispute with ASR Data over that name. Typically the primary evidence file in a case: a bit-for-bit physical or logical disk acquisition, stored as one or more numbered segments (.E01, .E02, ...), optionally compressed and hashed at acquisition time. This EWF-E01 (version 1) format is the one EnCase 6/7 and FTK Imager write and by far the most common in the field. SMART (.s01) acquisitions carry the same signature and are read the same way; the newer EWF2 (.Ex01) and the logical .L01 variant have entries of their own. The acquisition stores its own MD5/SHA1 of the media in a dedicated hash section, written by the acquisition tool — recomputing and comparing against it verifies the acquisition has not been altered since it was made, independent of any chain-of-custody paperwork.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 45 56 46 09 0D 0A FF 00 | EVF..... | EWF-E01 / SMART signature ('EVF' + control bytes) |
Known extensions
.e01, .s01
References
- EnCase image file format — history and format versions (Forensics Wiki) https://forensics.wiki/encase_image_file_format/
- Expert Witness Compression Format (EWF) — libewf project https://github.com/libyal/libewf/blob/main/documentation/Expert%20Witness%20Compression%20Format%20(EWF).asciidoc
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
- abrignoni/qnxprobe — filesystem reader (QNX, ext, F2FS, FAT, exFAT, NTFS, HFS+, APFS) used alongside ewfprobe https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “EWF Acquisition”. https://kalink0.github.io/crush-forensics/formats/ewf/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction