EWF2 Acquisition
| Format | EWF2 Acquisition |
|---|---|
| Short name | Ex01 |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
EWF2 (.Ex01) — the second version of the Expert Witness Format, introduced with EnCase 7. Like EWF-E01 it holds a bit-for-bit disk acquisition in numbered segments (.Ex01, .Ex02, ...), compressed in chunks, with the MD5/SHA1 the acquisition tool computed stored alongside; recomputing and comparing against it verifies the acquisition has not been altered since it was made. EnCase can also encrypt an Ex01 (AES-256); the encryption scheme is not publicly documented.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 45 56 46 32 0D 0A 81 00 | EVF2.... | EWF2 signature ('EVF2' + control bytes) |
Known extensions
.ex01
References
- EWF2 format specification — libewf project https://github.com/libyal/libewf/blob/main/documentation/Expert%20Witness%20Compression%20Format%202%20(EWF2).asciidoc
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “EWF2 Acquisition”. https://kalink0.github.io/crush-forensics/formats/ex01/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction