EnCase Logical Evidence
| Format | EnCase Logical Evidence |
|---|---|
| Short name | L01 |
| Category | logical_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (LogicalEvidenceVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
EnCase logical evidence file (.L01) — copies of selected files and folders rather than a disk: no partition table, no filesystem, no unallocated space, so deleted data is only included if it was selected. Uses the EWF segment structure (.L01 … .L99, then .LAA …); an 'ltree' section stores the file tree with names, paths, timestamps, attributes and per-file MD5/SHA1 hashes, with the file content in compressed chunks. Common for targeted and triage collections and for evidence handed over by other parties; the content can come from any system.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4C 56 46 09 0D 0A FF 00 | LVF..... | L01 signature ('LVF' + control bytes) |
Known extensions
.l01
References
- Expert Witness Compression Format (EWF) — libewf project (L01 section) https://github.com/libyal/libewf/blob/main/documentation/Expert%20Witness%20Compression%20Format%20(EWF).asciidoc
- ForensicsWiki — EnCase image file format (incl. L01) https://forensics.wiki/encase_image_file_format/
Cite this entry
Crush Format Reference, “EnCase Logical Evidence”. https://kalink0.github.io/crush-forensics/formats/l01/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction