E01 Compression Format

Introduction

Developed by ASR Data, the Expert Witness file format (aka E01 format aka EnCase file format) is an industry standard format for storing “forensic” images. The format allows a user to access arbitrary offsets in the uncompressed data without requiring decompression of the entire data stream. The specification does NOT provide for quantifyable assurance of integrity, it is up to the implementation to provide meaningful authentication for any data contained in an “evidence file”.

Overview

The Expert Witness Compression format can store a single image in one or more segment files. Each file consists of a standard 13-byte header, followed by a series of sections. The sections are typically arranged back-to-back. A section cannot span two files.

A Chunk is a 32k run of data (64 standard sectors). All offsets are relative to the beginning of the segment file, unless otherwise noted.

File Header Each file begins with the following 13-byte header. (This is not to be confused with the header section, below.)

Signature Part (8 bytes)…

Bytes 3 1 1 1 1 1
Data “EVF” 0x09 0x0d 0x0a 0xff 0x00

Fields Part (5 bytes)…

Bytes 1 2 2
Data 0x01 1 or higher 0x0000
Meaning Segment Number

The Section

Every section begins with the same standard data, with the following layout.

Offset: Bytes: Data: Meaning:
0 (0x0) 16 “volume”, “header”, etc. Section type string
16 (0x10) 8 64-bit offset in current file to the next section
24 (0x18) 8 64-bit byte-size of the section
32 (0x20) 40 0x00… Padding
72 (0x48) 4 CRC of all previous setion data

Section Types

Expert Witness Compression uses the following section types: header, volume, table, next, and done. Some of these section types have unique data that begins directly after the standard section structure above.

‘header’ section…

Offset: Bytes: Data: Meaning:
76 (0x4c) to end of section zlib compress()’ed data Comments structure (see below)

Comment structure is simply a text string in the following tab- and newline-delimited format. (The data in each cell is separated by a tab character, and each row is separated by a newline character.) The first three lines are standard and must not change. The characters in the third line serve as reminders for the content of the fields in the fourth line. (The fourth line is the only line that needs to be customized.)

1
main
c n a e t m u p r
Case Number Evidence Number Unique Description Examiner Name Notes Acquired Date System Date pwhash char
  • Case Number, Evidence Number, Unique Description, Examiner Name, and Notes are free-form (provided they don’t contain tab or newline characters).
  • Acquired Date and System Date are in the form of: “2002 3 4 10 19 59” (March 4, 2002 10:19:59).
  • pwhash should simply be the character ‘0’.
  • char should be the one of these three characters: ‘b’, ‘f’, or ‘n’. This represents “best”, “fastest”, or “no compression”. Expert Witness Compression uses ‘f’.

The header section should appear in the first segment file only.

‘volume’ section…

Offset: Bytes: Data: Meaning:
76 (0x4c) 4 1 Reserved
80 (0x50) 4 Chunk Count
84 (0x54) 4 64 Sectors per Chunk
88 (0x58) 4 512 Bytes per Sector
92 (0x5c) 4 Sector Count
96 (0x60) 20 0x00… Reserved
116 (0x74) 45 0x00… Padding
161 (0xa1) 5 Reserved (Signature)
166 (0xa6) 4 CRC of all previous ‘volume’ data, starting with offset 76

The volume section should appear in the first segment file only.

‘table’ section…

Offset: Bytes: Data: Meaning:
76 (0x4c) 4 1 Chunk Count (for this table)
80 (0x50) 16 0x00… Padding
96 (0x60) 4 CRC of all previous ‘table’ data, starting with offset 76
100 (0x64) as long as necessary Offset array (see below)
from end of offset array to end of section zlib compress()’ed data Chunks

The offset array is a series of back-to-back 4-byte unsigned integer values. Each entry is an offset to the start of a compressed ‘Chunk’. The high bit of each value must be set! There must be one entry per Chunk.

Each table section can hold 16375 entries. If more entries are needed, you must create multiple table sections per file.

‘next’ and ‘done’ sections…

Each file ends with a ‘next’ or ‘done’ section. If the file is the last segment in an Expert Witness compressed image, the section will be named ‘done’. Otherwise, the section will be named ‘next’ to indicate that another segment file must be read. The “next section” pointer for these section types points to the beginning of the section itself, since it is the last section in a file. These section types have no unique data.