Glossary
E01 / EWF (Expert Witness Format)
The segmented, compressed forensic image format produced by EnCase and FTK Imager, with per-chunk compression and acquisition hashes embedded in the file.
E01 is the file extension for an Expert Witness Format (EWF) image, the default
output of EnCase and FTK Imager. The media is split into fixed-size chunks
(usually 32 KiB), each stored raw or zlib-compressed, with an offset table that
maps chunk numbers to byte positions. Large acquisitions span numbered segments:
.E01, .E02, and so on, and you need the whole set because the table in the
first file points into the later ones.
What makes it a forensic format rather than just a compressed blob is the metadata. EWF embeds the acquisition MD5 and, on EnCase 6 and later, SHA-1, so a verifier can confirm the media data has not changed since it was captured.
You can open an E01 in the browser or browse one directly with the parser.