What is a .E01 file?
E01 is an EnCase Evidence File - a forensic disk image storing a bit-for-bit copy of a drive with checksums and a chain-of-custody header.
- Did you know
- E01 images carry a CRC for every block and an MD5 of the whole drive, so an investigator can prove the copy was never altered.
- E01 is the Expert Witness Format from Guidance Software's EnCase, long the de facto standard in law-enforcement forensics.
- An E01 stores the image compressed and split into numbered segments (.E01, .E02 and so on), so a huge drive fits onto smaller volumes.
- What Analyser reads
- Identify and read more security and forensics files: OpenPGP messages/keys/signatures (.pgp/.gpg/.sig - armor type, packet walk, key algorithm and user ID, secret-key warning), YARA rules, Snort/Suricata IDS rules, STIX/OpenIOC threat intel, Fiddler captures (.saz), 1Password exports (.1pux), Apple Keychain, KeePass 1.x (.kdb), Microsoft keys (.pvk) and AFF/AFF4 forensic images.
- Depth of analysis
- .E01 is an identification-grade format: Analyser recognises it from its bytes and decodes the header metadata it carries, rather than opening it in a full viewer. Formats that do get a full viewer are marked "Full" on the formats page.
- Open a .E01 file
- Drag a .E01 file onto the Analyser home page (or tap to pick one). It is identified entirely in your browser - nothing is uploaded, there is no account, and it works offline once installed.