Name: Logical File Evidence Format
Version:
Description: Logical FIle Evidence Format was introduced in EnCase version 5. They are form of Encase Image files, this format is used to store media images for forensic purposes. They are a type of disk image containing the contents and structure of an entire data storage device, disk volume or even a computer's physical memory. The logical version of this format is used to create an image of the original files as they existed on the media but also documents other ifnormation. This includes the assigned file name and extension, datetime of creation, modified date, and date last accessed, the logical and physical size, an MD5 hash value, permissions and original path. This format creates segments which have different file extensions, the first will have the extension '.l01'. this increases first numerically upto '.l99' the next extension will be '.laa' increasing to an estimated limit of '.zzz'.
Deprecated: false
MIMEType:
PUID: fmt/804
sameAs : PRONOM: http://www.nationalarchives.gov.uk/PRONOM/fmt/804
Extension: l01
Magic: true
Container Magic: false
Binary Magic: true
Signature Priority Over:
See Also (e.g. Wikidata, Library of Congress):
Software that can read the format:
Alias:
Class: http://the-fr.org/def/format-registry/FileFormat
Type: []()
SPARQL: http://the-fr.org/public/sparql/endpoint.php?query=describe+%3Chttp://the-fr.org/id/file-format/1257%3E&output=&jsonp=&key=&show_inline=1