# Expert Witness Disk Image

> file format

**Wikidata**: [Q50339410](https://www.wikidata.org/wiki/Q50339410)  
**Source**: https://4ort.xyz/entity/expert-witness-disk-image

## Summary
Expert Witness Disk Image is a file format used for storing disk images, most notably the EnCase E01 Bitstream format with the .e01 extension. It is classified as a disk image, which is a computer file containing the contents and structure of a disk volume.

## Key Facts
- Aliases: Expert Witness Disk Image, EnCase E01 Bitstream, .e01  
- Media type: application/octet‑stream (reference date 2018‑03‑05, source https://datatypes.net/open-e01-files#ext0)  
- Instance of: disk image  
- File extension: e01 (reference source )  
- Described at URL: https://github.com/libyal/libewf/blob/master/documentation/Expert%20Witness%20Compression%20Format%20%28EWF%29.asciidoc  
- Wikidata description: file format  
- PRONOM file format ID: fmt/803  
- Library of Congress format description document ID: fdd000408  
- Related class: disk image — a computer file containing the contents and structure of a disk volume (sitelink count: 26)  

## FAQs
**What is Expert Witness Disk Image?**  
Expert Witness Disk Image is a file format for disk images, specifically the EnCase E01 Bitstream format, identified by the .e01 extension.

**What file extension does Expert Witness Disk Image use?**  
It uses the file extension e01.

**What is the media type assigned to Expert Witness Disk Image?**  
Its media type is application/octet‑stream, as recorded with a reference date of 2018‑03‑05.

**What PRONOM identifier is associated with Expert Witness Disk Image?**  
The PRONOM file format ID for this format is fmt/803.

**What Library of Congress identifier describes Expert Witness Disk Image?**  
It is described by the Library of Congress format description document ID fdd000408.

**How is Expert Witness Disk Image related to the broader class of disk images?**  
It is an instance of a disk image, which is defined as a computer file containing the contents and structure of a disk volume.

**Where can the technical description of Expert Witness Disk Image be found?**  
The format is documented at https://github.com/libyal/libewf/blob/master/documentation/Expert%20Witness%20Compression%20Format%20%28EWF%29.asciidoc.

**What are the alternative names for Expert Witness Disk Image?**  
It is also known as Expert Witness Disk Image, EnCase E01 Bitstream, and .e01.

## Why It Matters
Expert Witness Disk Image provides a standardized way to preserve and exchange exact copies of storage media, which is essential in digital forensics and data recovery. Its recognition by PRONOM (fmt/803) and the Library of Congress (fdd000408) ensures long‑term accessibility and interoperability across forensic tools and archives. The format’s association with EnCase E01 Bitstream highlights its widespread use in investigative workflows, where preserving the original bit‑stream of a disk is critical for evidentiary integrity.

## Notable For
- Recognized as the EnCase E01 Bitstream format, a de facto standard in forensic imaging  
- Assigned the PRONOM identifier fmt/803, enabling automated format identification  
- Listed in the Library of Congress format registry with ID fdd000408  
- Uses the .e01 file extension, widely supported by forensic software  
- Defined as a disk image, preserving both data and structural metadata of a source volume  
- Documented in an open‑source specification hosted on GitHub, promoting transparency  

## Body
### Overview
Expert Witness Disk Image is a file format that falls under the class of disk images. A disk image is a computer file that contains the exact contents and structure of a disk volume, enabling sector‑by‑sector duplication of storage media.

### Technical Identification
- The format’s media type is application/octet‑stream, with a reference timestamp of 2018‑03‑05 pointing to https://datatypes.net/open-e01-files#ext0.  
- Its official file extension is e01, as cited by source .  
- It is identified in the PRONOM registry as fmt/803.  
- The Library of Congress assigns it format description document ID fdd000408.  
- Wikidata describes it simply as a file format.

### Aliases and Naming
Expert Witness Disk Image is also known as EnCase E01 Bitstream and uses the .e01 extension. These aliases reflect its origin in the EnCase forensic suite and its common file naming convention.

### Documentation
The detailed specification for the Expert Witness Compression Format (EWF), which underlies the Expert Witness Disk Image, is available at https://github.com/libyal/libewf/blob/master/documentation/Expert%20Witness%20Compression%20Format%20%28EWF%29.asciidoc. This document provides the technical reference used by implementations such as libewf.

### Relationship to Disk Image Class
As an instance of the disk image class, Expert Witness Disk Image inherits the core property of storing a complete, bit‑accurate copy of a disk volume, including filesystem structures, boot sectors, and any hidden or deleted data. The disk image class itself is noted to have a sitelink count of 26, indicating broad coverage across knowledge bases.

### Usage Context
Through its alias EnCase E01 Bitstream, the format is intrinsically linked to digital forensic investigations, where preserving the original state of storage media is required for legal and analytical purposes. Its inclusion in PRONOM and the Library of Congress registries supports preservation efforts and ensures that the format can be reliably identified and accessed over time.

## References

1. [Source](https://datatypes.net/open-e01-files#ext0)
2. PRONOM