All You Need to Know About: What is Encase LEF File?
What is Encase LEF File Format?
Encase L01 or LEF file is a logical evidence file which is created by the most efficient EnCase Forensics software and is commonly known as LEF file. It was initially named as Expert Witness that helps investigators in extracting the digital image respective to the evidence present on the local system of a user. It is the short form of EnCase Logical Evidence File. The main purpose of this LEF file is keeping a record of evidence maintained in the file with extension .lx01. However, while investigation an expert can save the file as an Image file.
Moreover, Encase LEF File deliver the replica of evidence without influencing or manipulating the original data file in terms of consistency and integrity to the expert. This article complies to illustrate all a user needs to about what is Encase LEF file format and how to create an evidence file.
Specification of Encase LEF File Format
|File Type||Disk Image Files|
|File Signature||4C 56 46 09 0D 0A FF 00|
|Default Location||User defined location|
|Full Form||EnCase Logical Evidence File|
Purpose of EnCase Logical Evidence File (.L01) in Forensics
As everybody knows the digital information is the most important factor in every investigation, which is to be preserved and protected carefully. Therefore, EnCase is one of the outstanding digital forensic application, which is used by most of the forensics experts.
- With the help of this tool, all the digital evidence can easily be extracted from, emails, physical devices or other hard drives.
- To prevent the loss or corruption of crucial digital proofs, investigators avoid the use of copying of files for data preserving. Hence, this EnCase forensic tool itself offers a reliable feature that permits to produce EnCase image file of the extracted data.
- To keep the data without any loss or manipulation in the important information, one can use these encase LEF (.L01) files. It proves to be an efficient solution for preserving the crucial data that can be used in future for court proceedings.
- The Encase LEF L01 files prove to be beneficial in many different ways such as rather than saving the complete disk image, an expert can save only the required files also from all evidence. Moreover, one can carry the original copy of selected evidences along with its associated meta properties such as file size, file name, logical size, physical size, last accessed time etc.
- In order to examine only particular evidence from a large amount of data, one can use EnCase forensic tool. Therefore, extracting the image files in L01 file format helps to save only selected evidences and saving the memory storage also.
Characteristics of EnCase LEF File Extension
Some of the important characteristics offered by Encase Logical Evidence files are mentioned below:
- Depending upon the requirement of user’s, Encase L01 files are created to save image files with respect to selected files or folders.
- It makes sure that consistency of data is maintained in extracted image file i.e. all the extracted information & evidences are stored in an original format.
- The image of selected evidences is complete in all sense and there is no loss of data. It extracts all the data by maintaining the integrity.
- Using Encase LEF file format an investigator can also extract information from other EnCase sources such as Records, Snapshots, etc.
- MD5 rehashing algorithms are used to retain the integrity of data in each extracted evidence item.
What are the Types of Encase LEF Logical Evidence File
There are two different types of evidence file that a user can create and are discussed below:
- EnCase Evidence File
Byte-for-byte representation of a physical device or logical volume is an EnCase evidence files (.E01).With the help of this file format, an expert can save the whole evidence and extracts the crucial information as an image file.
- Encase Logical Evidence File
Logical evidence files (.L01) are generated from previews, existing evidence files, etc. These are typically generated after an analysis locates some files for forensic reasons, and they are stored in a forensic container. These files are the single files that help investigators to save the selected folder instead of saving the entire information.
How to Create Logical Evidence File in EnCase
In order to create a logical evidence file, follow the steps mentioned below:
1. Open the Evidence tab and choose any number of entries in the left pane to create Encase LEF file.
2. Now, right-click and click on Acquire >> Create Logical Evidence File from the drop-down menu
3. In Create Encase Logical Evidence File, open Location tab and fill all the entries
4. If you want to add this file to an existing logical evidence file, then check the Add to existing evidence file option.
5. Now, open Logical tab and fill all entries.
6. After that open the Format tab and enter all required details
7. Now, click on Encryption option and Encryption Details dialog box is opened
8. Select the key icon from the upper pane to open New Encryption Key dialog and click Next to create a new encryption key
9. After that, Password dialog box is opened
10. Mention the encryption key and set the password by entering in Password field
11. Now, re-enter password in Confirm Password field and click on Finish button
12. Save the public key that is created by you by clicking on Save button
13. Now, go back to Encryption Details dialog and click on Update button to see the key that you have just created
14. After that, check the new key checkbox and click on the OK option to create Encase LEF file.
After understanding the importance of Encase LEF file for the users, we have covered all important aspects of LEF files from user’s point of view. The main purpose of this post is to let the users easily understand what is LEF file format, what is EnCase logical evidence file and how can it beneficial for investigators from the digital forensics point of view.