Table of Content
Introduction
Application Category & Support
Owned by Organization
MIME & File Signature
Location
Join Discussion

What is LEF File Extension? Introduction to EnCase Logical Evidence File

LEF, short for logical evidence file, is a proprietary format created by EnCase Forensics software. It keeps record of evidences in a file having extension L01. Besides, users can select required evidences from a disk image (for instance, E01 file format) and save them in LEF L01 file extension.

  • LEF L01 file format helps investigators to keep track of digital evidences.
  • L01 files are mainly used to extract & store selected evidences from an entire disk image.
  • Unlike E01 which is a replica copy of an entire disk, L01 extension saves only necessary data
  • EnCase LEF holds all files and folders in their original format.
  • All meta properties including file name & extension, file size, created date, modified date, permissions etc are kept intact.
  • EnCase LEF format uses MD5 hashing algorithm to verify data integrity.

The LEF file belongs to the category of Disk Image Files.

LEF file format is supported by EnCase

application/octet-stream

4C 56 46 09 0D 0A FF 00

User defined location