LEF File Extension
EnCase Logical Evidence File
Overview: LEF File Extension
LEF, short for logical evidence file, is a proprietary format created by EnCase Forensics software. It keeps record of evidences in a file having extension L01.
Users can select required evidences from a disk image (for instance, E01 file format) and save them in LEF L01 file extension.
Application Category
Disk Image Files
Organization
Guidance SoftwareFile Location
User Defined Location
More on EnCase LEF File Extension
- LEF L01 file format helps investigators to keep track of digital evidences.
- L01 files are mainly used to extract & store selected evidences from an entire disk image.
- Unlike E01 which is a replica copy of an entire disk, L01 extension saves only necessary data.
- EnCase LEF holds all files and folders in their original format.
- All meta properties including file name & extension, file size, created date, modified date, permissions etc are kept intact.
- EnCase LEF format uses MD5 hashing algorithm to verify data integrity.
Technical Specifications
MIME Type
Standard Identifier
application/octet-stream
Official media type for EnCase logical data streams.
File Signature Details
Hexadecimal Signature
4C 56 46 09 0D 0A FF 00
Standard forensic identifier for EnCase L01 files.
Applications Supported
EnCase Forensics