E01 is an EnCase Evidence File - a forensic disk image storing a bit-for-bit copy of a drive with checksums and a chain-of-custody header. E01 images carry a CRC for every block and an MD5 of the whole drive, so an investigator can prove the copy was never altered. Analyser handles .E01 alongside related formats such as .PGP, .GPG, .SIG and more. In Analyser's format library, .E01 sits in the Email & security category.

How do I open a .E01 file?

Drop a .E01 file onto Analyser at https://lab.valjdakosta.com/ and it is identified directly in your browser - no upload, no account and no software to install. Identify and read more security and forensics files: OpenPGP messages/keys/signatures (.pgp/.gpg/.sig - armor type, packet walk, key algorithm and user ID, secret-key warning), YARA rules, Snort/Suricata IDS rules, STIX/OpenIOC threat intel, Fiddler captures (.saz), 1Password exports (.1pux), Apple Keychain, KeePass 1.x (.kdb), Microsoft keys (.pvk) and AFF/AFF4 forensic images.

Can I open a .E01 file online for free?

Yes. Analyser is a free online .E01 identifier that runs entirely in your browser - your .E01 file never leaves your device, so there is nothing to upload and no software to install. It even works offline once installed.

.E01 file - what it is and how to identify it online

Click here to analyse any file

Home › Formats › .E01ID

What is a .E01 file?

E01 is an EnCase Evidence File - a forensic disk image storing a bit-for-bit copy of a drive with checksums and a chain-of-custody header.

Did you know: E01 images carry a CRC for every block and an MD5 of the whole drive, so an investigator can prove the copy was never altered.
Analyser handles .E01 alongside related formats such as .PGP, .GPG, .SIG and more.
In Analyser's format library, .E01 sits in the Email & security category.
What Analyser reads: Identify and read more security and forensics files: OpenPGP messages/keys/signatures (.pgp/.gpg/.sig - armor type, packet walk, key algorithm and user ID, secret-key warning), YARA rules, Snort/Suricata IDS rules, STIX/OpenIOC threat intel, Fiddler captures (.saz), 1Password exports (.1pux), Apple Keychain, KeePass 1.x (.kdb), Microsoft keys (.pvk) and AFF/AFF4 forensic images.
Depth of analysis: .E01 is an identification-grade format: Analyser recognises it from its bytes and decodes the header metadata it carries, rather than opening it in a full viewer. Formats that do get a full viewer are marked "Full" on the formats page.
Open a .E01 file: Drag a .E01 file onto the Analyser home page (or tap to pick one). It is identified entirely in your browser - nothing is uploaded, there is no account, and it works offline once installed.
Related formats: .PGP · .GPG · .SIG · .EVT · .YAR · .YARA · .RULES · .STIX · .IOC · .SAZ · .1PUX · .OPVault · .Keychain · .AFF · .AFF4 · .KDB · .PVK · .authorized_keys and more. See all supported file types.