Overview

LEF is the short for Logical Evidence File. The evidence’s related data is kept in the proprietary file format. L01 is the file that it makes use of extended. LEF is the file format it saves to; it can get the pertinent data from a disk image.

• LEF has been designed to keep the record of digital evidence
• The file format is controlled by users, extracts, and stores only the defined evidence from the disk image
• It is not like E01 which creates a photocopy of an entire disk, the L01 collects only necessary data
• EnCase LEF stores all folders in their original format
• It retains meta properties like size, date, and permission
• It uses an MD5 hashing algorithm to maintain the integrity of data

Category

It is counted under the Disk Image Files category.

Developer

The file format has been developed by Guidance Software.

Supportive Apps

It is supported only by Encase.

MIME Type

application/octet-stream

Signature

4C 56 46 09 0D 0A FF 00

Location

The file format is controlled by users. Thus, it saves the file at the user’s defined location.

Users can access an LEF file on Encase software. They can use a third-party tool to access the file.