Logical File Evidence Format

other

Logical FIle Evidence Format was introduced in EnCase version 5. They are form of Encase Image files, this format is used to store media images for forensic purposes. They are a type of disk image containing the contents and structure of an entire data storage device, disk volume or even a computer's physical memory. The logical version of this format is used to create an image of the original files as they existed on the media but also documents other ifnormation. This includes the assigned file name and extension, datetime of creation, modified date, and date last accessed, the logical and physical size, an MD5 hash value, permissions and original path. This format creates segments which have different file extensions, the first will have the extension '.l01'. this increases first numerically upto '.l99' the next extension will be '.laa' increasing to an estimated limit of '.zzz'.

Identify it

Not sure your file is this? Identify it from its first bytes, in your browser.

Open it

• EnCasereads and writes

Convert it

No conversion recorded. One of the tools above may export it; search for a chain.

Sources

• PRONOM fmt/804
• Wikidata Q60414146

From PRONOM, Wikidata. Updated 2026-10-20.

Improve this record JSON