What is LEF File Extension?


LEF stands for Logical Evidence File. The proprietary file format keeps the record of evidence. The file extension it uses is L01. It is capable to collect necessary evidence from a disk image and saves to LEF file format.

  • LEF has been designed to keep the record of digital evidence
  • The file format is controlled by users, extracts and stores only the defined evidence from the disk image
  • It is not like E01 which creates photocopy of an entire disk, the L01 collects only necessary data
  • EnCase LEF stores all folders in their original format
  • It retains meta properties like size, date, and permission
  • It uses MD5 hashing algorithm to maintain the integrity of data


It is counted under the Disk Image Files category.


The file format has been developed by Guidance Software.

Supportive Apps

It is supported only by Encase.




4C 56 46 09 0D 0A FF 00


The file format is controlled by users. Thus, it saves the file at user's defined location.

How to view the LEF File Extension

Users can access a LEF file on Encase software. They can use a third party tool to access the file.