LEF – Logical Evidence File

What is LEF File Extension?

Overview

LEF stands for Logical Evidence File. The proprietary file format keeps the record of evidence. The file extension it uses is L01. It is capable to collect necessary evidence from a disk image and saves to LEF file format.

  • LEF has been designed to keep the record of digital evidence
  • The file format is controlled by users, extracts and stores only the defined evidence from the disk image
  • It is not like E01 which creates photocopy of an entire disk, the L01 collects only necessary data
  • EnCase LEF stores all folders in their original format
  • It retains meta properties like size, date, and permission
  • It uses MD5 hashing algorithm to maintain the integrity of data

Category

It is counted under the Disk Image Files category.

Developer

The file format has been developed by Guidance Software.

Supportive Apps

It is supported only by Encase.

MIME Type

application/octet-stream

Signature

4C 56 46 09 0D 0A FF 00

Location

The file format is controlled by users. Thus, it saves the file at user’s defined location.

How to view the LEF File Extension

Users can access a LEF file on Encase software. They can use a third party tool to access the file.

error: Content is protected !!