Evidence file containers are
logical images that contain only selected files and preserve these
files with practically all their external metadata. They are used
either for acquisition as a substitute for a conventional
forensically sound image (in cases where only some files are needed
and a full sector-wise image would be overkill) or to share selected
files with other examiners, investigators, lawyers, prosecutors, the opposing
party etc. etc. Evidence file containers can be created by
X-Ways Forensics and
Comparison with skeleton images and cleansed images.
Containers are initially raw
images with a special file system (XWFS2). They can be converted to
.e01 evidence file format. However, that does not change any file
system data stored in the sectors and make the file system in the
image somehow "more compatible", as some users seem to expect.) They
are designed to preserve as much metadata as possible, see below.
Evidence file containers can even transport only the
metadata of files without the file contents if that is desired, and
still show the original file size (a concept not known from ordinary
file systems, which some users apparently find disturbing).
The information on this page is
about the new container format used by v16.3 and later. It is as
universal as it gets and can be understood by 3rd party forensic
tools with in-depth file system support out of the box or with
little additional effort.