3. Evidence File

• Evidence file extensions are

      E01, .E02, ...
  

  Internal organization of the evidence files is:

  1. Header -- acquisition-time parameters:

     • Case info, acquisition date/time, acquisition notes, examiner's name,

  2. Sequence of the data blocks:

     • Data block

     • CRC checksum

  3. Acquisition hash of the source media -- has no relation to the evidence file itself.