Importance of EnCase LX01 File Format in Digital Forensics Investigation

LX01 is the logical evidence image file with .lx01 extension created by EnCase forensic software. L01 was the previous file format used to save the EnCase logical evidence file which is now replaced by the LX01 file format and it offers more advanced security features. It allows users to acquire the selected part of the evidence file instead of acquiring the entire image file.

EnCase Forensic Software Tool in Digital Forensics

It is the digital investigation tool introduced by Guidance software. In digital forensics, it is used to recover evidence from the seized hard drive, other external storage media, etc. During the forensics investigation, EnCase software helps the investigators to extract and analyze the digital image evidence file. EnCase creates Logical Evidence File (LEF) which stores the collected evidence. It allows the examiners to save the selected evidence data from the image file without loading the entire disk image files. But, the EnCase evidence file is not in a readable format.

EnCase software creates the evidence file into two file formats, they are:

EX01: It is the EnCase imaging file format. An EX01 image file saves the entire copy of the hard disk including the deleted data by maintaining its integrity and consistency.

LX01: It is the EnCase logical evidence file. LX01 is used to store the selected part of the evidence file without loading the entire image file. It also maintains the consistency and integrity of the collected evidence.

EnCase Logical Evidence File LX01

In digital forensics investigation, the first task performed by the investigator is the collection of evidence from various sources and storing it. It is a very important duty of the Investigator to collect and store the evidence in a suitable file format with no alterations and manipulations in their consistency and integrity. One of such reliable file format to store the evidence is EnCase LEF file. It allows saving the selected artifacts instead of saving the entire image of the evidence for the investigation purposes.

Through this, an LX01 file allows maintaining confidentiality by sharing only the required data instead of sharing the entire case evidence file during the investigation. Logical Evidence file helps investigators to understand the various aspects of the case through the detailed analysis of evidence.

Information Provided by LX01 Image Files

EnCase logical evidence file provides the information, as follows:

Digital Image: LX01 creates an accurate image file without changing the integrity and consistency of the evidence.

Evidence Parameter: Addition to the actual evidence, the EnCase logical file also contains other parameters related to the case. It helps the investigators to understand the nature and other aspects of the case.

• Name: EnCase LEF file name.
• Case Name: Name of the case to which the EnCase file belongs to.
• Evidence Number: Unique identification number of the evidence.
• Examiner Name: Name of the examiner who publishes the EnCase file.
• Notes: Additional notes related to the case in order to remember minute details of the case.

EnCase logical evidence file saves with .lx01 extension. In the older version, EnCaseused to create a logical evidence file in the L01 file format, and now it is replaced by LX01. Because it provides more advanced security features over L01 such as AES256 encryption, LZ compression, and options for SHA1, MD5 hashing. LX01 file extension maintains the data integrity by encrypting the evidence using hashing algorithms. It also provides authenticity by locking the encrypted files using public and private keys.

Purpose of LX01 File Type in Digital Forensics

• LX01 file helps to examine the particular evidence including a large amount of data and saves the storage memory.
• Helps the Investigator in court proceedings and for further reviewing process.
• Provides advanced security mechanisms such as AES256 encryption, LZ compression, etc over L01 file format.
• Maintains data integrity without loss or manipulation of any important information.
• Ensures the integrity of evidence through MD5 and SHA1 hashing algorithms.

Examining LX01 File Format

MailXaminer Email Examiner Software provides the advanced options for search and analysis of EnCase created logical evidence files with .lx01 extension. Perform the following steps to examine and search for evidence in the LX01 file type.

STEP 1: Add the LX01 File

Use the Add Evidence option to a new evidence file. Select LEF – Processed Emails  to add LX01 files. Users can add files in bulk by providing a CSV file.

 

STEP 2: Preview LX01 File Details

After completing the scanning process, the preview of all the files will be displayed on a single screen. At the left pane of the screen, all the folders enclosed within the scanned LEF file will be shown individually. Users can expand the folder and view the files enclosed within it.

 

STEP 3: Advance Search Options

To search the evidence in scanned LX01 image files, click on the Search option for the systematic search. There are several email search methods available in the tool such as General Search, Proximity Search, Regular Expression, Stem Search, Fuzzy Search, and Wildcard Search. These search methods are based on different search algorithms which can be used by the users according to their requirement.

Users can use these advance search options for systematic evidence collection and data analysis of the LX01 file type.

 

STEP 4: Analysis Options

The software also provides the option for Analytics which can be used to systematically analyze the huge email data during the email investigation. The analytics feature of the software includes Word Cloud, Timeline Analysis, Link Analysis, and Entity Analysis which are based on different analysis mechanisms.

 

STEP 5: Export Option

After finding the specific evidence in .lx01 file type data, user can choose to selectively export the resultant evidence file into various file formats like PDF, EML, MSG, HTML, etc. Users can simply export the evidence report in the desired file format by choosing the required output format. The resultant file can be saved at the selective location by providing the desired location path.

 

Conclusion

In digital forensics investigation, recording of the collected evidence is a very important process. EnCase logical evidence file with LX01 file extension is one of the reliable formats which selectively stores the evidence by maintaining its consistency and integrity. To examine the case details in EnCase LX01 file, use the aforementioned Email Forensic Tool. It helps forensic investigators to search and examine the evidence stored in EnCase LX01 file format and save the forensic report in different file formats.