E01
A forensic evidence-container format that stores acquired media data together with metadata and integrity information in a segmented evidence file.
Evidence Container
E01, commonly associated with the Expert Witness Format family, stores forensic image data in a container rather than as a plain raw-sector stream. Implementations can include acquisition metadata, checksums and segmented storage.
The container does not by itself establish chain of custody. Acquisition procedure, tool/version information, source identity and later evidence handling still have to be documented.
Analysis Boundary
A forensic tool must correctly parse the container before interpreting the file system inside it. Container integrity and file-system evidence are separate validation layers.