™Image set + supporting records
Deliver the .E01 image and all segments with an evidence inventory, SHA-256 manifest, verification report, acquisition and export notes, and chain-of-custody record.
+Platform
Digital Forensics & EWF Export
Built with Digital Forensic Principles. Preserve sources, verify supported .E01 exports, and document examiner review.
05TRUST STARTS AT THE SOURCE
Built with
Digital Forensic
Principles.
Preservation, provenance, traceability, and controlled access belong at the foundation of your data workflows.
Export supported forensic images in EWF (.E01) format. Verify image integrity and every segment, include hash manifests and chain-of-custody records, and require examiner review before release for court presentation.
Forensic outcomes depend on your configured procedures, controls, and validation.
EWF EVIDENCE EXPORT · BUILT WITH DIGITAL FORENSIC PRINCIPLES
Verifiable evidence.
Prepared for court review.
Bring the evidence and its history together. Hawkeye's evidence workflow supports Expert Witness Format (EWF) export in .E01 for supported forensic disk and volume images, with validation and custody records for examiner review.
.E01EXPERT WITNESS FORMATOn-box · tenant-scoped · auditable
STEP 01 · PRESERVE
Start with a documented source.
Associate the evidence with its case, tenant, acquisition record, and original integrity values. Preserve the acquired image with controlled access; use working copies for ETL, search, and AI analysis.
- Document acquisition method, scope, operator, and tool version
- Record collection timestamps, time zone, and any acquisition errors
- Keep original evidence separate from derived records and AI outputs
Preserved image + acquisition record
Preserved forensic imagePrivate data lake · original baseline
Authorized case / tenant scope
On-box EWF export.E01 + continuation segments
Read back · compare · document
Integrity verificationEvidence hash + delivery-file manifest
Validation complete + examiner approval
Controlled evidence releaseImage set · custody · validation report
Export and verification can run offline
EXPLORE THE VERIFICATION GATE
Illustrative outcomes. This page does not process or export evidence.
Eligible for examiner reviewPassing checks still require documented approval.
Native files keep their identity
Preserve video, documents, and third-party productions in their original formats with hashes and provenance. Export them as companion evidence when appropriate. A file bundle is not an original forensic disk acquisition.
Controlled, reproducible release
Apply case permissions, legal holds, retention rules, and release approvals. Log exports in the on-box SIEM and keep AI summaries clearly identified as derived work products.
Prepared for court review, with the record to support it. Admissibility depends on lawful collection, validated methods, authentication, custody, and the applicable court rules; the .E01 format alone does not establish admissibility. Validate the configured workflow and receiving tools before operational use.