# Expert Witness Compression Format ## Identification [[Expert Witness Compression Format|EWF]] stores forensic media images; the Library of Congress describes the EWF family and its EnCase variants ([LOC format description](https://www.loc.gov/preservation/digital/formats/fdd/fdd000406.shtml)). [[libewf|libewf]] is an open-source library for accessing EWF files ([libyal repository](https://github.com/libyal/libewf)). [[GNS3|GNS3]] emulates and connects network appliances. [[Signalling System No. 7|SS7]] and [[Base Station System Application Part|BSSAP]] belong to telecom signaling. `boot`, `esp`, and `msftdata` are partition-purpose flags commonly shown by GPT-aware tools. ## Notebook evidence - [[Scanned_20260730-1719#PDF page 27 — EWF forensics, libyal, GNS3, telecom signaling, and partition flags|PDF page 27: EWF forensics, libyal, GNS3, telecom signaling, and partition flags]] — The author is joining preservation and emulation. A disk image can be captured in a forensic format, mounted with open tooling, and then examined or booted in a virtual/network lab. The telecom fragments may be candidate protocols for that lab rather than observed traffic. ## Relationships and overlays The source places this note in a shared evidence cluster with [[Base Station System Application Part|Base Station System Application Part]] · [[GNS3|GNS3]] · [[libewf|libewf]] · [[Scanned_20260730-1706|Scanned_20260730-1706]] · [[Signalling System No. 7|Signalling System No. 7]]. Within the larger collection, this evidence extends [[Vendor-Agnostic Recovery|vendor-agnostic recovery]] and [[Continuity Architecture|continuity architecture]] by showing how software, hardware, identity, and pre-OS control depend on recoverable interfaces. ## Evidentiary status and open leads Add hashes, acquisition tool/version, segment order, write-blocker status, evidence notes, and a read-only mount workflow. Without those, “forensic image” describes a format, not a defensible process. ## Source - [[Scanned_20260730-1719|Scanned_20260730-1719]]