View source for Advanced Forensics Format

{{FormatInfo
|formattype=electronic
|subcat=Disk Image Formats
|extensions={{ext|aff}}
|locfdd={{LoCFDD|fdd000412}}(v1), {{LoCFDD|fdd000413}}(v4)
|pronom={{PRONOM|fmt/844}}
|wikidata={{wikidata|Q27473543}}
|compression=lossless
|magic=41 46 46
|developed by=Simson L. Garfinkel and Basis Technology
|maintained by=Phillip Hellewell (v3 only)
}}
'''Advanced Forensics Format''' is an open-source format developed originally by Basis Technology and Simson L. Garfinkel, and is maintained by Phillip Hellewell<ref>[https://github.com/sshock/AFFLIBv3 AFFLIB version 3 - GitHub]</ref>, that:
* Is designed to support precision forensics using compression, encryption, and segmentation, <ref>[https://www.cybertriage.com/glossary-term/advanced-forensic-format-aff/ Advanced Forensic Format (AFF) - Cyber Triage]</ref> As well as an alternative to current proprietary disk image formats.<ref>[https://cs.harvard.edu/malan/publications/aff.pdf Advanced Forensic Format: An open, extensible format for disk imaging - S. Garfinkel, D. Malan, K. Dubec, C. Stevens and C. Pham - Computer Science of Harvard University]</ref>,
* Offers two significant benefits. First, it is more flexible due to allowing extensive metadata to be stored with metadata. Second, AFF images consume less disk space than disk images in other formats (e.g., [[Expert Witness|EnCase image]]s).<ref>[https://cs.harvard.edu/malan/publications/aff.pdf Advanced Forensic Format: An open, extensible format for disk imaging - S. Garfinkel, D. Malan, K. Dubec, C. Stevens and C. Pham - Computer Science of Harvard University]</ref>
* Is a library that is available for use in both Open Source and proprietary tools implementing AFF.

The last format that offers Open Source tooling is based on the version 3, and it is still presently maintained by Phillip Hellewell. Advanced Forensics Format version 4 (AFF4) was originally written in Python,<ref>[https://web.archive.org/web/20250212102144/http://www2.aff4.org/ AFF4 - The Advanced Forensics File Format - Internet Archive copy]</ref> however the format appears to have become closed: papers documenting format are not publicly available,<ref>[https://www.magnetforensics.com/blog/aff4-aff4-l-an-open-standard-for-forensic-imaging/ AFF4 & AFF4-L -- An Open Standard for Forensic Imaging - Magnet Forensics blog]</ref> despite the blog entry is titled as "Open Standard". The associated tool is also offered as trialware only.<ref>[https://www.magnetforensics.com/blog/updates-in-magnet-axiom-4-2-include-support-for-aff4-skype-warrant-returns-and-whatsapp/ Updates in Magnet AXIOM 4.2 Include Support for AFF4, Skype Warrant Returns, and WhatsApp - Magnet Forensics blog]</ref>

== Software ==
* [https://github.com/sshock/AFFLIBv3 Philip (sshock) Hellewell's AFFLIB version 3 - GitHub] offers toolkit for working with AFF images.<ref>[https://github.com/sshock/AFFLIBv3/blob/master/tools/Makefile.am#L1-L2 Makefile.am lines 1-2 - AFFLIBv3 - GitHub]</ref>
* [https://www.exterro.com/digital-forensics-software/ftk-imager Exterro FTK Imager] (trialware, mostly Windows-only) - supports the AFF4 format and execution on portable drives (as of FTK Imager 4.7)
* [https://www.magnetforensics.com/blog/updates-in-magnet-axiom-4-2-include-support-for-aff4-skype-warrant-returns-and-whatsapp/ Magnet AXIOM 4.2 and Magnet AXIOM Cyber 4.2 download link] (trialware) - Mentioned as blog entry, the software is available only at customer portal that is linked in this URL.
* [[The Sleuth Kit and Autopsy]] - supports AFF image format.<ref>[http://wiki.sleuthkit.org/index.php?title=Reference_Documents Reference Documents - SleuthKitWiki]</ref>

== Links ==
* [https://github.com/sshock/AFFLIBv3 Philip (sshock) Hellewell's AFFLIB version 3 - GitHub]
* [https://github.com/simsong/AFFLIBv3 Simon L. (simsong) Garfinkel's AFFLIB version 3 (archived repository) - GitHub]
* [https://web.archive.org/web/20081208033442/https://www.afflib.org/ Internet Archive's copy of afflib.org, current website is occupied by web squatter]
* [https://github.com/google/rekall Rekall Memory Forensic Framework (archived repository) - GitHub] - For evaluating AFF4 imaging technology

== References ==
<references/>

[[Category:Forensics and Law Enforcement]]