Anonymoususer852: /* Software */ Add The Sleuth Kit and Autopsy

2025-08-16T04:46:17Z

‎Software: Add The Sleuth Kit and Autopsy

Anonymoususer852: Added compression type, appears to be lossless when looking at AFFLib v3 which includes LZMA SDK.

2025-08-16T04:43:34Z

Added compression type, appears to be lossless when looking at AFFLib v3 which includes LZMA SDK.

Anonymoususer852: Created page with "{{FormatInfo |formattype=electronic |subcat=Disk Image Formats |extensions={{ext|aff}} |locfdd={{LoCFDD|fdd000412}}(v1), {{LoCFDD|fdd000413}}(v4) |pronom={{PRONOM|fmt/844}} |w..."

2025-08-16T04:41:23Z

Created page with "{{FormatInfo |formattype=electronic |subcat=Disk Image Formats |extensions={{ext|aff}} |locfdd={{LoCFDD|fdd000412}}(v1), {{LoCFDD|fdd000413}}(v4) |pronom={{PRONOM|fmt/844}} |w..."

New page

{{FormatInfo
|formattype=electronic
|subcat=Disk Image Formats
|extensions={{ext|aff}}
|locfdd={{LoCFDD|fdd000412}}(v1), {{LoCFDD|fdd000413}}(v4)
|pronom={{PRONOM|fmt/844}}
|wikidata={{wikidata|Q27473543}}
|magic=41 46 46
|developed by=Simson L. Garfinkel and Basis Technology
|maintained by=Phillip Hellewell (v3 only)
}}
'''Advanced Forensics Format''' is an open-source format developed originally by Basis Technology and Simson L. Garfinkel, and is maintained by Phillip Hellewell<ref>[https://github.com/sshock/AFFLIBv3 AFFLIB version 3 - GitHub]</ref>, that:
* Is designed to support precision forensics using compression, encryption, and segmentation, <ref>[https://www.cybertriage.com/glossary-term/advanced-forensic-format-aff/ Advanced Forensic Format (AFF) - Cyber Triage]</ref> As well as an alternative to current proprietary disk image formats.<ref>[https://cs.harvard.edu/malan/publications/aff.pdf Advanced Forensic Format: An open, extensible format for disk imaging - S. Garfinkel, D. Malan, K. Dubec, C. Stevens and C. Pham - Computer Science of Harvard University]</ref>,
* Offers two significant benefits. First, it is more flexible due to allowing extensive metadata to be stored with metadata. Second, AFF images consume less disk space than disk images in other formats (e.g., [[Expert Witness|EnCase image]]s).<ref>[https://cs.harvard.edu/malan/publications/aff.pdf Advanced Forensic Format: An open, extensible format for disk imaging - S. Garfinkel, D. Malan, K. Dubec, C. Stevens and C. Pham - Computer Science of Harvard University]</ref>
* Is a library that is available for use in both Open Source and proprietary tools implementing AFF.

The last format that offers Open Source tooling is based on the version 3, and it is still presently maintained by Phillip Hellewell. Advanced Forensics Format version 4 (AFF4) was originally written in Python,<ref>[https://web.archive.org/web/20250212102144/http://www2.aff4.org/ AFF4 - The Advanced Forensics File Format - Internet Archive copy]</ref> however the format appears to have become closed: papers documenting format are not publicly available,<ref>[https://www.magnetforensics.com/blog/aff4-aff4-l-an-open-standard-for-forensic-imaging/ AFF4 & AFF4-L -- An Open Standard for Forensic Imaging - Magnet Forensics blog]</ref> despite the blog entry is titled as "Open Standard". The associated tool is also offered as trialware only.<ref>[https://www.magnetforensics.com/blog/updates-in-magnet-axiom-4-2-include-support-for-aff4-skype-warrant-returns-and-whatsapp/ Updates in Magnet AXIOM 4.2 Include Support for AFF4, Skype Warrant Returns, and WhatsApp - Magnet Forensics blog]</ref>

== Software ==
* [https://github.com/sshock/AFFLIBv3 Philip (sshock) Hellewell's AFFLIB version 3 - GitHub] offers toolkit for working with AFF images.<ref>[https://github.com/sshock/AFFLIBv3/blob/master/tools/Makefile.am#L1-L2 Makefile.am lines 1-2 - AFFLIBv3 - GitHub]</ref>
* [https://www.exterro.com/digital-forensics-software/ftk-imager Exterro FTK Imager] (trialware, mostly Windows-only) - supports the AFF4 format and execution on portable drives (as of FTK Imager 4.7)
* [https://www.magnetforensics.com/blog/updates-in-magnet-axiom-4-2-include-support-for-aff4-skype-warrant-returns-and-whatsapp/ Magnet AXIOM 4.2 and Magnet AXIOM Cyber 4.2 download link] (trialware) - Mentioned as blog entry, the software is available only at customer portal that is linked in this URL.

== Links ==
* [https://github.com/sshock/AFFLIBv3 Philip (sshock) Hellewell's AFFLIB version 3 - GitHub]
* [https://github.com/simsong/AFFLIBv3 Simon L. (simsong) Garfinkel's AFFLIB version 3 (archived repository) - GitHub]
* [https://web.archive.org/web/20081208033442/https://www.afflib.org/ Internet Archive's copy of afflib.org, current website is occupied by web squatter]
* [https://github.com/google/rekall Rekall Memory Forensic Framework (archived repository) - GitHub] - For evaluating AFF4 imaging technology

== References ==
<references/>

[[Category:Forensics and Law Enforcement]]

@@ Line 22: / Line 22: @@
 * [https://www.exterro.com/digital-forensics-software/ftk-imager Exterro FTK Imager] (trialware, mostly Windows-only) - supports the AFF4 format and execution on portable drives (as of FTK Imager 4.7)
 * [https://www.magnetforensics.com/blog/updates-in-magnet-axiom-4-2-include-support-for-aff4-skype-warrant-returns-and-whatsapp/ Magnet AXIOM 4.2 and Magnet AXIOM Cyber 4.2 download link] (trialware) - Mentioned as blog entry, the software is available only at customer portal that is linked in this URL.
 == Links ==

@@ Line 6: / Line 6: @@
 |pronom={{PRONOM|fmt/844}}
 |wikidata={{wikidata|Q27473543}}
 |magic=41 46 46
 |developed by=Simson L. Garfinkel and Basis Technology

Advanced Forensics Format - Revision history

Anonymoususer852: /* Software */ Add The Sleuth Kit and Autopsy

Anonymoususer852: Added compression type, appears to be lossless when looking at AFFLib v3 which includes LZMA SDK.

Anonymoususer852: Created page with "{{FormatInfo |formattype=electronic |subcat=Disk Image Formats |extensions={{ext|aff}} |locfdd={{LoCFDD|fdd000412}}(v1), {{LoCFDD|fdd000413}}(v4) |pronom={{PRONOM|fmt/844}} |w..."