Current AFFLIB version: afflib-3.2.5 [download now][sig]
AFF Advantages
AFF has a number of technical advantages over other popular file formats:
- AFF can store an entire disk image and associated information in a single file, which may potentially be many gigabytes in size, or split into multiple files.
- AFF supports encryption using AES256 and X.509 public key certificates. Other formats store a “password” in the disk image which doesn’t actually protect the data at all.
- AFF supports digital signatures using X.509 public key certificates. Other formats merely record the cryptographic hash of a disk image, and leave it up to the investigator to write this hash in a safe place.
- AFF can store an arbitrary amount of metadata, including user-defined and tool-specific metadata.
- AFF can record the chain-of-custody for digital evidence.
AFFLIB and AFF Tools
AFFLIB is an Open Source Library for developing computer forensic tools. By using AFFLIB’s af_open(), af_read(), and af_seek() API, your open source computer forensic tool will be to automatically detect and use disk images in any of the following formats:- Raw disk images (e.g. file.raw)
- Split raw (file.001, file.002, file.002, etc.)
- EnCase (file.E01)
- AFF (file.aff)
- AFD, a version of AFF where the AFF files are all stored in a single “AFD” directory. (Useful on file systems that do not support files larger than 2GB, or for splitting a disk image for archiving to CDR or DVD.)
- AFM, a version of AFF where the data is stored in one or more raw files and the metdata is stored in an AFM file.
- S3, Amazon’s Simple Storage Service (useful for building large-scale forensic applications.)
AFFLIB transparently supports disk images that are digitally signed or encrypted using the AFF 3.0 encryption standard.
In addition to the library, AFFLIB also comes with the AFF Tools, a set of programs for creating and manipulating AFF files:
- afcat, sends the copy of a disk image to standard output (or another file).
- afcompare, compares the data and metadata of two disk images and reports the differences in an intelligent manner.
- afconvert, changes the format of a disk image from one standard to another one.
- afcopy, makes a copy of a disk image from one location to another, optionally adding a chain-of-custody segment.
- afcrypto, changes the encryption options of a disk image.
- affix, fixes corrupt disk images.
- afinfo, reports information about a disk image.
- afrecover, which recovers corrupted disk images using AFF parity pages.
- afsegment, for manipulating specific AFF segments within a file
- afsign, digitally signs an AFF image
- afstats, prints statistics about an AFF file.
- afverify, verifies the digital signatures on an AFF file.
- afxml, outputs the metadata of an AFF file in XML
AFF is an Open Format
By open, we mean that the AFF format is clearly documented and that it may be used without the payment of royalties or license fees. This may not be the case with other disk image forensic formats. At this website you will also find AFFLIB, a high-performance AFF implementation. AFFLIB has been incorporated into Brian Carrier's Sleuth Kit and Autopsy, two popular open source digital forensic programs.
AFFLIB is Open Source Software
AFFLIB is an open source library developed by Simson Garfinkel and Basis Technology that implements the AFF standard. AFFLIB is distributed under 4-clause Berkeley License and may be freely incorporated into both Open Source and proprietary software.Find Out More!
More information about AFF can be found in the:- The AFF Entry of the Forensics Wiki
- Review our AFF Publications.