Current AFFLIB version: afflib-3.1.6 [download now]
AFF is an Open Format
By Open, we mean that the AFF format is clearly documented and that it may be used without the payment of royalties or license fees. This may not be the case with other disk image forensic formats. At this website you will also find AFFLIB, a high-performance AFF implementation. AFFLIB has been incorporated into Brian Carrier's Sleuth Kit and Autopsy, two popular open source digital forensic programs..AFF Advantages
Because AFF is open, users are not locked into a proprietary format that may limit how data is acquired or analyzed. or she may analyze it. Beyond being open, AFF has a number of technical advantages over other popular file formats:- AFF can store an entire disk image and associated information in a single file, which may potentially be many gigabytes in size, or split into multiple files.
- AFF can store an arbitrary amount of metadata, including user-defined and tool-specific metadata.
- AFF implements the LZMA compression system, which can produce disk image files that are dramatically smaller than other tools on the market today. Compared with the Expert Witness format used by EnCase and other tools, AFF images are typically 30% to 50% smaller.
- AFF can record the chain-of-custody for digital evidence.
- AFF supports encryption using AES256 and X.509 public key certificates.
AFFLIB and AFF Tools
AFFLIB is an open source library developed by Simson Garfinkel and Basis Technology that implements the AFF standard. AFFLIB is distributed under 4-clause Berkeley License and may be freely incorporated into both Open Source and Proprietary software.In addition to the library, AFFLIB also comes with the AFF Tools, a set of programs for creating and manipulating AFF files.
Find Out More!
More information about AFF can be found in the:- AFF Entry of the Forensics Wiki. We have also created a PDF file which explains some of AFF's features.
- Brian Carrier's AFF PowerPoint Presentation