AFFlib

The Advanced Forensic Format (AFF) is on-disk format for storing computer forensic information. Critical features of AFF include:

• AFF allows you to store both computer forensic data and associated metadata in one or more files.
• AFF allows files to be digital signed, to provide for chain-of-custody and long-term file integrity.
• AFF allows for forensic disk images to stored encrypted and decrypted on-the-fly for processing. This allows disk images containing privacy sensitive material to be stored on the Internet.
• AFF is an open format unencumbered by copyright or patent protection. The AFFLIB library that implements AFF is available for use in both Open Source and proprietary tools.

Commands

The following commands are included:

• affcat Extracts and displays the contents (segments) of an AFF file, useful for viewing metadata or image chunks.

• affcompare Compares two AFF files to ensure they are identical at the segment level, including image data and metadata.

• affconvert Converts AFF files between formats (e.g., from AFF to RAW, or vice versa), or between different AFF variants (like AFD or AFM).

• affcopy Copies an AFF file from one format to another, often used to transfer data while preserving metadata and structure.

• affcrypto Manages encryption and decryption of AFF files using passphrases or keys; supports cryptographic operations for secure data handling.

• affdiskprint Prints information about the disk image stored in an AFF file, such as disk geometry, partitions, and metadata.

• affinfo Displays general information about an AFF file — including format version, segment list, and optional metadata.

• affix Appends additional metadata or evidence to an existing AFF file, such as tags, comments, or case info.

• affrecover Attempts to recover readable data from a corrupted or partially unreadable AFF file.

• affsegment Creates or modifies individual AFF segments; allows manual segment-level editing.

• affsign Digitally signs an AFF file to prove authenticity and ensure chain of custody.

• affstats Provides statistics about an AFF file, such as compression ratios, segment counts, and sizes.

• affuse Mounts an AFF file as a user-space filesystem (via FUSE), allowing direct access to the disk image as if it were mounted.

• affverify Verifies the integrity of an AFF file using embedded hashes and checksums.

• affxml Extracts metadata from AFF files and outputs it in XML format for use in other forensic or analytical tools.