AFFLib

The Advanced Forensic Format (AFF) is an on-disk format for storing computer forensic data and associated metadata in one or more files. Key features include digital signing for chain-of-custody and integrity, on-the-fly encryption/decryption for privacy-sensitive material, and support for multiple image formats like raw/dd, splitraw, AFF, AFD, and AFM. The AFF Toolkit offers programs to interconvert disk images, compare them, copy with verification, fix errors, and generate metadata reports.

Use cases include forensic investigations requiring secure storage and transport of disk images, especially over the internet. Tools support chain-of-custody documentation, rapid fingerprinting via XML diskprints, and handling of large images split across files or directories. It integrates with Amazon S3 for cloud storage and FUSE for mounting AFF containers as filesystems.

The package afflib-tools provides executables like affcat, affcompare, affconvert, and others for practical workflows in digital forensics.

AFF stores forensic data with metadata segments, supporting digital signatures for integrity and chain-of-custody. Images can be encrypted/decrypted on-the-fly using passphrases or public-key cryptography. Tools read/write AFF structures, verifying MACs, hashes (MD5/SHA1/SHA256), and signatures. Formats include single-file AFF, multi-file AFD directories, and annotated raw (AFM). FUSE integration allows mounting as virtual filesystems; S3 support enables cloud operations with MD5 validation.