AFF is open and extensible, and unencumbered by patents and trade secrets. After evaluating several of the existing alternatives for storing disk images, we decided to create the new Advanced Forensic Format (AFF TM ) for our forensic work. When metadata is not stored in the image file itself, there is a chance that it will become separated from the image file and lost or even confused with the metadata of another drive.
Prodiscover basic advantages serial#
Because a raw image is a sector-for-sector copy of the drive under investigation, the file cannot store metadata such as the drive s serial number, the name of the investigator who performed the acquisition, or the date on which the disk was imaged. A second problem with raw images is the storage of data about the image itself, i.e., its metadata. Because many forensic tools require random access to captured data just like a file system requires random access to a physical disk, disk images that are compressed must be decompressed before they can be used. But neither gzip nor bzip2 allowĢ 18 ADVANCES IN DIGITAL FORENSICS II random access within a compressed file. The obvious way to solve the problem of data storage is to use a file compressor like gzip or bzip2. However, raw images are not compressed, as a result, they can be very large even if the drive itself contained very little data. Raw images are widely used because they work with practically every forensic tool available today. Some practitioners make a sector-for-sector copy of the original disk to a second drive that is the same size as the original. In these cases, it is common practice to copy the drive s contents sector-for-sector into a single file, a so-called raw or dd copy. Police might raid a drug dealer s apartment and seize a computer that was used for contacting suppliers. A wife might bring her spouse s laptop to an examiner to make a copy a few days before she files for divorce. Introduction Most forensic practitioners work with just one or a few disks at a time. Keywords: Disk imaging, image storage, Advanced Forensic Format (AFF) 1. This paper also describes the Advanced Disk Imager (AImage), a new program for acquiring disk images that compares favorably with existing alternatives. Second, AFF images consume less disk space than images in other formats (e.g., EnCase images). First, it is more flexible because it allows extensive metadata to be stored with images. Pham Abstract This paper describes the Advanced Forensic Format (AFF), which is designed as an alternative to current proprietary disk image formats. 1 Chapter 2 ADVANCED FORENSIC FORMAT: AN OPEN, EXTENSIBLE FORMAT FOR DISK IMAGING S.