Extending the Advanced Forensic Format to Accommodate Multiple Data Sources, Logical Evidence, Arbitrary Information and Forensic Workflow

Abstract

Forensic analysis requires the acquisition and management of many different types of evidence, including individual disk drives, RAID sets, network packets, memory images and extracted files. Often the same evidence is reviewed by several different tools or examiners in different locations. We propose a backwards-compatible redesign of the Advanced Forensic Format -- an open, extensible file format for storing and sharing of evidence, arbitrary case related information and analysis results among different tools. The new specification, termed AFF4, is designed to be simple to implement, built upon the well supported ZIP file format specification. Furthermore, the AFF4 implementation has downward comparability with existing AFF files.

Open PDF

Document Details

Document Type
Technical Report
Publication Date
Jan 01, 2009
Accession Number
ADA549440

Entities

People

  • Bradley Schatz
  • Michael Cohen
  • Simson Garfinkel

Tags

Communities of Interest

  • Advanced Electronics
  • Cyber

DTIC Thesaurus Topics

  • Acquisition
  • Application Protocols
  • Computational Forensics
  • Computer Network Security
  • Computer Science
  • Computers
  • Computing System Architectures
  • Cryptography
  • Data Storage Systems
  • Directories
  • Electronic Mail
  • Forensic Analysis
  • Notation
  • Operating Systems
  • Security
  • Specifications
  • Standards

Fields of Study

  • Computer science

Readers

  • Computer Science/Computer Engineering/Data Science/Digital Signal Processing.
  • Database Systems and Applications
  • Distributed Systems and Data Platform Development