Article ID | Journal | Published Year | Pages | File Type |
---|---|---|---|---|
457978 | Digital Investigation | 2009 | 12 Pages |
Abstract
Forensic analysis requires the acquisition and management of many different types of evidence, including individual disk drives, RAID sets, network packets, memory images, and extracted files. Often the same evidence is reviewed by several different tools or examiners in different locations. We propose a backwards-compatible redesign of the Advanced Forensic Format—an open, extensible file format for storing and sharing of evidence, arbitrary case related information and analysis results among different tools. The new specification, termed AFF4, is designed to be simple to implement, built upon the well supported ZIP file format specification. Furthermore, the AFF4 implementation has downward comparability with existing AFF files.
Related Topics
Physical Sciences and Engineering
Computer Science
Computer Networks and Communications
Authors
Michael Cohen, Simson Garfinkel, Bradley Schatz,