From 78ff633bd1844c80628ead7a59cf2a9a84f91e06 Mon Sep 17 00:00:00 2001 From: Joachim Metz Date: Mon, 26 Oct 2026 03:44:35 +0100 Subject: [PATCH] Changes related to documentation --- COPYING | 2 +- README | 52 +++++++++++++++++++++++++---------------- include/afflib/afflib.h | 2 +- 3 files changed, 34 insertions(+), 22 deletions(-) diff --git a/COPYING b/COPYING index 7d06192..65698b7 100644 --- a/COPYING +++ b/COPYING @@ -44,7 +44,7 @@ advertising requirement when requested: * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. + * SUCH DAMAGE. * * AFF and AFFLIB is a trademark of Simson Garfinkel and Basis Technology Corp. */ diff --git a/README b/README index b862c16..88a2b6a 100644 --- a/README +++ b/README @@ -7,19 +7,37 @@ 2014-2025 Phillip Hellewell The Advanced Forensic Format (AFF) is on-disk format for storing -computer forensic information. Critical features of AFF include: +computer forensic information. - - AFF allows you to store both computer forensic data and associated - metadata in one or more files. +Project information: - - AFF allows files to be digital signed, to provide for + * Status: maintenance mode, since AFF4 supersedes AFF + * License: Original 4-Clause BSD License + +Supported AFF formats and features: + + * AFF version 1, 2 and 3 + * zlib, LZMA1 and zero-page compression + * AFF directory (AFD) segmented format + +Unsupported AFF formats and features: + + * bzip2 compression + + +Critical features of AFF include: + + * AFF allows you to store both computer forensic data and associated + metadata in one or more files. + + * AFF allows files to be digital signed, to provide for chain-of-custody and long-term file integrity. - - AFF allows for forensic disk images to stored encrypted and + * AFF allows for forensic disk images to stored encrypted and decrypted on-the-fly for processing. This allows disk images containing privacy sensitive material to be stored on the Internet. - - AFF is an open format unencumbered by copyright or patent + * AFF is an open format unencumbered by copyright or patent protection. The AFFLIB library that implements AFF is available for use in both Open Source and proprietary tools. @@ -28,14 +46,14 @@ forensic information. Using these tools you can: * Interconvert disk images between a variety of formats, including: - - raw or "dd" - - splitraw (in which a single image is split between mulitple files) - - AFF format (in which the entire disk image is stored in a single file.) - - AFD format (in which a disk image is stored in mulitple AFF files + * raw or "dd" + * splitraw (in which a single image is split between mulitple files) + * AFF format (in which the entire disk image is stored in a single file.) + * AFD format (in which a disk image is stored in mulitple AFF files stored in a single directory.) - - AFM format (in which an AFF file is used to annotate a raw file.) + * AFM format (in which an AFF file is used to annotate a raw file.) - * Compare disk images and report the data or metadata that is different. + * Compare disk images and report the data or metadata that is different. * Copy disk images from one location to another, with full verification of data, metadata, and the automatic generation of a @@ -55,6 +73,7 @@ forensic information. Using these tools you can: fingerprinted without having the computer the SHA1 of the entire disk. + AFFLIBv3 implements version 3 of the AFF format. This version is currently in maintenance mode while work on AFFv4 continues. Key differences between AFFv3 and AFFv4 include: @@ -66,9 +85,8 @@ differences between AFFv3 and AFFv4 include: is licensed an approved Open Source license. - AFFLIB and Toolkit is provided in source code form for Linux, MacOS -and Windows. We have also created a Windows zipfile that contains: +and Windows. We have also created a Windows ZIP file that contains: * precompiled versions of the AFFLIB tools and all of the libraries necessary to run them. @@ -91,12 +109,6 @@ supports. To use the other image formats, specify the image type as # fls -o 63 -i afflib foo.vmdk - -================ -Note: AFF and AFFLIB are trademarks of Simson L. Garfinkel and Basis -Technology, Inc. - - # Local Variables: # mode: auto-fill # mode: flyspell diff --git a/include/afflib/afflib.h b/include/afflib/afflib.h index ef1a069..4fb24e9 100644 --- a/include/afflib/afflib.h +++ b/include/afflib/afflib.h @@ -452,7 +452,7 @@ int af_hash_verify_seg2(AFFILE *af,const char *segname,unsigned char *sigbuf_,si #define AF_PAGE_COMP_MAX 0x0002 // compressed at maximum; nice to know #define AF_PAGE_COMP_ALG_MASK 0x00F0 // up to 16 compression algorithms may be used #define AF_PAGE_COMP_ALG_ZLIB 0x0000 -#define AF_PAGE_COMP_ALG_BZIP 0x0010 // not implemented; why bother? +#define AF_PAGE_COMP_ALG_BZIP 0x0010 // originally reserved for bzip2 compression but never implemented #define AF_PAGE_COMP_ALG_LZMA 0x0020 // high compression but pretty slow #define AF_PAGE_COMP_ALG_ZERO 0x0030 // Data segment is a 4-byte value of # of NULLs.