Skip to content

Changes related to documentation #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joachimmetz wants to merge 1 commit into
base: master
Choose a base branch
from
+34 −22
Open

Changes related to documentation #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion COPYING
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ advertising requirement when requested:
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* SUCH DAMAGE.
*
* AFF and AFFLIB is a trademark of Simson Garfinkel and Basis Technology Corp.
*/
Expand Down
52 changes: 32 additions & 20 deletions README
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,19 +7,37 @@
2014-2025 Phillip Hellewell <sshock@gmail.com>

The Advanced Forensic Format (AFF) is on-disk format for storing
computer forensic information. Critical features of AFF include:
computer forensic information.

- AFF allows you to store both computer forensic data and associated
metadata in one or more files.
Project information:

- AFF allows files to be digital signed, to provide for
* Status: maintenance mode, since AFF4 supersedes AFF
* License: Original 4-Clause BSD License

Supported AFF formats and features:

* AFF version 1, 2 and 3
* zlib, LZMA1 and zero-page compression
* AFF directory (AFD) segmented format

Unsupported AFF formats and features:

* bzip2 compression


Critical features of AFF include:

* AFF allows you to store both computer forensic data and associated
metadata in one or more files.

* AFF allows files to be digital signed, to provide for
chain-of-custody and long-term file integrity.

- AFF allows for forensic disk images to stored encrypted and
* AFF allows for forensic disk images to stored encrypted and
decrypted on-the-fly for processing. This allows disk images
containing privacy sensitive material to be stored on the Internet.

- AFF is an open format unencumbered by copyright or patent
* AFF is an open format unencumbered by copyright or patent
protection. The AFFLIB library that implements AFF is available
for use in both Open Source and proprietary tools.

Expand All @@ -28,14 +46,14 @@ forensic information. Using these tools you can:

* Interconvert disk images between a variety of formats, including:

- raw or "dd"
- splitraw (in which a single image is split between mulitple files)
- AFF format (in which the entire disk image is stored in a single file.)
- AFD format (in which a disk image is stored in mulitple AFF files
* raw or "dd"
* splitraw (in which a single image is split between mulitple files)
* AFF format (in which the entire disk image is stored in a single file.)
* AFD format (in which a disk image is stored in mulitple AFF files
stored in a single directory.)
- AFM format (in which an AFF file is used to annotate a raw file.)
* AFM format (in which an AFF file is used to annotate a raw file.)

* Compare disk images and report the data or metadata that is different.
* Compare disk images and report the data or metadata that is different.

* Copy disk images from one location to another, with full
verification of data, metadata, and the automatic generation of a
Expand All @@ -55,6 +73,7 @@ forensic information. Using these tools you can:
fingerprinted without having the computer the SHA1 of the entire
disk.


AFFLIBv3 implements version 3 of the AFF format. This version is
currently in maintenance mode while work on AFFv4 continues. Key
differences between AFFv3 and AFFv4 include:
Expand All @@ -66,9 +85,8 @@ differences between AFFv3 and AFFv4 include:
is licensed an approved Open Source license.



AFFLIB and Toolkit is provided in source code form for Linux, MacOS
and Windows. We have also created a Windows zipfile that contains:
and Windows. We have also created a Windows ZIP file that contains:

* precompiled versions of the AFFLIB tools and all of the libraries
necessary to run them.
Expand All @@ -91,12 +109,6 @@ supports. To use the other image formats, specify the image type as
# fls -o 63 -i afflib foo.vmdk



================
Note: AFF and AFFLIB are trademarks of Simson L. Garfinkel and Basis
Technology, Inc.


# Local Variables:
# mode: auto-fill
# mode: flyspell
Expand Down
2 changes: 1 addition & 1 deletion include/afflib/afflib.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,7 +452,7 @@ int af_hash_verify_seg2(AFFILE *af,const char *segname,unsigned char *sigbuf_,si
#define AF_PAGE_COMP_MAX 0x0002 // compressed at maximum; nice to know
#define AF_PAGE_COMP_ALG_MASK 0x00F0 // up to 16 compression algorithms may be used
#define AF_PAGE_COMP_ALG_ZLIB 0x0000
#define AF_PAGE_COMP_ALG_BZIP 0x0010 // not implemented; why bother?
#define AF_PAGE_COMP_ALG_BZIP 0x0010 // originally reserved for bzip2 compression but never implemented
#define AF_PAGE_COMP_ALG_LZMA 0x0020 // high compression but pretty slow
#define AF_PAGE_COMP_ALG_ZERO 0x0030 // Data segment is a 4-byte value of # of NULLs.

Expand Down