aff4tools - Access to the Advanced Forensic Format 4

The Advanced Forensic Format v4 (AFF4) is an open source file format used for the storage of digital data and evidence. The format is defined in a Standard with canonical reference images.

This project is a Rust implementation for reading, writing, and validating AFF4 and AFF4-L evidence files. aff4tools provides a command-line tool and a library.

Command line usage

Usage: aff4tools <COMMAND> [command options]

Commands:

• info - Detailed or summary information about an .aff4 container's metadata
• verify - Recompute a container's hash digests
• conformance - Check a container's conformance to the AFF4 Standard v1.0a
• acquire - acquire a block device, logical folder or files, or image file to .aff4. Experimental!
• export - copy out a disk image from .aff4 to raw dd; or export files out of an AFF4-L. Even more experimental.
• help - Print this message or the help for the given command(s) (e.g. aff4tools info --help)

Compile and run

You need a Rust environment first. See step-by-step compilation instructions.

git clone https://github.com/jbolas/aff4tools aff4tools
cd aff4tools
cargo build --release

Possible uses

The AFF4 format for digital evidence has existed since ~2009 with elaboration and standardization occurring in the decade that followed. (Primary credit and respect to Dr. Bradley Schatz and Michael Cohen for work to develop the format.) Tools from major commercial software companies now create evidence containers in .aff4 format, but they vary in terms of hash digests and metadata content. To date, only the pyaff4 reference implementation offers open-source hash verification.

aff4tools may prove useful to information security practitioners for:

• Comparing tool output when validating other .aff4 readers and writers.
• Checking the conformance to Standard of .aff4 containers created by a different writer.
• Verification hashing without need of a commercial tool.
• Creating sample .aff4 containers for tool testing.
• Education about the .aff4 format, including its internal structure and support for block hashes.
• Experimenting with the library for use with existing open source forensic tools.
• Surfacing potential issues with the AFF4 format's scalability for large datasets.
• Driving the evolution of the Standard and the interoperability of AFF4-supporting tools.

What aff4tools doesn't do (for now)

1. Initial commit builds and passes tests for macOS and Linux, but Linux needs a lot more testing. No Windows support.
2. Support for AFF4-L (logical) volumes is in an experimental alpha state, awaiting more canonical reference images. Logical volumes can't be written to split-file aff4s.
3. Deduplicated AFF4-L files have a stub implementation per Specification but should not be used for casework.
4. Encrypted AFF4s are discussed in the literature but not formally specified or supported.
5. Cannot append new data to an existing container.
6. Doesn't gracefully handle symlinks and firm links. The AFF4-L spec doesn't cover symlinks.
7. No binaries released at this time, because signed Mac binaries are a whole thing. See compilation instructions.

Has it been tested?

The aff4tools project includes over 650 unit and integration tests using canonical reference images, intentionally malformed aff4s, and synthetic .aff4 data created with other available writers. Users are invited to review source code for themselves. But no amount of tool testing is ever enough for DFIR! If you have sample AFF4 files available to add to integration tests, please contact the developer to contribute them. This project could use more real-world test samples created by commercial tools.

Caveat emptor

Project code generated by Claude Opus 4.8. Current version should be considered experimental. Validate results with alternate tools. Released under the MIT License with special enthusiasm for the part in all caps.

Further reading

[1] "Advanced Forensic Framework 4 (AFF4)." https://forensics.wiki/aff4/

[2] Cohen, Garfinkel, Schatz (2009) “Extending the Advanced Forensic Format to Accommodate Multiple Data Sources, Logical Evidence, Arbitrary Information and Forensic Workflow.” https://dfrws.org/presentation/extending-the-advanced-forensic-format-to-accommodate-multiple-data-sources-logical-evidence-arbitrary-information-and-forensic-workflow/

[3] Cohen & Schatz (2010) “Hash based disk imaging using AFF4.” https://dfrws.org/presentation/hash-based-disk-imaging-using-aff4/

[4] Schatz (2015) “Wirespeed: Extending The AFF4 Container Format For Scalable Acquisition And Live Analysis.” https://dfrws.org/presentation/wirespeed-extending-the-aff4-container-format-for-scalable-acquisition-and-live-analysis/

[5] Schatz (2019) "AFF4-L: A Scalable Open Logical Evidence Container." https://www.dfrws.org/wp-content/uploads/2019/06/2019_USA_paper-aff4_l_a_scalable_open_logical_evidence_container.pdf

[6] Schatz (2021) "The AFF4 Evidence Container: Why and what’s next?" Magnet Virtual Summit webinar. https://www.youtube.com/watch?v=rQPgI7ozUS0