AFF Acquisition
| Format | AFF Acquisition |
|---|---|
| Short name | AFF |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Advanced Forensic Format (AFF) — an open disk acquisition format from AFFLIB, written by tools such as affconvert and FTK Imager. The disk is stored in compressed pages beside named metadata segments, which can hold the acquisition's own MD5/SHA1 of the disk and a count of bad sectors. AFF can be encrypted. An AFD is the same acquisition split over several .aff files in a folder whose name ends in .afd; an AFM keeps the metadata in an AFF file and the disk data in a separate raw file. A page the acquisition declares but doesn't hold reads as the image's bad-sector marker, not as data from the device. AFF4, the later successor, is a different format.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 41 46 46 31 30 0D 0A 00 | AFF10... | AFF signature ('AFF10' + control bytes), in every file of an AFD |
Known extensions
.aff, .afm
References
- Advanced Forensics Format (Forensics Wiki) https://forensics.wiki/aff/
- AFFLIB — the reference implementation https://github.com/sshock/AFFLIBv3
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “AFF Acquisition”. https://kalink0.github.io/crush-forensics/formats/aff/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction