AFF4 Acquisition
| Format | AFF4 Acquisition |
|---|---|
| Short name | AFF4 |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Advanced Forensic Format 4 — an acquisition format stored as a ZIP64 container. The acquired data is held in compressed, chunked image streams, mapped onto the source's address space by map streams, with RDF metadata (information.turtle) describing source, acquisition and streams; the volume URI (aff4://...) is in the ZIP comment and in container.description. A container can be striped across several .aff4 files. Stores hashes of streams, chunks, maps and of the whole source, so the acquisition can be verified. Used for disk images and for memory acquisitions: sparse maps represent physical memory with gaps, and the metadata category (e.g. aff4:category memory/physical) tells which one an image holds. Variants: encrypted AFF4 and AFF4-L for logical evidence.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 61 66 66 34 3A 2F 2F | aff4:// | A ZIP whose comment holds the aff4:// volume URI, or whose first member is container.description |
Known extensions
.aff4
References
- AFF4 Standard (aff4/Standard) https://github.com/aff4/Standard
- pyaff4 — the AFF4 reference implementation https://github.com/aff4/pyaff4
- ForensicsWiki — Advanced Forensic Framework 4 (AFF4) https://forensics.wiki/aff4/
- Cohen, Garfinkel, Schatz — Extending the Advanced Forensic Format to accommodate Multiple Data Sources, Logical Evidence, Arbitrary Information and Forensic Workflow (DFRWS 2009) https://dfrws.org/presentation/extending-the-advanced-forensic-format-to-accommodate-multiple-data-sources-logical-evidence-arbitrary-information-and-forensic-workflow/
- Schatz — AFF4-L: A scalable open logical evidence container (DFRWS 2019) https://dfrws.org/presentation/aff4-l-a-scalable-open-logical-evidence-container/
- The AFF4 Imager — documentation (incl. memory acquisition) https://aff4-imager.readthedocs.io/en/latest/
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “AFF4 Acquisition”. https://kalink0.github.io/crush-forensics/formats/aff4/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction