Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow
Data(s) |
01/08/2009
|
---|---|
Resumo |
Forensic analysis requires the acquisition and management of many different types of evidence, including individual disk drives, RAID sets, network packets, memory images, and extracted files. Often the same evidence is reviewed by several different tools or examiners in different locations. We propose a backwards-compatible redesign of the Advanced Forensic Formatdan open, extensible file format for storing and sharing of evidence, arbitrary case related information and analysis results among different tools. The new specification, termed AFF4, is designed to be simple to implement, built upon the well supported ZIP file format specification. Furthermore, the AFF4 implementation has downward comparability with existing AFF files. |
Identificador | |
Publicador |
Elsevier |
Relação |
DOI:10.1016/j.diin.2009.06.010 Cohen, Michael, Schatz, Bradley, & Garfinkel, Simson (2009) Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow. Digital Investigation, 6(Supplement), S57-S68. |
Direitos |
Copyright 2009 Elsevier |
Fonte |
Faculty of Science and Technology; Information Security Institute |
Palavras-Chave | #080303 Computer System Security #Computer forensics #Digital evidence #Evidence containers |
Tipo |
Journal Article |