Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow

Forensic analysis requires the acquisition and management of many different types of evidence, including individual disk drives, RAID sets, network packets, memory images, and extracted files. Often the same evidence is reviewed by several different tools or examiners in different locations. We propose a backwards-compatible redesign of the Advanced Forensic Formatdan open, extensible file format for storing and sharing of evidence, arbitrary case related information and analysis results among different tools. The new specification, termed AFF4, is designed to be simple to implement, built upon the well supported ZIP file format specification. Furthermore, the AFF4 implementation has downward comparability with existing AFF files.

Hash based disk imaging using AFF4

Forensic imaging has been facing scalability challenges for some time. As disk capacity growth continues to outpace storage IO bandwidth, the demands placed on storage and time are ever increasing. Data reduction and de-duplication technologies are now commonplace in the Enterprise space, and are potentially applicable to forensic acquisition. Using the new AFF4 forensic file format we employ a hash based compression scheme to leverage an existing corpus of images, reducing both acquisition time and storage requirements. This paper additionally describes some of the recent evolution in the AFF4 file format making the efficient implementation of hash based imaging a reality.

No evidence for association of ataxia-telangiectasia mutated gene T2119C and C3161G amino acid substitution variants with risk of breast cancer

Background There is evidence that certain mutations in the double-strand break repair pathway ataxia-telangiectasia mutated gene act in a dominant-negative manner to increase the risk of breast cancer. There are also some reports to suggest that the amino acid substitution variants T2119C Ser707Pro and C3161G Pro1054Arg may be associated with breast cancer risk. We investigate the breast cancer risk associated with these two nonconservative amino acid substitution variants using a large Australian population-based case–control study. Methods The polymorphisms were genotyped in more than 1300 cases and 600 controls using 5' exonuclease assays. Case–control analyses and genotype distributions were compared by logistic regression. Results The 2119C variant was rare, occurring at frequencies of 1.4 and 1.3% in cases and controls, respectively (P = 0.8). There was no difference in genotype distribution between cases and controls (P = 0.8), and the TC genotype was not associated with increased risk of breast cancer (adjusted odds ratio = 1.08, 95% confidence interval = 0.59–1.97, P = 0.8). Similarly, the 3161G variant was no more common in cases than in controls (2.9% versus 2.2%, P = 0.2), there was no difference in genotype distribution between cases and controls (P = 0.1), and the CG genotype was not associated with an increased risk of breast cancer (adjusted odds ratio = 1.30, 95% confidence interval = 0.85–1.98, P = 0.2). This lack of evidence for an association persisted within groups defined by the family history of breast cancer or by age. Conclusion The 2119C and 3161G amino acid substitution variants are not associated with moderate or high risks of breast cancer in Australian women.