PAGES
← all tools
◆ Digital Forensics & Incident Response

afflib

v3.7.5 open-source

AFFLIB is a library and toolkit implementing the Advanced Forensic Format for storing computer forensic disk images and associated metadata.

Summary

afflib is an open-source library and command-line toolkit for storing and converting computer forensic disk images in the Advanced Forensic Format, and it is free to use. It works both as a library that other programs link against and as a set of command-line tools, so investigators can convert between raw, split-raw, AFD, and AFM formats, compare images, copy them with chain-of-custody metadata, and check files for errors. This puts it in the hands of forensic examiners and DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. practitioners handling disk acquisition rather than live incident response, and one documented use pairs it with SleuthKit for reading VMDK images. The README notes AFF itself is unencumbered by patents, with AFFLIBv3 now in maintenance mode while AFFv4 is developed separately. Development is slow: the project dates to 2012 with 16 contributors, but only 4 commits in the past year and its last release was 347 days ago.

AFFLIB is a library and toolkit implementing the Advanced Forensic Format for storing computer forensic disk images and associated metadata.

How afflib helps

Which format is this seized disk image actually stored in, and can it be converted to raw for another tool to read?

reads the header and metadata of the file, identifies whether it's raw, split-raw, AFF, AFD, or AFM, and converts between them without altering the underlying forensic data

Have these two copies of the same disk image diverged in their data or their metadata?

runs a comparison across both segments of content and metadata, and reports exactly which parts differ instead of just flagging a mismatch

Is this AFF file corrupted, and where?

scans the file's internal segments for errors and identifies which ones are damaged so they can be repaired or flagged before analysis continues

Can I move this image to another machine without breaking the chain of custody?

copies the image while verifying data and metadata against the source and appends a chain-of-custody segment recording the transfer

What acquisition details are embedded in this image's metadata?

extracts an XML representation of the disk image's metadata, such as acquisition time or the serial number of the acquiring device

Can I confirm this is the same disk without hashing the entire image again?

generates an XML diskprint that fingerprints the disk image without recomputing a full SHA1 over all its data

all 12 features, with the evidence for each →

Languages

Not documented

Features

12 capabilities

Built from afflib's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • afflib covers 1 of the 8 investigation and response capabilities we track.

What afflib offers you

  • Command-line interface3
Disk and filesystem forensics 9 features Investigation and response since 2005
Advanced Forensic Format (AFF) image support shipped Provides the capability to create, convert, and analyze disk images in the Advanced Forensic Format with support for metadata, encryption, and digital signing. 13 releases · 5 other sources · first seen Sep 2005

Shared capability: Disk and filesystem forensics

release 13 total

  • Adds -J flag to afcrypto CLI to print the total number of unencrypted segments 2009-12-13 Simson Garfinkel <simsong@Silver-Surfer.local> · Dec 2009 · source · release history
  • Adds -j flag to afcrypto CLI to print the total number of encrypted segments 2009-12-13 Simson Garfinkel <simsong@Silver-Surfer.local> · Dec 2009 · source · release history
  • Adds AF_VNODE_NO_SIGNING and AF_VNODE_NO_SEALING flags to control encryption and sealing behavior 2008-07-02 Simson Garfinkel <simsong@Silver-Surfer.local> · Jul 2008 · source · release history
  • Updates internal libewf support modules (lib/vnode_ewf.cpp) to maintain compatibility with circa 2007 versions of libewf. 2008-04-21 Simson L. Garfinkel <simsong@t.eecs.harvard.edu> · Apr 2008 · source · release history
  • Adds AF_SHA256 constant to lib/afflib.h for programmatic SHA256 support. 2007-06-29 Simson L. Garfinkel <simsong> · Jun 2007 · source · release history
  • aimage now supports SHA256 image hashing (requires linking against libncurses, not libcurses). 2007-06-29 Simson L. Garfinkel <simsong> · Jun 2007 · source · release history

docs

  • 2005-2013 Simson L. Garfinkel 2014-2025 Phillip Hellewell The AFF library can be downloaded from https://github.com/simsong/AFFLIBv3 seen Sep 2026 · source
  • Library and toolkit for creating, converting, and analyzing Advanced Forensic Format (AFF) disk images with metadata, encryption, and digital signing support.

example

  • Overwrite an existing AFF3 image file without manual deletion. afcopy -z source.img target.aff3 2006-10-27 Simson L. Garfinkel <simsong> · Oct 2006 · source
  • Verify if a file is a valid AFF image before processing. bool is_aff = af_identify("path/to/file"); 1.1 · Sep 2005 · source
  • Use AFFLIB image formats with SleuthKit fls -o 63 -i afflib foo.vmdk
Segment listing for metadata inspection shipped Allows listing only the names of segments in an AFF file to enable fast metadata inspection without reading full data contents. 3 releases · first seen May 2007

Shared capability: Disk and filesystem forensics

release

  • Includes new man pages authored by Joao Eriberto Mota Filho v3.7.5 · Oct 2014 · source · release history
  • Adds encrypted_count and signed_count to the output of aff_vstat for detailed AFF image metadata analysis. 2008-04-21 Simson L. Garfinkel <simsong@t.eecs.harvard.edu> · Apr 2008 · source · release history
  • Optimizes aff_get_seg to skip scanning the whole file when a segment is not in the ToC 2007-05-30 Simson Garfinkel <simsong> · May 2007 · source · release history
Passphrase environment variable configuration shipped Allows opening AFF images encrypted with a passphrase by setting the password via an environment variable instead of explicit arguments. 2 releases · 1 other source · first seen Aug 2007

Shared capability: Disk and filesystem forensics

Also counts toward: Command-line interface

release

  • Adds -e option to afcrypto for decryption operations 2010-04-12 Ryan Mayer <mrsolo@mayer-precision> · Apr 2010 · source · release history
  • lib/afflib.cpp (af_open_with) adds support for the AFFLIB_PASSPHRASE environment variable. 2007-08-29 Simson Garfinkel <simsong@m.ern.nps.edu> · Aug 2007 · source · release history

example

  • Open an AFF image in C/C++ code by setting the passphrase via environment variable instead of a file or string argument. #include "afflib.h" #include <cstdlib> int main() { setenv("AFFLIB_PASSPHRASE", "my_secret_passphrase", 1); affil_t *af = af_open_with("image.aff", O_RDONLY, 0644); if (af) { /* ... */ } return 0; } 2007-08-29 Simson Garfinkel <simsong@m.ern.nps.edu> · Aug 2007 · source
SCSI bus rescanning support shipped Enables automatic SCSI bus rescanning via scsi device paths to capture images from specific bus locations. 2 releases · 1 other source · first seen Dec 2005

Shared capability: Disk and filesystem forensics

Also counts toward: Command-line interface

release

  • Adds -X flag to afinfo to print segment names without data contents 2007-05-30 Simson Garfinkel <simsong> · May 2007 · source · release history
  • Adds automatic SCSI bus rescanning support in aimage via scsi device paths (FreeBSD only) 1.2.8 · Dec 2005 · source · release history

example

  • List only the names of segments in an AFF file for fast metadata inspection. afinfo -X image.aff 2007-05-30 Simson Garfinkel <simsong> · May 2007 · source
Disk pagesize query capability shipped Provides a library function to query the disk pagesize for a given AFFLIB file handle. 1 release · 1 other source · first seen Sep 2011

Shared capability: Disk and filesystem forensics

release

  • Adds af_get_pagesize(AFFILE *af) library function 2011-09-18 Simson Garfinkel <simsong@imac3.home> · Sep 2011 · source · release history

example

  • Query the disk pagesize for a given AFFLIB file handle. int page_size = af_get_pagesize(af); 2011-09-18 Simson Garfinkel <simsong@imac3.home> · Sep 2011 · source
Enhanced split filename handling shipped Generates extended split filenames using a revised logic (000-999 then A00-ZZ9) to prevent conflicts when the default naming limit is reached for large disk images. 1 release · 1 other source · first seen Apr 2011

Shared capability: Disk and filesystem forensics

release

  • Implements revised split_raw_increment_fname logic to generate split filenames from 000-999 then A00-ZZ9. 3.6.10 · Apr 2011 · source · release history

example

  • Generate extended AFFsplit output files when the default 000-999 naming limit is reached, preventing filename conflicts for large disk images. /* No shell command exposes this internal C++ function directly; it is used by affsplit/afflib internally during write operations. */ 3.6.10 · Apr 2011 · source
Reliable vnode support shipped Enables reliable vnode operations and defines specific vnode types for AFF images to ensure data integrity during access. 1 release · 1 other source · first seen Apr 2007

Shared capability: Disk and filesystem forensics

release

  • Adds AF_VNODE_TYPE_RELIABLE to vnode types in lib/vnode_raw.cpp, lib/vnode_aff.cpp, and lib/vnode_afd.cpp 2007-04-16 Simson Garfinkel <simsong> · Apr 2007 · source · release history

example

  • Enable reliable vnode operations when constructing a vnode object programmatically. AF_VNODE_TYPE type = AF_VNODE_TYPE_RELIABLE; 2007-04-16 Simson Garfinkel <simsong> · Apr 2007 · source
Random access optimization shipped Automatically detects random access patterns and adjusts the update algorithm to support efficient seeking operations. 1 release · first seen Jul 2007

Shared capability: Disk and filesystem forensics

release

  • Adds automatic detection of random access in lib/afflib.cpp which changes the af_update_seg algorithm to better support seeking operations. 2007-07-19 Simson Garfinkel <simsong> · Jul 2007 · source · release history
Compression configuration shipped Allows setting the compression level when creating AFF images via the afconvert utility. 1 release · first seen Dec 2005

Shared capability: Disk and filesystem forensics

Also counts toward: Command-line interface

release

  • afconvert now supports the -X <level> flag to set compression level when creating AFF images 1.3.0 · Dec 2005 · source · release history
Other / not yet classified 3 features Features we have not matched to a capability yet. A suggested match is marked.
Trace configuration shipped Enables tracing of seek and read operations via environment variables for performance debugging. 1 release · 1 other source · first seen Nov 2006

release

  • Adds AFFLIB_TRACE environment variable to enable tracing of seek and read operations 2006-11-25 Simson L. Garfinkel <simsong> · Nov 2006 · source · release history

example

  • Debug seek and read performance by enabling trace output. AFFLIB_TRACE=1 ./my_afflib_app 2006-11-25 Simson L. Garfinkel <simsong> · Nov 2006 · source
Size alignment validation shipped Implements validation to ensure image sizes are multiples of specific boundaries via vnode flags. 1 release · first seen Apr 2007

release

  • Adds AF_VNODE_MAXSIZE_MULTIPLE flag to vnode types in lib/vnode_split_raw.cpp and lib/vnode_afm.cpp 2007-04-16 Simson Garfinkel <simsong> · Apr 2007 · source · release history
Automatic format detection shipped Automatically infers the output file format from the filename extension, producing AFF files for .aff extensions and raw output otherwise. 1 release · first seen Dec 2005

release

  • afconvert infers output format from filename extension: .aff produces an AFF file while other extensions produce raw output 1.3.0 · Dec 2005 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for afflib, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail afflib puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

18 entries

  1. October 20141
  2. September 20111
  3. April 20111
  4. April 20101
  5. December 20091
  6. July 20081
  7. April 20081
  8. August 20071
  9. July 20071
  10. June 20071
  11. May 20071
  12. April 20071
  13. November 20061
  14. October 20061
  15. January 20061
  16. December 20052
  17. September 20051
    Show

    18 entries

    Project health

    Issue, contributor and maintainer activity in sshock/AFFLIBv3, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −1 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 1.5 days first maintainer reply 35 hours
    6. Open backlog 3 of 41 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 3
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 94
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →