afflib
v3.7.5 open-sourceThe section your link pointed to isn't on afflib's page any more, so we've brought you to the top.
AFFLIB is a library and toolkit implementing the Advanced Forensic Format for storing computer forensic disk images and associated metadata.
int page_size = af_get_pagesize(af);
/* No shell command exposes this internal C++ function directly; it is used by affsplit/afflib internally during write operations. */
#include "afflib.h"
#include <cstdlib>
int main() {
setenv("AFFLIB_PASSPHRASE", "my_secret_passphrase", 1);
affil_t *af = af_open_with("image.aff", O_RDONLY, 0644);
if (af) { /* ... */ }
return 0;
}
afinfo -X image.aff
AF_VNODE_TYPE type = AF_VNODE_TYPE_RELIABLE;
AFFLIB_TRACE=1 ./my_afflib_app
#include <afflib.h>
// Now uses int64_t for position
int64_t pos = 0;
af_seek(af, pos, SEEK_SET);
afcopy -z source.img target.aff3
bool is_aff = af_identify("path/to/file");
Summary
afflib is an open-source library and command-line toolkit for storing and converting computer forensic disk images in the Advanced Forensic Format, and it is free to use. It works both as a library that other programs link against and as a set of command-line tools, so investigators can convert between raw, split-raw, AFD, and AFM formats, compare images, copy them with chain-of-custody metadata, and check files for errors. This puts it in the hands of forensic examiners and DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. practitioners handling disk acquisition rather than live incident response, and one documented use pairs it with SleuthKit for reading VMDK images. The README notes AFF itself is unencumbered by patents, with AFFLIBv3 now in maintenance mode while AFFv4 is developed separately. Development is slow: the project dates to 2012 with 16 contributors, but only 4 commits in the past year and its last release was 347 days ago.
AFFLIB is a library and toolkit implementing the Advanced Forensic Format for storing computer forensic disk images and associated metadata.
How afflib helps
Which format is this seized disk image actually stored in, and can it be converted to raw for another tool to read?
reads the header and metadata of the file, identifies whether it's raw, split-raw, AFF, AFD, or AFM, and converts between them without altering the underlying forensic data
Have these two copies of the same disk image diverged in their data or their metadata?
runs a comparison across both segments of content and metadata, and reports exactly which parts differ instead of just flagging a mismatch
Is this AFF file corrupted, and where?
scans the file's internal segments for errors and identifies which ones are damaged so they can be repaired or flagged before analysis continues
Can I move this image to another machine without breaking the chain of custody?
copies the image while verifying data and metadata against the source and appends a chain-of-custody segment recording the transfer
What acquisition details are embedded in this image's metadata?
extracts an XML representation of the disk image's metadata, such as acquisition time or the serial number of the acquiring device
Can I confirm this is the same disk without hashing the entire image again?
generates an XML diskprint that fingerprints the disk image without recomputing a full SHA1 over all its data
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for afflib, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail afflib puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
18 entries
No entries match these filters.
- October 20141
- September 20111
- April 20111
- April 20101
- December 20091
- July 20081
- April 20081
- August 20071
- July 20071
- June 20071
- May 20071
- April 20071
- November 20061
- October 20061
- January 20061
- December 20052
- September 20051
Project health
Issue, contributor and maintainer activity in sshock/AFFLIBv3, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 1 ±0 vs prior 12 months
- Maintainers 0 +0 joined · −1 left, last 12 months
- Bus factor 0 committers behind half the commits
- Community-filed 100% of issues opened, last 12 months
- Median time to close 1.5 days first maintainer reply 35 hours
- Open backlog 3 of 41 issues ever filed
- Issues opened / month 0 · 0 communitymaintainers
- Open backlog 3
- Contributors / month 0
- Commits / month 0
- Stars 94
- other 100%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.