This package provides the AFF Toolkit, that is a set of programs for working with computer forensic information. Using these tools you can:
* Interconvert disk images between a variety of formats, including:
- raw or "dd";
- splitraw (in which a single image is split between multiple files);
- AFF format (in which the entire disk image is stored in a single
file);
- AFD format (in which a disk image is stored in multiple AFF files
stored in a single directory);
- AFM format (in which an AFF file is used to annotate a raw file).
* Compare disk images and report the data or metadata that is different.
* Copy disk images from one location to another, with full verification
of data, metadata, and the automatic generation of a chain-of-custody
segment.
* Find errors in an AFF file and fix them.
* Print information about a file.
* Print detailed statistics about a file
* Generate a XML representation of a disk image's metadata (for example,
acquisition time or the serial number of the acquisition device).
* Produce a XML "diskprint" which allows a disk image to be rapidly
fingerprinted without having the computer the SHA1 of the entire
disk.