Title: 1. Understanding Storage Formats for Digital Evidence
Course: IN 2005 Digital Forensics > Section: Module 4: Chapter 4 - Data Acquisition

Understanding Storage Formats for Digital Evidence

1. Three storage formats for digital evidence:
  - Raw format
  - Proprietary formats
  - Advanced Forensics Format (AFF)

Raw Format

1. Raw format makes it possible to write bit-stream data to files.
2. Advantages of using raw format, including:
  - a. Fast data transfers
  - Capability to ignore minor data read errors on the source drive
  - Most computer forensics tools can read raw format
3. Disadvantages of using raw format, including:
  - Requires as much storage space as the original disk or data
  - Tools might not collect marginal (bad) sectors

Proprietary Formats

1. Features offered by proprietary formats, including:
  - Option to compress or not compress image files
  - Capability to split an image into smaller segmented files
  - Capability to integrate metadata into the image file
2. Disadvantages of using proprietary formats, including:
  - Inability to share an image between different tools
  - File size limitation for each segmented volume

Advanced Forensics Format

1. The Advanced Forensics Format (AFF) was developed by Dr. Simson L. Garfinkel of Basis Technology Corporation.
2. Design goals of AFF, including:
  - Provide compressed or uncompressed image files
  - No size restriction for disk-to-image files
  - Provide space in the image file or segmented files for metadata
  - Simple design with extensibility
  - Open source for multiple computing platforms and Oss
  - Offer internal consistency checks for self-authentication
3. File extensions include .afd for segmented image files and .afm for AFF metadata.
4. AFF is open source.