GCIH · Question #616
Which of the following evidence container formats is an open source alternative that can provide metadata along with the image?
The correct answer is A. AFF4. AFF4 (Advanced Forensic Framework 4) is an open source forensic evidence container that supports rich metadata, multiple data streams, and extensible RDF-based indexing.
Question
Which of the following evidence container formats is an open source alternative that can provide metadata along with the image?
Options
- AAFF4
- BRaw
- CE01
- DL01
How the community answered
(36 responses)- A92% (33)
- B3% (1)
- D6% (2)
Why each option
AFF4 (Advanced Forensic Framework 4) is an open source forensic evidence container that supports rich metadata, multiple data streams, and extensible RDF-based indexing.
AFF4 is a fully open source forensic image format governed by an open specification, designed to store disk images alongside structured metadata using RDF (Resource Description Framework). It supports compression, encryption, and multiple evidence streams within a single container, making it a capable open alternative to proprietary formats.
Raw format is a bit-for-bit sector copy with no container structure, no built-in metadata, and no integrity verification features.
E01 (EnCase Evidence File) is a proprietary format owned by OpenText (formerly Guidance Software) and is not open source, though it supports metadata and hashing.
L01 (EnCase Logical Evidence File) is also a proprietary EnCase format used for logical acquisitions and is not open source.
Concept tested: Open source forensic evidence container formats with metadata
Source: https://github.com/aff4/aff4
Topics
Community Discussion
No community discussion yet for this question.