Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow

Digital Investigation

Volumn 6, Issue SUPPL., 2009, Pages

  Cohen, Michael ^a   Garfinkel, Simson ^a   Schatz, Bradley ^a  

^a Australian Federal Police   (Australia)

Author keywords

Cryptography; Digital Evidence Management; Digital forensics; Distributed Forensic Analysis; Distributed Storage; Evidence Archiving; Forensic File Format; Forensic Integrity; Hard disk Imaging; Image

Indexed keywords

COMPUTER FORENSICS; CRYPTOGRAPHY; DIGITAL IMAGE STORAGE; DIGITAL STORAGE; HARD DISK STORAGE; IMAGE ANALYSIS; SPECIFICATIONS;

DIGITAL EVIDENCE; DISK IMAGING; DISTRIBUTED STORAGE; EVIDENCE ARCHIVING; FILE FORMATS; FORENSIC ANALYSIS; FORENSIC INTEGRITY; IMAGE;

DIGITAL FORENSICS;

EID: 68649107328     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2009.06.010     Document Type: Article

References (24)

1. B.S. NTI Forensics Source. Safeback bit stream backup software. [Online]. Available: (2008). http://www.forensics-intl.com/safeback.html
2. Berners-Lee T, Masinter L, McCahill M. RFC 1738: uniform resource locators (URL), Dec. 1994, updated by RFC1808, RFC2368 [23][24]. Status: PROPOSED STANDARD.
3. Carrier B.D., and Spafford E.H. "An event-based digital forensic investigation framework", in digital forensics research workshop. [Online]. Available: (2004). http://www.digital-evidence.org/papers/dfrws_event.pdf
4. Cohen M. Advanced carving techniques. Digital Investigation 4 3-4 (2007) 119-128
5. Cohen M.I. Pyflag: an advanced network forensic framework [Online]. Proceedings of the 2008 digital forensics research workshop. DFRWS (Aug. 2008). http://www.pyflag.org Available:
6. Cohen M.I. Advanced jpeg carving. e-Forensics '08: proceedings of the 1st international conference on forensic applications and techniques in telecommunications, information, and multimedia and workshop (2008), ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering), ICST, Brussels, Belgium, Belgium 1-6
7. Cohen M. How to load a raid set into pyflag. [Online]. Available: (2008). http://www.pyflag.net/cgi-bin/moin.cgi/RaidHowTo
8. Fielding R, RFC 1808: Relative uniform resource locators, Jun. 1995, updates RFC1738 [13]. Updated by RFC2368 [24]. Status: PROPOSED STANDARD.
9. Fielding R., Gettys J., Mogul J., Frystyk H., and Masinter L. RFC 2616: hypertext transfer protocol - HTTP/1.1. [Online]. Available: (June 1999). http://www.w3.org/Protocols/rfc2616/rfc2616.html
10. Garfinkel S.L. Providing cryptographic security and evidentiary chain-of-custody with the advanced forensic format, library, and tools. The International Journal of Digital Crime and Forensics 1 (2009)
11. Garfinkel S.L., Malan D.J., Dubec K.-A., Stevens C.C., and Pham C. Disk imaging with the advanced forensic format, library and tools. Research advances in digital forensics (second annual IFIP WG 11.9 international conference on digital forensics) (Jan. 2006), Springer
12. Goland Y., Faizi E.W.A., Carter S., and Jensen D. RFC 2518: HTTP extensions for distributed authoring - WEBDAV. [Online]. Available: (February 1999). http://www.ietf.org/rfc/rfc2518.txt
13. Guidance Software, Inc. EnCase forensic. [Online]. Available: (2007). http://www.guidancesoftware.com/products/ef_index.asp
14. Hoffman P, Masinter L, Zawinski J, RFC 2368: the mailto URL scheme, Jul. 1998, updates RFC1738, RFC1808 [13], [23]. Status: PROPOSED STANDARD.
15. Ilook investigator. [Online]. Available: (2008). http://ilook-forensics.org
16. Katz P. APPNOTE.TXT - .ZIP file format specification. [Online]. Available: (Sep. 28 2007), PKWare, Inc., Tech. Rep. http://www.pkware.com/documents/casestudies/APPNOTE.TXT
17. Keightley R. EnCase version 3.0 manual revision 3.18. [Online]. Available: (2003). http://www.guidancesoftware.com
18. Kloet B., Metz J., Mora R.-J., Loveall D., and Schreiber D. libewf: project info. [Online]. Available: (2008). http://www.uitwisselplatform.nl/projects/libewf
19. Leach P., Mealling M., and Salz R. RFC 4122: a universally unique identifier (UUID) URN namespace. standards Track. [Online]. Available: (Jul. 2005). http://www.ietf.org/rfc/rfc4122.txt
20. Schatz BL, Clark A, An information architecture for digital evidence integration, In: Australian security response team annual conference; 2006.
21. Sollins K, Masinter L, RFC 1737: Functional requirements for uniform resource names, Dec. 1994, status: INFORMATIONAL.
22. Tanenbaum A.S. Modern operating systems (2008), Prentice Hall
23. Various. libcurl - the multiprotocol file transfer library. [Online]. Available: (March 2009). http://curl.haxx.se/libcurl
24. Zero storage carving; Nov. 2006.