Logical imaging with AFF4-L

Using AFF4-L containers is an efficient and forensically sound way of storing selectively imaged evidence. There exist two open source implementations to perform this task: c-aff4 and pyaff4. To image a directory with aff4.py, run:

python3 aff4.py --verbose --recursive --create-logical \
$(date +%Y-%m-%d)_EVIDENCE_1.aff4 /path/to/dir

If you have to acquire logical files on Windows systems, c-aff4 can be used with PowerShell to conveniently recurse a relevant directory:

Get-ChildItem -Recurse C:\Users\sysprog\Desktop\ `
 | ForEach {$_.FullName} | .\aff4imager.exe --input '@' `
 --output .\$(Get-Date -UFormat '+%Y-%m-%dT%H%M%S')_EVIDENCE_2.aff4

Although those two tools are helpful, it has to be noted that open-source tools for working with AFF4-L-containers, do not get the deserved attention.

There are numerous factors that demand logical instead of physical acquisitions. Data is constantly moving into the cloud, encryption is becoming more widespread, and disk capacity has been growing alongside the amount of data being stored by users ever since. This leads to the fact that performing physical imaging in every case respectively incident is either not efficient or even not possible anymore due to the high storage requirements, time criticality, and data availability. Furthermore, full disk images are often neither needed to answer the investigative questions nor useful to do so. Therefore, a selective seizure of the relevant data makes far more sense. To determine the relevant evidence is another story, but if it is possible to do so, selective imaging might be the preferred solution regarding its efficiency. This brings up the question of how to acquire logical files in a forensically sound manner and how to store them for later analysis.

Central aspects when acquiring logical files are the metadata and timestamp preservation, as well as the assurance of the integrity of the acquired data. There are several options to do so, which differ in complexity and suitability. Think of creating a timestamp preserving TAR-archive with tar --create --atime-preserve=system --file ... ¹ in the most simple case, but this can be done way better as the following section explains.

In the past, the widely used tool FTK Imager created AD1-containers during logical acquisitions ². This aged format, however, is not supported well for processing its contents with open-source tools or even with X-Ways. There was no widely adopted standard for interoperability and the solutions for storing logical acquisitions were far from ideal because they preserved less metadata than forensic analyst requires ³.

AFF4-L, developed by Bradley Schatz ⁴, comes to the rescue. This standard aims at providing an open standard with human interpretability using Zip-tooling (like 7zip), efficient access for many and large logical files, and the storage of arbitrary metadata ⁵. Two years after its presentation at DFRWS 2019 this container format is only very slowly adopted by a few commercial tools, e.g., Axiom ⁶, while Autopsy still lacks support for it.

Since this blog post is geared toward the practical work of seizing digital evidence, I'll skip the internals of this forensic container format, the academic thoughts behind it, and the engineering for its realization. So let's have look at the tools for performing an actual acquisition.

Currently, there exist two open source implementations pyaff4 and c-aff4. The first is the initial imaging/container-handling software written in Python and provided with all publications to AFF4, while the latter is a C implementation by Mike Cohen.

Logical imaging is nowadays often the preferred way of acquiring digital evidence. AFF4-L seems to be the best container format defined as an open standard. pyaff4 and aff4imager (provided by c-aff4) are two open source tools to acquire files logically "into" AFF4-L-containers. The present blog post gives an introduction to their usage. Unfortunately, the AFF4-L-container format and the corresponding imaging tools seem not to get the momentum and attention of the open-source community they deserve, which might change with their popularity.