Forensic Image Formats

Overview

The most common image formats are:

• Raw Images (dd)
• EnCase EWF (E01)
• FTK SMART
• The Advanced Forensic Format (AFF)

Raw Images (dd)

dd is the linux command to take an image

Bit by bit copy from an evidence source

Will create the same size, even if the drive itself contained very little data

Contain no additional metadata information about the image file itself (name, size, timestamps, and other information in the image's own inode)

What is missing

Desired forensic features, such as:

• Cryptographic hashing
• Improved error handling
• Logging
• Performance enhancements (Compression) - Cannot compress
• Verification checking
• Progress monitoring (forensic imaging can take many hours)

EnCase EWF (E01)

The Expert Witness Format (EWF) is a proprietary format from EnCase

Supports many features, such as metadata, compression, encryption, hashing, and split files

Forensic file formats are sometimes called evidence containers

E01 vs dd?

Have to hash the image of an E01 because the metadata will make it different

E01 is more secure than DD because the metadata is stored within the file itself

FTK SMART

Also, a proprietary format from AccessData

Supports many features, such as metadata, compression, encryption, hashing, and split files

The Advanced Forensic Format (AFF)

Includes all the expected features of a forensic format and also includes additional encryption

Open source implementation and extensible file format (new features can be added) to store disk images and associated metadata