Re: [sleuthkit-users] Disk image in TSK

[Hoyt H. <hoy...@gm...>]

Hello Eddie,

You're correct regarding RAW files. RAW can have different extensions other
than ".dd" also, such as .001, .raw, .img, etc., so saying "RAW" includes
all of those. Single refers to a single disk image file such as
someimage.dd, and split refers to a disk image file separated into multiple
chunks such as someotherimage.001, someotherimage.002, someotherimage.003,
... Windows doesn't come with an included disk imager as far as I'm aware.
RAW and .dd is pretty much considered an industry standard, regardless of
the file extension actually used or the examiner's chosen platform.

You're also correct regarding EWF (Expert Witness Format). AFF (Advanced
Forensic Format) uses AFFLIB, which can be found here:
https://github.com/sshock/AFFLIBv3/releases.

I hope this helps!

Hoyt


On Sat, Jun 25, 2016 at 7:42 AM, Edward Diener <
eld...@tr...> wrote:

> What are the disk image formats in TSK ?
>
> I see mention of single and split raw images. To what do these refer ?
> Are these files created by the Linux 'dd' command ? What about on other
> operating systems such as Windows ?
>
> I also see mention of EWF and AFF. I assume that EWF are images created
> by the libewf project and I can see that TSK 4.2.0 supports libewf. What
> is needed to support AFF and where would I find more information about it ?
>
> Eddie Diener
>
>
>
> ------------------------------------------------------------------------------
> Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
> Francisco, CA to explore cutting-edge tech and listen to tech luminaries
> present their vision of the future. This family event has something for
> everyone, including kids. Get more information and register today.
> http://sdm.link/attshape
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>



-- 
Hoyt
-----------------
There are 11 kinds of people - those who think binary jokes are funny,
those who don't, ...and those who don't know binary.