AFF: A New Format for STORING HARD DRIVE IMAGES

摘要

Most forensic practi- tioners work with just one or a few disks at a time. A wife might bring in her husband's lap-top for imaging a few days before she files for divorce. Police might raid a drug dealer's apartment and seize a PC that's used for contacting suppliers. In these cases it is common practice to copy the drive's contents sector-for-sector into a single file, referred to here as raw copy. Some practitioners bypass the file entirely, and just make a raw copy to a second disk drive that is the same size (or larger) than the original.