GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → aff4 → pyaff4

aff4 / pyaff4

Licence: Apache-2.0 license
The Python implementation of the AFF4 standard.

Programming Languages

python
139335 projects - #7 most used programming language

Labels

forensicsdigital-forensicsforensic-analysiscompression-librarycompression-formats

Projects that are alternatives of or similar to pyaff4

ForensicsTools
A list of free and open forensics analysis tools and other resources
Stars: ✭ 392 (+959.46%)
Mutual labels:  forensics, digital-forensics, forensic-analysis
Memlabs
Educational, CTF-styled labs for individuals interested in Memory Forensics
Stars: ✭ 696 (+1781.08%)
Mutual labels:  forensics, digital-forensics
dcfldd
Enhanced version of dd for forensics and security
Stars: ✭ 27 (-27.03%)
Mutual labels:  forensics, forensic-analysis
Awesome Forensicstools
Awesome list of digital forensic tools
Stars: ✭ 120 (+224.32%)
Mutual labels:  forensics, digital-forensics
Awesome Forensics
A curated list of awesome forensic analysis tools and resources
Stars: ✭ 1,775 (+4697.3%)
Mutual labels:  digital-forensics, forensic-analysis
lsrootkit
Rootkit Detector for UNIX
Stars: ✭ 53 (+43.24%)
Mutual labels:  forensics, forensic-analysis
C Aff4
An AFF4 C++ implementation.
Stars: ✭ 126 (+240.54%)
Mutual labels:  forensics, digital-forensics
Palmprint-Recognition-in-the-Wild
No description or website provided.
Stars: ✭ 22 (-40.54%)
Mutual labels:  forensics, forensic-analysis
Judge-Jury-and-Executable
A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV. Threats and data can be probed harnessing the power and syntax of SQL.
Stars: ✭ 66 (+78.38%)
Mutual labels:  forensics, forensic-analysis
Forensic Tools
A collection of tools for forensic analysis
Stars: ✭ 204 (+451.35%)
Mutual labels:  forensics, digital-forensics
Tcpflow
TCP/IP packet demultiplexer. Download from:
Stars: ✭ 1,231 (+3227.03%)
Mutual labels:  forensics, digital-forensics
btrfscue
Recover files from damaged BTRFS filesystems
Stars: ✭ 28 (-24.32%)
Mutual labels:  forensics, forensic-analysis
Linuxforensics
Everything related to Linux Forensics
Stars: ✭ 189 (+410.81%)
Mutual labels:  forensics, digital-forensics
INDXRipper
Carve file metadata from NTFS index ($I30) attributes
Stars: ✭ 32 (-13.51%)
Mutual labels:  forensics, digital-forensics
vminspect
Tools for inspecting disk images
Stars: ✭ 25 (-32.43%)
Mutual labels:  forensics, forensic-analysis
PSTrace
Trace ScriptBlock execution for powershell v2
Stars: ✭ 38 (+2.7%)
Mutual labels:  forensics
WELA
WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）
Stars: ✭ 442 (+1094.59%)
Mutual labels:  forensics
DFIR-O365RC
PowerShell module for Office 365 and Azure log collection
Stars: ✭ 158 (+327.03%)
Mutual labels:  forensics
pdfresurrect
Analyze and help extract older "hidden" versions of a pdf from the current pdf.
Stars: ✭ 40 (+8.11%)
Mutual labels:  forensic-analysis
dumproid
Android process memory dump tool without ndk.
Stars: ✭ 55 (+48.65%)
Mutual labels:  forensics
View All Similar Projects ➔

AFF4 -The Advanced Forensics File Format

The Advanced Forensics File Format 4 (AFF4) is an open source format used for the storage of digital evidence and data.

It was originally designed and published in [1] and has since been standardised as the AFF4 Standard v1.0, which is available at https://github.com/aff4/Standard. This project is a work in progress implementation, providing two library implementations, C/C++ and Python.

What is currently supported.

The focus of this implementation is reading physical images conforming with the AFF4 Standard v1.0, and for the ongoing development of an AFF4 based logical image standard.

Canonical images for the v1.0 physical image specification are provided in the AFF4 Reference Images github project at https://github.com/aff4/ReferenceImages

  1. Reading, writing & appending to ZipFile style volumes.
  2. Reading striped ZipFile volumes.
  3. Reading & writing AFF4 ImageStreams using the deflate or snappy compressor.
  4. Reading RDF metadata using Turtle (and to some degree YAML).
  5. Verification of linear and block hashed images.
  6. Reading & writing logical images (new) .
  7. Reading & writing deduplicated logical images (new).
  8. Encrypted AFF4 logical volumes (new).

What is not yet supported:

The write support in the libraries is currently broken and being worked on. Other aspects of the AFF4 that have not yet been implemented in this codebase include:

  1. Persistent data store (resolver).
  2. HTTP backed streams.
  3. Support for signed statements or Bill of Materials.
  4. Directory based volumes.

Notice

This is not an official Google product (experimental or otherwise), it is just code that happens to be owned by Google and Schatz Forensic.

References

[1] "Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow" M.I. Cohen, Simson Garfinkel and Bradley Schatz, digital investigation 6 (2009) S57-S68.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].