Which forensic software family is known to work with the AFF file format?

• A. Autopsy and Sleuth Kit
• B. FTK Imager
• C. EnCase
• D. X-Ways Forensics

Answer: (A)

Understanding which image formats forensic tools can read is essential for choosing the right workflow. AFF, the Advanced Forensic Format, is an open, extensible disk image format designed to store data and metadata separately for portability and scalability. Tools that rely on the AFFLIB library are able to open and analyze AFF images directly.

Autopsy and Sleuth Kit are built around this library, so they natively handle AFF images as part of their standard workflow. This integration lets you open an AFF image, view file system structures, and extract artifacts without needing to convert the image first. In contrast, some other suites focus on formats like EnCase's EWF or raw images and may require conversion or special plugins to work with AFF, making Autopsy and Sleuth Kit the most straightforward choice for AFF.