Which three disk image formats are used for evidence collection and preservation? (Choose three.)

In digital forensics, a disk image is a bit-for-bit copy of a source storage device created for analysis and preservation.

RAW(DD): This is a direct, sector-by-sector copy of the source media, resulting in a file that is the exact same size as the source. It is a fundamental and universally supported format.

E01 (EnCase Evidence File): A proprietary but widely adopted industry-standard format. It segments the image, can apply compression, and embeds metadata (case information, acquisition details) and integrity hashes (e.g., MD5, SHA-1) directly within the evidence file.

AFF (Advanced Forensics Format): An open-source format designed to overcome the limitations of RAW images. Like E01, it supports compression, metadata, and hashing, but in a non-proprietary, extensible structure.

D. APFS: This is the Apple File System, which defines how data is organized on a volume. It is a file system, not a forensic disk image container format.

E. EXT4: This is the Fourth Extended Filesystem, a common file system for Linux. Like APFS, it is a data structure on a disk, not an evidence container format.

1. Garfinkel

S. L. (2006). Advanced forensic format: An open

extensible format for disk imaging. In Systematic Approaches to Digital Forensic Engineering

2005 First International Workshop on (pp. 17-20). IEEE. This paper introduces AFF and explicitly compares it to RAW ("dd") and the EnCase format ("E01") as the primary existing formats for forensic disk imaging. (DOI: 10.1109/SADFE.2005.7)

2. National Institute of Standards and Technology (NIST). (2007). Computer Forensics Tool Testing Program: Disk Imaging Tool Specification Version 3.1.6. Section 2

"Image File Formats

" outlines the requirements for testing forensic imaging tools and specifies RAW (dd-style)

EnCase (.E01)

and AFF as the target formats for evaluation.

3. Carrier

B. (2021). The Sleuth Kit (TSK) & Autopsy User’s Guide. In the section on "Adding a Data Source

" the documentation lists supported disk image types

which include Raw (e.g.

dd)

EnCase (E01)

and Advanced Forensic Format (AFF). This is official documentation for a standard forensic toolset. (Available via autopsy.com)