# Support for AFF images

**URL:** <https://sleuthkit.discourse.group/t/support-for-aff-images/2831>\
**Category:** Autopsy Help\
**Created:** [September 15, 2021, 11:21am UTC](https://sleuthkit.discourse.group/t/support-for-aff-images/2831 "2021-09-15T11:21:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![seanthegeek](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/seanthegeek/32/1456_2.png) [@seanthegeek](https://sleuthkit.discourse.group/u/seanthegeek)\
**Post date:** [September 15, 2021, 11:21am UTC](https://sleuthkit.discourse.group/t/support-for-aff-images/2831/1 "2021-09-15T11:21:27Z")

</div>

Hello,

According to [this old Sluthkit page](http://sleuthkit.org/autopsy/v2/), Autopsy v2 supported AFF images.

> Autopsy and TSK support raw, Expert Witness, and AFF file formats.

When I try to add a data source in Autopsy 4.19.1, AFF is not one of the supported file types.

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/5/54b58f7db43982372d40635ec6812dc110613ad6.png)

If I try to open the image by filtering on `All Files`, Autopsy doesn’t know what to do with it.

> Errors occurred while ingesting image
> 
> 1. Possible encryption detected (High entropy (7.99)) (Sector offset: 0)

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/2/2f138f7de45d58ce9d3593b36b45c3b0a45f0e54.png)

A friend mentioned this might be fixed by a plugin, but the list of available plugins is blank.

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/c/c6eab0ae5ebd6ca8a4e209ab3def80f68b7edb34.png)

Do modern versions of Autopsy support AFF images? If so, how? Currently, I’ve resorted to converting AFF images to RAW using `affconvert`. Pf course, those files are much larger.

---

<div class="post-metadata">

**Author:** ![seanthegeek](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/seanthegeek/32/1456_2.png) [@seanthegeek](https://sleuthkit.discourse.group/u/seanthegeek)\
**Post date:** [September 17, 2021, 2:13am UTC](https://sleuthkit.discourse.group/t/support-for-aff-images/2831/2 "2021-09-17T02:13:12Z")

</div>

Ah, I see now that AFF3 and AFFLIBv3 have been [depreciated](https://forensicswiki.xyz/wiki/index.php?title=AFF).

> **AFF3 and AFFLIBv3 have been depreciated and should not be used for new projects.**

The AFF4 GitHub repository is [gone](https://github.com/google/aff4). So I’ll stick with `E01` (Encase format) for compressed images. FTK Imager does a great job with compression when the compression setting is maxed out at `9`. A 62 GB RAW image, was converted to a 24 GB `E01` file!

So, if anyone else is reading this and wondering how to convert `AFF` images to `E01` images:

1. Convert the `AFF` image to `RAW` using `affconvert`

> affconvert example.aff -r example.raw

2. Convert the `RAW` image to `E01` using by adding the `RAW` image as a source, right clicking it-and exporting the image in `E01` format. Or use `ewfaquire`

> ewfaquire -c best example.raw

---

<div class="post-metadata">

**Author:** ![macuisdein](https://avatars.discourse-cdn.com/v4/letter/m/eada6e/32.png) [@macuisdein](https://sleuthkit.discourse.group/u/macuisdein)\
**Post date:** [December 2, 2021, 2:41pm UTC](https://sleuthkit.discourse.group/t/support-for-aff-images/2831/3 "2021-12-02T14:41:27Z")

</div>

AFF4 is now at [AFF4 · GitHub](https://github.com/aff4)