The AFF4 Evidence Container: Why and what’s next?

In recent times the next-generation evidence file format, AFF4, has transitioned from niche to broad support across the forensic tool ecosystem. Targeted at intermediate examiners, this presentation will provide an introduction to new users of the format, allowing one to understand the format’s advantages, how it differs to existing approaches, independently assess its forensic soundness in comparison to existing formats, and identify where current forensic workflows might benefit. It will also examine where the format is headed next in solving emerging challenges such as logical acquisition.