Gfzip - Revision history

Joachim Metz at 14:33, 23 September 2012

2012-09-23T14:33:20Z

Simsong at 01:16, 21 April 2009

2009-04-21T01:16:46Z

Simsong at 03:06, 4 February 2007

2007-02-04T03:06:18Z

Uwe Hermann at 16:30, 6 May 2006

2006-05-06T16:30:21Z

Capibara: Generic Forensic Zip

2006-03-07T09:31:04Z

Generic Forensic Zip

Capibara at 11:35, 1 March 2006

2006-03-01T11:35:58Z

New page

Generic Forensic Zip is a set of tools and libraries for creating and
accessing randomly accessible forensic zip files of disk images.
These files that use an open format (gfzip) defined by this project,
allow a dd disk image to be stored in compressed form and yet be
randomly accessable through the libgfz library. A second library,
libgfzcreate is made available by this project to allow the creation
of gfz files from programs used to acquire disk image data. Finally the
project includes a set of basic commandline tools for the creation
and verification of gfzip files and for restoring dd images from the
gfz files. Next to compression, the gfzip files are made 'safe' for
forensic use by the use of x509 certificates and the use of multi level
digests (sha256). The x509 certificate that is used to sign the gfz
file is embedded into the file, thus carrying all relevant information
about the person who acquired the image within the file.
One further feature thet gfzip allows is the embedding of (signed)
enviroment data and commandline attributes that may be useful as
metadata in the further processing of the image files. This metadata may
include for example information about the source of the data and the
time it was aquired.
Future versions of gfzip will also include bad-block information, this
is a feature defined in the file format, but not implemented in the
first release of gfzip.

← Older revision		Revision as of 14:33, 23 September 2012
Line 2:		Line 2:

	Details on gfzip can be found at http://www.nongnu.org/gfzip/		Details on gfzip can be found at http://www.nongnu.org/gfzip/
		+
	[[Category:Forensics File Formats]]		[[Category:Forensics File Formats]]

← Older revision		Revision as of 01:16, 21 April 2009
Line 2:		Line 2:

	Details on gfzip can be found at http://www.nongnu.org/gfzip/		Details on gfzip can be found at http://www.nongnu.org/gfzip/
		+	[[Category:Forensics File Formats]]

← Older revision		Revision as of 16:30, 6 May 2006
Line 1:		Line 1:
		+	{{Wikify}}
		+
	Generic Forensic Zip is a set of tools and libraries for creating and		Generic Forensic Zip is a set of tools and libraries for creating and
	accessing randomly accessible forensic zip files of disk images.		accessing randomly accessible forensic zip files of disk images.

@@ Line 1: / Line 1: @@
-{{Wikify}}
+Gfzip is a file format designed by [[Rob J Meijer]] to hold forensic copies of disk images. The format provides for images that are both uncompressed and compressed, and allows both data and meta-data to be signed using x509 certificates.
-Generic Forensic Zip is a set of tools and libraries for creating and
+Details on gfzip can be found at http://www.nongnu.org/gfzip/
-accessing randomly accessible forensic zip files of disk images.
-These files that use an open format (gfzip) defined by this project,
-allow a dd disk image to be stored in compressed form and yet be
-randomly accessable through the libgfz library. A second library,
-libgfzcreate is made available by this project to allow the creation
-of gfz files from programs used to acquire disk image data. Finally the
-project includes a set of basic commandline tools for the creation
-and verification of gfzip files and for restoring dd images from the
-gfz files. Next to compression, the gfzip files are made 'safe' for
-forensic use by the use of x509 certificates and the use of multi level
-digests (sha256). The x509 certificate that is used to sign the gfz
-file is embedded into the file, thus carrying all relevant information
-about the person who acquired the image within the file.
-One further feature thet gfzip allows is the embedding of (signed)
-enviroment data and commandline attributes that may be useful as
-metadata in the further processing of the image files. This metadata may
-include for example information about the source of the data and the
-time it was aquired.
-Future versions of gfzip will also include bad-block information, this
-is a feature defined in the file format, but not implemented in the
-first release of gfzip. Details on gfzip can be found at http://www.nongnu.org/gfzip/