ATTENTION: The new home of the Digital Forensics Wiki is at Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn


From ForensicsWiki
Revision as of 23:40, 31 May 2007 by Jessek (Talk | contribs) (Defined FUSE acronym and added external link)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

affuse is a Filesystem in Userspace (FUSE) implementation that allows AFF files to appear as raw files on Linux systems. This allows the files to be processed with forensic tools that do not understand AFF. It also allows the disk images to be actually mounted, should you want to do that.

For example, say that /project/0089.aff is a disk image that you wish to process with raw tools. With affuse you can mount it like this:

  # affuse /project/00709.aff /mnt/p
  # ls /mnt/p

This raw file could then be mounted:

  # mount -t vfat -o loop=/dev/loop0,ro,noexec,offset=32256 /mnt/p/0070.aff.raw  /mnt/r
  # ls /mnt/r
  total 316
  -rwxr-xr-x 1 root root  93880 May 11  1998
  -r-xr-xr-x 1 root root 222390 May 11  1998 io.sys
  -r-xr-xr-x 1 root root      9 May 11  1998 msdos.sys

External Links

  • FUSE - Filesystem in User Space