Install afflib with Homebrew, apt, dnf, MacPorts, Nix, zypper

Project links

• Homepage
• Upstream docs
• Package manager page

Commands and aliases

• affcat
• affcompare
• affconvert
• affcopy
• affcrypto
• affdiskprint
• affinfo
• affix
• affrecover
• affsegment
• affsign
• affstats
• affuse
• affverify
• affxml

Project history

AFFLIB's official changelog begins with Release 1.0 on August 13, 2005, described as the initial release with the library description, README, basic library functionality, and four utilities. The README credits Basis Technology and Simson L. Garfinkel for the original 2005-2013 period and Phillip Hellewell for 2014-2025 maintenance.

The 2005 changelog shows rapid early development: large-file support, AMD64 fixes, write support, segment directories, aimage improvements, and archive conversion fixes. Later entries document ongoing portability, OS X updates, license cleanup, and a move toward GitHub preparation in 2012.

The README states AFFLIBv3 implements version 3 of the AFF format and is in maintenance mode while AFFv4 work continues. It contrasts AFFv3's purpose-built container with AFFv4's ZIP64 base and notes licensing differences between the two generations.

Adoption history

AFFLIB became part of forensic and disk-image tooling because it provided both a library and many command-line utilities: affcat, affcompare, affconvert, affcopy, affcrypto, affdiskprint, affinfo, affrecover, affsign, affstats, affuse, affverify, affxml, and others listed by the package facts and manpages.

The official README includes a section on using AFFLIB with The Sleuth Kit, noting that TSK officially supports a subset of the image formats AFFLIB supports and that users can specify image type afflib for the other formats. That is a concrete adoption bridge into a well-known forensic analysis toolkit.

How it is used

AFFLIB tools convert between raw, splitraw, AFF, AFD, and AFM disk-image forms; compare disk images; copy with verification and chain-of-custody segment generation; repair files; print information and statistics; generate XML metadata; and produce diskprints.

The affinfo manpage describes AFF as an open and extensible file format to store disk images and metadata, useful in computer forensics investigations. It also documents hash validation options for MD5, SHA1, and page-level verification, showing the tool suite's integrity-checking focus.

Why package nerds care

AFFLIB is significant because it packages a whole forensic image ecosystem into Unix command-line tools plus a library. It is not merely a decoder: it covers conversion, verification, metadata extraction, encryption, signing, FUSE mounting, and XML export.

For package maintainers, AFFLIB is also an example of legacy-but-still-useful domain software: older file-format support, forensic workflow compatibility, C/C++ portability scars, and maintenance-mode upstream reality all matter more than shiny new features.

Timeline

• 2005-08-13: AFFLIB Release 1.0 initial release.
• 2005-11-18: Release 1.2.5 introduced an in-memory segment directory for random-access performance.
• 2012-03-04: Version 3.6.16 changelog entry changed license from BSD with advertising to BSD without advertising.
• 2012-03-31: Version 3.7.0 changelog entry prepared the project for a move to GitHub.
• 2014-2025: Official README credits Phillip Hellewell maintenance period.
• Current: README says AFFLIBv3 is in maintenance mode while AFFv4 continues.

Related projects

• Related projects include AFFv4, The Sleuth Kit, raw/dd disk images, splitraw, AFD, AFM, FUSE mounting, forensic XML metadata tooling, and chain-of-custody workflows.

Sources

• https://github.com/sshock/AFFLIBv3/blob/master/ChangeLog
• https://github.com/sshock/AFFLIBv3/blob/master/README
• https://github.com/sshock/AFFLIBv3/blob/master/man/affinfo.1
• source_facts.repo