# Install afflib with Homebrew, apt, dnf, MacPorts, Nix, zypper Advanced Forensic Format. Version 3.7.22 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:afflib ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install afflib ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install afflib ``` Evidence: MacPorts ports tree: security/afflib/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install afflib-tools ``` Evidence: Debian stable package indexes: afflib-tools from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install afflib ``` Evidence: Fedora Rawhide package metadata: afflib from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#afflib ``` Evidence: nixpkgs package indexes: pkgs/by-name/af/afflib/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install afflib-devel ``` Evidence: openSUSE Tumbleweed package metadata: afflib-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:afflib - **Package manager:** Homebrew - **Package manager page:** - **Version:** 3.7.22 - **Source summary:** Advanced Forensic Format - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-4-Clause AND LicenseRef-Homebrew-public-domain - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - affcat (cli) - affcompare (cli) - affconvert (cli) - affcopy (cli) - affcrypto (cli) - affdiskprint (cli) - affinfo (cli) - affix (cli) - affrecover (cli) - affsegment (cli) - affsign (cli) - affstats (cli) - affuse (cli) - affverify (cli) - affxml (cli) - affcat (alias) - affcompare (alias) - affconvert (alias) - affcopy (alias) - affcrypto (alias) - affdiskprint (alias) - affinfo (alias) - affix (alias) - affrecover (alias) - affsegment (alias) - affsign (alias) - affstats (alias) - affuse (alias) - affverify (alias) - affxml (alias) ## Dependencies - openssl@3 ## Build dependencies - autoconf - automake - libtool - pkgconf - python@3.14 ## Uses from macOS - curl - expat ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 3.7.22 - Local data: ok - Upstream repository: https://github.com/sshock/AFFLIBv3 - Upstream latest detected: v3.7.22 (current) - info: No package-manager update timestamp was available. ## Project history and usage AFFLIBv3 is the library and tool suite for the Advanced Forensic Format, an open disk-image format for storing computer forensic data and metadata. The official README describes AFF as supporting forensic data plus metadata, digital signatures for chain of custody and integrity, encrypted disk-image storage, and use in both open-source and proprietary tools. ### Project history AFFLIB's official changelog begins with Release 1.0 on August 13, 2005, described as the initial release with the library description, README, basic library functionality, and four utilities. The README credits Basis Technology and Simson L. Garfinkel for the original 2005-2013 period and Phillip Hellewell for 2014-2025 maintenance. The 2005 changelog shows rapid early development: large-file support, AMD64 fixes, write support, segment directories, aimage improvements, and archive conversion fixes. Later entries document ongoing portability, OS X updates, license cleanup, and a move toward GitHub preparation in 2012. The README states AFFLIBv3 implements version 3 of the AFF format and is in maintenance mode while AFFv4 work continues. It contrasts AFFv3's purpose-built container with AFFv4's ZIP64 base and notes licensing differences between the two generations. ### Adoption history AFFLIB became part of forensic and disk-image tooling because it provided both a library and many command-line utilities: affcat, affcompare, affconvert, affcopy, affcrypto, affdiskprint, affinfo, affrecover, affsign, affstats, affuse, affverify, affxml, and others listed by the package facts and manpages. The official README includes a section on using AFFLIB with The Sleuth Kit, noting that TSK officially supports a subset of the image formats AFFLIB supports and that users can specify image type afflib for the other formats. That is a concrete adoption bridge into a well-known forensic analysis toolkit. ### How it is used AFFLIB tools convert between raw, splitraw, AFF, AFD, and AFM disk-image forms; compare disk images; copy with verification and chain-of-custody segment generation; repair files; print information and statistics; generate XML metadata; and produce diskprints. The affinfo manpage describes AFF as an open and extensible file format to store disk images and metadata, useful in computer forensics investigations. It also documents hash validation options for MD5, SHA1, and page-level verification, showing the tool suite's integrity-checking focus. ### Why package nerds care AFFLIB is significant because it packages a whole forensic image ecosystem into Unix command-line tools plus a library. It is not merely a decoder: it covers conversion, verification, metadata extraction, encryption, signing, FUSE mounting, and XML export. For package maintainers, AFFLIB is also an example of legacy-but-still-useful domain software: older file-format support, forensic workflow compatibility, C/C++ portability scars, and maintenance-mode upstream reality all matter more than shiny new features. ### Timeline - 2005-08-13: AFFLIB Release 1.0 initial release. - 2005-11-18: Release 1.2.5 introduced an in-memory segment directory for random-access performance. - 2012-03-04: Version 3.6.16 changelog entry changed license from BSD with advertising to BSD without advertising. - 2012-03-31: Version 3.7.0 changelog entry prepared the project for a move to GitHub. - 2014-2025: Official README credits Phillip Hellewell maintenance period. - Current: README says AFFLIBv3 is in maintenance mode while AFFv4 continues. ### Related projects - Related projects include AFFv4, The Sleuth Kit, raw/dd disk images, splitraw, AFD, AFM, FUSE mounting, forensic XML metadata tooling, and chain-of-custody workflows. ### Sources - - - - source_facts.repo ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** afflib - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - afflib-tools - 3.7.21-1: normalized package name match | Debian stable package indexes: afflib-tools from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Advanced Forensics Format Library (utilities) | https://github.com/sshock/AFFLIBv3 - Debian apt - libafflib-dev - 3.7.21-1: normalized package name match | Debian stable package indexes: libafflib-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Advanced Forensics Format Library (development files) | https://github.com/sshock/AFFLIBv3 - Debian apt - libafflib0t64 - 3.7.21-1: normalized package name match | Debian stable package indexes: libafflib0t64 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Advanced Forensics Format Library | https://github.com/sshock/AFFLIBv3 - Nix - afflib: normalized package name match | nixpkgs package indexes: pkgs/by-name/af/afflib/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - afflib-tools - 3.7.20-1.1ubuntu5: normalized package name match | Ubuntu 24.04 LTS package indexes: afflib-tools from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Advanced Forensics Format Library (utilities) | https://github.com/sshock/AFFLIBv3 - Ubuntu apt - libafflib-dev - 3.7.20-1.1ubuntu5: normalized package name match | Ubuntu 24.04 LTS package indexes: libafflib-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Advanced Forensics Format Library (development files) | https://github.com/sshock/AFFLIBv3 - Ubuntu apt - libafflib0t64 - 3.7.20-1.1ubuntu5: normalized package name match | Ubuntu 24.04 LTS package indexes: libafflib0t64 from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Advanced Forensics Format Library | https://github.com/sshock/AFFLIBv3 - dnf - afflib - 3.7.22-5.fc45: normalized package name match | Fedora Rawhide package metadata: afflib from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Library to support the Advanced Forensic Format | https://github.com/sshock/AFFLIBv3 - dnf - afflib-devel - 3.7.22-5.fc45: normalized package name match | Fedora Rawhide package metadata: afflib-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Development files for afflib | https://github.com/sshock/AFFLIBv3 - dnf - afftools - 3.7.22-5.fc45: normalized package name match | Fedora Rawhide package metadata: afftools from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Utilities for afflib | https://github.com/sshock/AFFLIBv3 - dnf - python3-pyaff - 3.7.22-5.fc45: normalized package name match | Fedora Rawhide package metadata: python3-pyaff from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Python3 binding for the AFFLIB | https://github.com/sshock/AFFLIBv3 - zypper - afflib-devel - 3.7.22-1.3: normalized package name match | openSUSE Tumbleweed package metadata: afflib-devel from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Library for working with the Advanced Forensics Format - Build support | https://github.com/sshock/AFFLIBv3 - zypper - afflib-tools - 3.7.22-1.3: normalized package name match | openSUSE Tumbleweed package metadata: afflib-tools from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Tools for working with the Advanced Forensics Format | https://github.com/sshock/AFFLIBv3 - zypper - libafflib0 - 3.7.22-1.3: normalized package name match | openSUSE Tumbleweed package metadata: libafflib0 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Library for working with the Advanced Forensics Format-Runtime support | https://github.com/sshock/AFFLIBv3 - MacPorts - afflib: normalized package name match | MacPorts ports tree: security/afflib/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - Runtime dependency declared by Homebrew. - [autoconf](https://www.automicvault.com/pkg/brew/autoconf/) - Build dependency declared by Homebrew. - [automake](https://www.automicvault.com/pkg/brew/automake/) - Build dependency declared by Homebrew. - [libtool](https://www.automicvault.com/pkg/brew/libtool/) - Build dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [sleuthkit](https://www.automicvault.com/pkg/brew/sleuthkit/) - Popular package that depends on this formula. - [xmount](https://www.automicvault.com/pkg/brew/xmount/) - Popular package that depends on this formula. - [chainsaw](https://www.automicvault.com/pkg/brew/chainsaw/) - Shares av.db curated category or tags: cli, forensics, security. - [dc3dd](https://www.automicvault.com/pkg/brew/dc3dd/) - Shares av.db curated category or tags: cli, forensics, security. - [dcfldd](https://www.automicvault.com/pkg/brew/dcfldd/) - Shares av.db curated category or tags: cli, forensics, security. - [evtx](https://www.automicvault.com/pkg/brew/evtx/) - Shares av.db curated category or tags: cli, forensics, security. - [hack-browser-data](https://www.automicvault.com/pkg/brew/hack-browser-data/) - Shares av.db curated category or tags: cli, forensics, security. - [ssdeep](https://www.automicvault.com/pkg/brew/ssdeep/) - Shares av.db curated category or tags: cli, forensics, security. - [mac-robber](https://www.automicvault.com/pkg/brew/mac-robber/) - Shares av.db curated category or tags: cli, forensics, security. - [binwalk](https://www.automicvault.com/pkg/brew/binwalk/) - Shares av.db curated category or tags: cli, forensics, security. - [libewf](https://www.automicvault.com/pkg/brew/libewf/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, disk, forensics, format, openssl. ## Combined YAML source View the package source record on GitHub. [combined/afflib.yml](https://github.com/automic-vault/db/blob/main/combined/afflib.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph