{"id":33938821,"url":"https://github.com/zff-team/zff-rs","last_synced_at":"2026-03-17T16:03:50.327Z","repository":{"id":45808394,"uuid":"394743958","full_name":"zff-team/zff-rs","owner":"zff-team","description":"Library to handle the files in zff format (file format to store and handle forensic acquisitions).","archived":false,"fork":false,"pushed_at":"2026-03-08T21:02:40.000Z","size":1999,"stargazers_count":21,"open_issues_count":0,"forks_count":1,"subscribers_count":4,"default_branch":"master","last_synced_at":"2026-03-08T23:42:41.235Z","etag":null,"topics":["aquisition","fileformats","forensics","forensics-tools","rust"],"latest_commit_sha":null,"homepage":"https://zff.dev","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zff-team.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-08-10T18:18:57.000Z","updated_at":"2026-03-08T21:02:43.000Z","dependencies_parsed_at":"2023-12-28T13:52:05.901Z","dependency_job_id":"41c6ca23-73c8-40a5-a427-46011e49043a","html_url":"https://github.com/zff-team/zff-rs","commit_stats":{"total_commits":388,"total_committers":3,"mean_commits":"129.33333333333334","dds":"0.0077319587628865705","last_synced_commit":"959683d9be2c86883ef8df18cb8ef52eff4b024f"},"previous_names":["zff-team/zff-rs","ph0llux/zff"],"tags_count":12,"template":false,"template_full_name":null,"purl":"pkg:github/zff-team/zff-rs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zff-team%2Fzff-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zff-team%2Fzff-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zff-team%2Fzff-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zff-team%2Fzff-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zff-team","download_url":"https://codeload.github.com/zff-team/zff-rs/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zff-team%2Fzff-rs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30626906,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-17T14:16:03.965Z","status":"ssl_error","status_checked_at":"2026-03-17T14:16:03.380Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aquisition","fileformats","forensics","forensics-tools","rust"],"created_at":"2025-12-12T15:04:10.784Z","updated_at":"2026-03-17T16:03:50.320Z","avatar_url":"https://github.com/zff-team.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Zff\n\n[![crate][crate-image]][crate-link]\n[![Docs][docs-image]][docs-link]\n![Apache2/MIT licensed][license-image]\n![Rust Version][rustc-image]\n[![website][website-image]][website-link]\n[![codeberg][codeberg-image]][codeberg-link]\n\nZff (Z forensic file format) is file format to store and handle the contents and structure of a partial or entire disk image, physical memory or logical file/folder structures.\nThe focus of zff is on speed, security and modularity in concert with forensic requirements. The modular design promises high maintainability and scalability.\nZff is an alternative to the ewf and aff file formats and is not compatible with them.\n\nSee at the [wiki](https://github.com/ph0llux/zff/wiki) to learn more about the specification.\n\n## Features included in Zff(v3) (most of them are optional)\n\n- ⚡ modern, blazingly fast methods to compress the dumped data (like Zstd or Lz4) ⚡\n- 🔒 the data can optionally be stored encrypted. Strong AEAD and PBE algorithms are used.  🔒\n- ☄ The format is built to be streamable (e.g. you could stream a zff dump/container via HTTP). ☄\n- 🪂 Zff can handle both: logical dumps (like filesystem extractions) and physical dumps (like dd dumps). 🪂\n- 🌐️ It is possible to build a virtual object to setup proper reading of the content (e.g. to define RAIDs). 🌐️\n- ♊️ Zff can deduplicate the data to ensure the best usage of the available storage. ♊️\n- 🤹 The format is built to be splitable in multiple files. 🤹\n- 🍱 You can store multiple dumps within one zff-container and extend an existing zff container with additional dumps. 🍱\n- 🛡 To prevent manipulation attacks, the data can be stored signed. 🛡\n- 🔗 Fast and modern hash algorithms are used to ensure the integrity of stored data. 🔗\n\n## Zff tools and libraries\n\nThere are several tools (and this library) to work with zff containers (or acquire them). All tools and libraries are written in pure Rust.\n\n| Name | Type | Description | Crates.io | MRSV\n|------|:----:|:------------|:---------:|:----:|\n| [zff](https://github.com/ph0llux/zff)  | library | Library to handle the zff format | [![crates.io][zff-crates-io-image]][zff-crates-io-link] | 1.67.1 |\n| [zffacquire](https://github.com/ph0llux/zffacquire) | binary | Tool to acquire disk images in zff format | [![crates.io][zffacquire-crates-io-image]][zffacquire-crates-io-link] | 1.67.1 |\n| [zffanalyze](https://github.com/ph0llux/zffanalyze) | binary | Tool to get information about a zff container | [![crates.io][zffanalyze-crates-io-image]][zffanalyze-crates-io-link] | 1.70.0 |\n| [zffmount](https://github.com/ph0llux/zffmount) | binary | Tool to mount a zff container with FUSE (similar to xmount) | [![crates.io][zffmount-crates-io-image]][zffmount-crates-io-link] | 1.67.1 |\n\n## Benchmarks\n\nThe following benchmarks were all run on a notebook, which has the following specifications:\n- Lenovo Thinkbook 14S Yoga ITL  \n- Intel(R) 11th Gen i5-1135G7 @ AVG: 2.40GHz (MAX: 4.2 GHz)  \n- 16GB DDR4-3200 RAM  \n- internal Samsung 980 Pro NVMe 1TB \nThe installed operating system was Gentoo Linux.  \nInput and output storage device was the internal NVMe.  \n\nThe following benchmark was created for a \\~20GB prebuilt image, which was generated using [the benchmark script](/benchmarks/gen_benchmark_image.sh).\n\n![Acquisition time](/benchmarks/acquisition_time.png)  \n\n¹using ```ewfacquire example01.dd -t example01_ewf -b 64 -c fast -S 7.9EiB -u```, using ewfacquire 20171104.  \n²using ```ewfacquire example01.dd -t example01_ewf -f encase7-v2 -b 64 -c fast -S 7.9EiB -u```  \n³using ```zffacquire physical -i raw/example01.dd -o zff``` \n⁴using ```zffacquire physical -i raw/example01.dd -o zff -p -L debug```  \n⁵using ```zffacquire physical -i raw/example01.dd -o zff -S```  \n⁶using ```zffacquire physical -i raw/example01.dd -o zff_lz4 -z lz4```   \n⁷Using Guymager 0.8.12, with the default guymager.cfg, MD5 hash calculation, without \"HashVerifyDest\".  \n⁸Using Guymager 0.8.12, with enabled Aff support and Aff compression level 1 in guymager.cfg, with MD5 hash calculation, without \"HashVerifyDest\".  \n⁹using ```linpmem-3.3-rc1 -i example01.dd -o output.aff4```  \n¹⁰using ```linpmem-3.3-rc1 -i example01.dd -o output.aff4 --threads 8```  \n¹¹using ```linpmem-3.3-rc1 -i example01.dd -o output.aff4 -c snappy```  \n¹²using ```linpmem-3.3-rc1 -i example01.dd -o output.aff4 -c snappy --threads 8```  \n¹³using ```linpmem-3.3-rc1 -i example01.dd -o output.aff4 -c lz4```  \n\nAs you can see, zffacquire is in most cases much faster than the other tools - even if you store the data encrypted. Using zffacquire with the default values gives no performance disadvantage. The situation is different, of course, with an additional signature operation (but the same would also apply to Guymager with \"HashVerifyDest\" and/or \"HashVerifySrc\" enabled).  \n\\ \nzffacquire and linpmem produce very good benchmarks using lz4 (which just goes to show how much switching compression algorithms can do!).  \n\\ \nTwo of the acquired images (The Guymager-e01-image at number 1, acquired in the benchmark process above and the zff-z01-image acquired with the default options of zffacquire, see above at number 6), the acquired Ex01-image (number 7) and the acquired Aff-image (by Guymager, see number 2), were used as the basis for the read speed benchmark.\nFor the benchmark, xmount and zffmount was used to FUSE mount the appropriate images. Next, dd was used to benchmark the read speed.  \n\\ \nUnfortunately, I have not found an official reference tool that could have been used to FUSE mount aff4 images (neither on www.aff4.org nor on docs.aff4.org).\nIf someone can tell me one, I will update the benchmarks appropriately.\n\n![Read speed](/benchmarks/read_speed_dd.png)\n\\\n¹The following commands were used:\n```bash\nzffmount -i zff.z01 -m /tmp/zffmount -c in-memory\ndd if=/tmp/zffmount/zff_image.dd of=/dev/null bs=1M\n```\n²The following commands were used:\n```bash\nzffmount-v2 -i zff.z01 -m /tmp/zffmount\ndd if=/tmp/zffmount/zff_image.dd of=/dev/null bs=1M\n```\n³The following commands were used:\n```bash\naffuse aff_image.aff /tmp/affmount\ndd if=/tmp/affmount/aff_example01.aff.raw of=/dev/null bs=1M\n```\n⁴The following commands were used:\n```bash\nxmount --in aff aff_image.aff /tmp/affmount\ndd if=/tmp/affmount/aff_image.dd of=/dev/null bs=1M\n```\n⁵The following commands were used:\n```bash\nxmount --in ewf ewfacquired.Ex01 /tmp/ewfmount\ndd if=/tmp/ewfmount/ewfacquired.dd of=/dev/null bs=1M\n```\n⁶The following commands were used:\n```bash\nxmount --in ewf guymager.e01 /tmp/ewfmount\ndd if=/tmp/ewfmount/guymager.dd of=/dev/null b=1M\n```\n## Zff layout\n\nSee the [wiki](https://github.com/ph0llux/zff/wiki) for further information.\n\n## License\n\nZff is open source and Apache 2.0 and MIT licensed. This should ensure compliance to use with both open source and commercial software.\n\n### Contribution\n\nUnless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.\n\n[//]: # (badges)\n\n[codeberg-image]: https://img.shields.io/badge/Codeberg_Mirror-codeberg.org/zff--team/zff--rs-blue\n[codeberg-link]: https://codeberg.org/zff-team/zff-rs\n[crate-image]: https://img.shields.io/crates/v/zff\n[crate-link]: https://crates.io/crates/zff\n[docs-image]: https://docs.rs/zff/badge.svg\n[docs-link]: https://docs.rs/zff/\n[license-image]: https://img.shields.io/badge/license-Apache2.0/MIT-blue.svg\n[rustc-image]: https://img.shields.io/badge/rustc-1.67.1+-blue.svg\n[website-image]: https://img.shields.io/website-up-down-green-red/http/zff.dev.svg\n[website-link]: https://zff.dev\n\n[zff-crates-io-image]: https://img.shields.io/crates/v/zff.svg\n[zff-crates-io-link]: https://crates.io/crates/zff\n\n[zffacquire-crates-io-image]: https://img.shields.io/crates/v/zffacquire.svg\n[zffacquire-crates-io-link]: https://crates.io/crates/zffacquire\n\n[zffanalyze-crates-io-image]: https://img.shields.io/crates/v/zffanalyze.svg\n[zffanalyze-crates-io-link]: https://crates.io/crates/zffanalyze\n\n[zffmount-crates-io-image]: https://img.shields.io/crates/v/zffmount.svg\n[zffmount-crates-io-link]: https://crates.io/crates/zffmount\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzff-team%2Fzff-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzff-team%2Fzff-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzff-team%2Fzff-rs/lists"}