Module header 

This module contains all header, could be found in the zff specification (header version 1 and header version 2).

Modules

version1

This module contains the version 1 of all zff header. This module contains all header (mostly sub headers of the MainHeader), which are specified in the zff standard version 1.

version2

This module contains the version 2 of all zff header.

Structs

ChunkHeader

Header for chunk data.
Each data chunk has his own chunk header. After the header, the chunked data follows.

CompressionHeader

Header for the data compression parameters.
This header is part of the main header.

DescriptionHeader

The description header contains all data, which describes the dumped data in den appropriate object (e.g. case number, examiner name or acquisition date).
The description information are stored in a HashMap (e.g. like [“acquisition tool”, “zffacquire”]). Some fields are predefined, to be able to ensure a certain degree of compatibility between different tools. The following fields are predefined:

EncryptionHeader

The encryption header contains all informations (and the encrypted key) for the data and header encryption.
The encryption header is the only optional header part of the main header (With the exception of the PBEHeader, which is, however, part of the EncryptionHeader). The encryption header contains an encrypted key (encrypted encryption key). This key is encrypted with a password based encryption method, described by the containing PBEHeader. This key (decrypted with the appropriate password) is used to decrypt the encrypted data or the optionally encrypted header.

FileHeader

Each dumped file* contains a FileHeader containing several metadata. The following metadata are included in a FileHeader:

HashHeader

Header for the hash values of the dumped data stream. This header is part of various footers and contains 0 or more hash values of the dumped data.\

HashValue

This is a part of the HashHeader. The HashValue-struct contains the appropriate hash algorithm and the hash. This struct has a version also.

MainHeader

The main header is the first Header, which can be found at the beginning of the first segment.
This header contains a lot of metadata about the zff container

ObjectHeader

Each object starts with a ObjectHeader. The ObjectHeader contains several metadata of the appropriate underlying object. The following metadata are stored in an ObjectHeader:

PBEHeader

The pbe header contains all informations for the encryption of the encryption key.
The encryption key, used for the chunk encryption, can be found at the EncryptionHeader - encrypted with an user password.
This encryption of the encryption key is done via a password-based encryption (PBE).
All metadata about this PBE can be found in this PBEHeader.\

PBKDF2SHA256Parameters

struct to store the parameters for the KDF PBKDF2-SHA256.

ScryptParameters

struct to store the parameters for the KDF Scrypt.

SegmentHeader

The SegmentHeader contains a lot of initial metadata of the appropriate segment. Each segment has its own segment header.
The following metadata are included in the SegmentHeader:

Enums

FileType

Defines all file types, which are implemented for zff files.

KDFParameters

enum to handle the stored parameters for the appropriate key deriavation function (KDF).

ObjectType

Defines the ObjectType, which can be used in zff container.