Add AFF4 support

[OlafHaalstra]

Add AFF4 Support

Add loader to support AFF4

Proposed Changes

Builds on fox-it/dissect.evidence#41 and fox-it/dissect.evidence#58 to add AFF4 loader.

Closes #589

I could use some input what tests are desired.

Checklist

• PR Title is descriptive of the changes
• The description is descriptive of the changes
• Tests are included and pass
• Closes related issue number

[OlafHaalstra]

When running this I get:

2026-06-22T22:23:16.848976Z [warning  ] Failed to detect <class 'dissect.target.volumes.md.MdVolumeSystem'> logical volume [dissect.target.volume]
2026-06-22T22:23:16.856922Z [warning  ] Failed to detect <class 'dissect.target.volumes.ddf.DdfVolumeSystem'> logical volume [dissect.target.volume]
2026-06-22T22:23:16.865467Z [warning  ] <Target /Volumes/x/x.aff4>: Can't identify volume system or no volumes found, adding as raw volume instead: <Container type=raw size=12345678 vs=None> [dissect.target.target]
2026-06-22T22:23:16.865564Z [warning  ] Failed to detect <class 'dissect.target.volumes.md.MdVolumeSystem'> logical volume [dissect.target.volume]
2026-06-22T22:23:16.865598Z [warning  ] Failed to detect <class 'dissect.target.volumes.ddf.DdfVolumeSystem'> logical volume [dissect.target.volume]

Is there any chance we could clean that up a little bit? Does the raw container make the most sense? Shouldn't AFF4 be considered a container? Or if we stick with raw it would probably be nicer to get rid of the warning since it's an expected outcome.

The MdVolumeSystem and DdfVolumeSystem I don't fully understand

[Schamper]

Is there any chance we could clean that up a little bit?

I think those warnings only show up if there was a hard error trying to check for those volume systems. Perhaps some -v flags could provide some more information?

Does the raw container make the most sense?

I think so, it's my understanding that AFF4 images should usually be raw disks.