<?xml version='1.0' encoding='UTF-8'?>
<dfxml 
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
  xmlns:dc='http://purl.org/dc/elements/1.1/'
  version='1.1.0+'>
  <metadata>
    <dc:type>Disk Image</dc:type>
  </metadata>
  <source>
    <image_filename>/Users/simsong/from_brian/image.gen1.dmg</image_filename>
  </source>
<!-- fs start: 0 -->
  <volume offset='0'>
    <partition_offset>0</partition_offset>
    <block_size>4096</block_size>
    <ftype>4096</ftype>
    <ftype_str>hfsp</ftype_str>
    <block_count>2560</block_count>
    <first_block>0</first_block>
    <last_block>2559</last_block>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$ExtentsFile</filename>
      <partition>1</partition>
      <id>1</id>
      <name_type>r</name_type>
      <filesize>81920</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>3</inode>
      <meta_type>1</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='8400896' img_offset='8400896' len='81920'/>
      </byte_runs>
      <hashdigest type='md5'>6233f5008af0e462b698fa642950cb87</hashdigest>
      <hashdigest type='sha1'>6ff0463452210585e7bdc62aa61243b871d6c661</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$CatalogFile</filename>
      <partition>1</partition>
      <id>2</id>
      <name_type>r</name_type>
      <filesize>81920</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>4</inode>
      <meta_type>1</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='8482816' img_offset='8482816' len='81920'/>
      </byte_runs>
      <hashdigest type='md5'>866b6bfe809c70e0d943b4c85301bda7</hashdigest>
      <hashdigest type='sha1'>f2f5ba1fd0bece6288210b8ca41b5a5fd37451f6</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$BadBlockFile</filename>
      <partition>1</partition>
      <id>3</id>
      <name_type>r</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>5</inode>
      <meta_type>1</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$AllocationFile</filename>
      <partition>1</partition>
      <id>4</id>
      <name_type>r</name_type>
      <filesize>4096</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>6</inode>
      <meta_type>1</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='4096' img_offset='4096' len='4096'/>
      </byte_runs>
      <hashdigest type='md5'>463ec68fdf2b2f85f15e234c106ddc8d</hashdigest>
      <hashdigest type='sha1'>2726b19234de608439946a3314a89f45b80fba42</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$AttributesFile</filename>
      <partition>1</partition>
      <id>5</id>
      <name_type>r</name_type>
      <filesize>81920</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>8</inode>
      <meta_type>1</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='9383936' img_offset='9383936' len='81920'/>
      </byte_runs>
      <hashdigest type='md5'>8cd04a95cd86302b34222a21aec231c1</hashdigest>
      <hashdigest type='sha1'>80615447dc573dbdcdfcf73b3cb1adfd8e774728</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>..</filename>
      <partition>1</partition>
      <id>6</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_name>1</alloc_name>
      <inode>0</inode>
      <meta_type>0</meta_type>
      <mode>0</mode>
      <nlink>0</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>.fseventsd</filename>
      <partition>1</partition>
      <id>7</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>21</inode>
      <meta_type>2</meta_type>
      <mode>448</mode>
      <nlink>1</nlink>
      <uid>501</uid>
      <gid>501</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:42Z</mtime>
      <ctime>2009-01-29T17:33:42Z</ctime>
      <atime>2009-01-29T17:33:41Z</atime>
      <crtime>2009-01-29T17:33:34Z</crtime>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>21</inode>
      </parent_object>
      <filename>.fseventsd/..</filename>
      <partition>1</partition>
      <id>8</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>2</inode>
      <meta_type>2</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>99</uid>
      <gid>99</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:35Z</mtime>
      <ctime>2009-01-29T17:33:35Z</ctime>
      <crtime>2009-01-29T17:33:30Z</crtime>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>21</inode>
      </parent_object>
      <filename>.fseventsd/0000000085c085db</filename>
      <partition>1</partition>
      <id>9</id>
      <name_type>r</name_type>
      <filesize>174</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>26</inode>
      <meta_type>1</meta_type>
      <mode>384</mode>
      <nlink>1</nlink>
      <uid>501</uid>
      <gid>501</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:36Z</mtime>
      <ctime>2009-01-29T17:33:36Z</ctime>
      <atime>2009-01-29T17:33:36Z</atime>
      <crtime>2009-01-29T17:33:36Z</crtime>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='9478144' img_offset='9478144' len='174'/>
      </byte_runs>
      <hashdigest type='md5'>c49d37e452eb33596f220081f5e72a5c</hashdigest>
      <hashdigest type='sha1'>ee965bd9943b22764f700b08fc3936cf6289bb12</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>21</inode>
      </parent_object>
      <filename>.fseventsd/0000000085c086a9</filename>
      <partition>1</partition>
      <id>10</id>
      <name_type>r</name_type>
      <filesize>149</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>28</inode>
      <meta_type>1</meta_type>
      <mode>384</mode>
      <nlink>1</nlink>
      <uid>501</uid>
      <gid>501</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:42Z</mtime>
      <ctime>2009-01-29T17:33:42Z</ctime>
      <atime>2009-01-29T17:33:42Z</atime>
      <crtime>2009-01-29T17:33:42Z</crtime>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='9486336' img_offset='9486336' len='149'/>
      </byte_runs>
      <hashdigest type='md5'>8a6dbfb52fdeded6bf8b77e2120b5b1a</hashdigest>
      <hashdigest type='sha1'>c96fd913dfd0b753158cc407de6cb6aef44cc20e</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>21</inode>
      </parent_object>
      <filename>.fseventsd/fseventsd-uuid</filename>
      <partition>1</partition>
      <id>11</id>
      <name_type>r</name_type>
      <filesize>36</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>22</inode>
      <meta_type>1</meta_type>
      <mode>384</mode>
      <nlink>1</nlink>
      <uid>501</uid>
      <gid>501</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:42Z</mtime>
      <ctime>2009-01-29T17:33:42Z</ctime>
      <atime>2009-01-29T17:33:42Z</atime>
      <crtime>2009-01-29T17:33:34Z</crtime>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='9465856' img_offset='9465856' len='36'/>
      </byte_runs>
      <hashdigest type='md5'>d9ba039609c374dcb06dbb3bff04c582</hashdigest>
      <hashdigest type='sha1'>43f8b731de2d5ea70a99db6400daa6afcf975802</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>.HFS+ Private Directory Data\x0D</filename>
      <partition>1</partition>
      <id>12</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>19</inode>
      <meta_type>2</meta_type>
      <mode>877</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:30Z</mtime>
      <ctime>2009-01-29T17:33:30Z</ctime>
      <atime>2009-01-29T17:33:30Z</atime>
      <crtime>2009-01-29T17:33:30Z</crtime>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>19</inode>
      </parent_object>
      <filename>.HFS+ Private Directory Data\x0D/..</filename>
      <partition>1</partition>
      <id>13</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>2</inode>
      <meta_type>2</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>99</uid>
      <gid>99</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:35Z</mtime>
      <ctime>2009-01-29T17:33:35Z</ctime>
      <crtime>2009-01-29T17:33:30Z</crtime>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>.journal</filename>
      <partition>1</partition>
      <id>14</id>
      <name_type>r</name_type>
      <filesize>8388608</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>16</inode>
      <meta_type>1</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:31Z</mtime>
      <crtime>2009-01-29T17:33:31Z</crtime>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='12288' img_offset='12288' len='8388608'/>
      </byte_runs>
      <hashdigest type='md5'>edbf1bfafa8170503c6cbf7e91cde05b</hashdigest>
      <hashdigest type='sha1'>6fe668e13286cf67f82e10fb78d34917b3bac58c</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>.journal_info_block</filename>
      <partition>1</partition>
      <id>15</id>
      <name_type>r</name_type>
      <filesize>4096</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>17</inode>
      <meta_type>1</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:30Z</mtime>
      <crtime>2009-01-29T17:33:30Z</crtime>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='8192' img_offset='8192' len='4096'/>
      </byte_runs>
      <hashdigest type='md5'>9d185f70e410122e702073d1c4957eb1</hashdigest>
      <hashdigest type='sha1'>0b6dff3f813af2944929029ea29a4ec33628af37</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>.Trashes</filename>
      <partition>1</partition>
      <id>16</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>20</inode>
      <meta_type>2</meta_type>
      <mode>731</mode>
      <nlink>1</nlink>
      <uid>501</uid>
      <gid>501</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:42Z</mtime>
      <ctime>2009-01-29T17:33:42Z</ctime>
      <atime>2009-01-29T17:33:34Z</atime>
      <crtime>2009-01-29T17:33:34Z</crtime>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>20</inode>
      </parent_object>
      <filename>.Trashes/..</filename>
      <partition>1</partition>
      <id>17</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>2</inode>
      <meta_type>2</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>99</uid>
      <gid>99</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:35Z</mtime>
      <ctime>2009-01-29T17:33:35Z</ctime>
      <crtime>2009-01-29T17:33:30Z</crtime>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>file1.txt</filename>
      <partition>1</partition>
      <id>18</id>
      <name_type>r</name_type>
      <filesize>28</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>24</inode>
      <meta_type>1</meta_type>
      <mode>420</mode>
      <nlink>1</nlink>
      <uid>501</uid>
      <gid>501</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:42Z</mtime>
      <ctime>2009-01-29T17:33:42Z</ctime>
      <atime>2009-01-29T17:33:35Z</atime>
      <crtime>2009-01-29T17:33:35Z</crtime>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='9482240' img_offset='9482240' len='28'/>
      </byte_runs>
      <hashdigest type='md5'>fdb2cbe03eadd06158b0d3acd17d62aa</hashdigest>
      <hashdigest type='sha1'>bc4eb9fa980cb82808292e47f023874b8e63d068</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>file2.txt</filename>
      <partition>1</partition>
      <id>19</id>
      <name_type>r</name_type>
      <filesize>23</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>25</inode>
      <meta_type>1</meta_type>
      <mode>420</mode>
      <nlink>1</nlink>
      <uid>501</uid>
      <gid>501</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:35Z</mtime>
      <ctime>2009-01-29T17:33:35Z</ctime>
      <atime>2009-01-29T17:33:35Z</atime>
      <crtime>2009-01-29T17:33:35Z</crtime>
      <byte_runs facet='data'>
       <byte_run file_offset='0' fs_offset='9474048' img_offset='9474048' len='23'/>
      </byte_runs>
      <hashdigest type='md5'>476b30654f28faa9c46f5876c9d1ae5b</hashdigest>
      <hashdigest type='sha1'>d1d2a3107039298f5e70c1699d36d1d37bf66b20</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>^^^^HFS+ Private Data</filename>
      <partition>1</partition>
      <id>20</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>18</inode>
      <meta_type>2</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:30Z</mtime>
      <ctime>2009-01-29T17:33:30Z</ctime>
      <atime>2009-01-29T17:33:30Z</atime>
      <crtime>2009-01-29T17:33:30Z</crtime>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>18</inode>
      </parent_object>
      <filename>^^^^HFS+ Private Data/..</filename>
      <partition>1</partition>
      <id>21</id>
      <name_type>d</name_type>
      <filesize>0</filesize>
      <alloc_inode>1</alloc_inode>
      <alloc_name>1</alloc_name>
      <used>1</used>
      <inode>2</inode>
      <meta_type>2</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>99</uid>
      <gid>99</gid>
      <byte_runs facet='inode'>
      </byte_runs>
      <mtime>2009-01-29T17:33:35Z</mtime>
      <ctime>2009-01-29T17:33:35Z</ctime>
      <crtime>2009-01-29T17:33:30Z</crtime>
    </fileobject>
  </volume>
<!-- end of volume -->
</dfxml>
