<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-6.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/ae/AE10-001/AE10-001.xml -IMf /home/slgarfin/corp/drives/nus/ae/AE10-001/AE10-001.E01 /home/slgarfin/corp/drives/nus/ae/AE10-001/AE10-001.E02 /home/slgarfin/corp/drives/nus/ae/AE10-001/AE10-001.E03</command_line><start_time>2012-03-04T04:06:17Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/ae/AE10-001/AE10-001.E01</image_filename>
  </source><volume offset="32256"><partition_offset>32256</partition_offset><block_size>512</block_size><ftype>8</ftype><ftype_str>fat32</ftype_str><block_count>78155217</block_count><first_block>0</first_block><last_block>78155216</last_block><fileobject><filename>P0000001.SYS</filename><partition>1</partition><id>1</id><name_type>r</name_type><filesize>222390</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>1</meta_type><mode>73</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1998-05-12T03:01:00Z</mtime><atime>2009-12-29T08:00:00Z</atime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="9818112" len="222390" img_offset="9850368"></byte_run>
      </byte_runs><hashdigest type="md5">2cda0bf24a44750b18f9db4d15c671b3</hashdigest><hashdigest type="sha1">328ede2e2a1485a78e1fe56d6a0fb214e727f5e4</hashdigest>
    </fileobject><fileobject><filename>P0000002.SYS</filename><partition>1</partition><id>2</id><name_type>r</name_type><filesize>9</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>1</meta_type><mode>73</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1998-05-12T03:01:00Z</mtime><atime>2009-12-29T08:00:00Z</atime><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10047488" len="9" img_offset="10079744"></byte_run>
      </byte_runs><hashdigest type="md5">734040ec3565b902d87a3ebf89bedd77</hashdigest><hashdigest type="sha1">958d342c1801ae248d3bf83dc07f17c934d37212</hashdigest>
    </fileobject><fileobject><filename>P0000003.COM</filename><partition>1</partition><id>3</id><name_type>r</name_type><filesize>93880</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1998-05-12T03:01:00Z</mtime><atime>2009-12-29T08:00:00Z</atime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10080256" len="93880" img_offset="10112512"></byte_run>
      </byte_runs><hashdigest type="md5">b067cc477e113932e0a997e9d5e4319d</hashdigest><hashdigest type="sha1">c84db785e5dc9341f5406908c57e1e3c19d086e5</hashdigest>
    </fileobject><fileobject><filename>P0000004.SYS</filename><partition>1</partition><id>4</id><name_type>r</name_type><filesize>55</filesize><alloc>1</alloc><used>1</used><inode>6</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1997-04-25T22:34:44Z</mtime><atime>2009-12-29T08:00:00Z</atime><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10178560" len="55" img_offset="10210816"></byte_run>
      </byte_runs><hashdigest type="md5">de8ce2720e0f6e394614c53e5b60b9dc</hashdigest><hashdigest type="sha1">dd981a406b6d053ebc663aa6593e86fe81e1962d</hashdigest>
    </fileobject><fileobject><filename>P0000005.BAT</filename><partition>1</partition><id>5</id><name_type>r</name_type><filesize>34</filesize><alloc>1</alloc><used>1</used><inode>7</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1997-04-25T22:35:30Z</mtime><atime>2009-12-29T08:00:00Z</atime><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10211328" len="34" img_offset="10243584"></byte_run>
      </byte_runs><hashdigest type="md5">7ca414ec43f910988f231e7afd7e95b8</hashdigest><hashdigest type="sha1">062fc120b9ecc1962fa5644a977b494c5cc394d7</hashdigest>
    </fileobject><fileobject><filename>DEV</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>8</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2009-12-29T22:50:14Z</mtime><atime>2009-12-29T08:00:00Z</atime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10244096" len="32768" img_offset="10276352"></byte_run>
      </byte_runs><hashdigest type="md5">17fab935cb68b5022ad612202dd670af</hashdigest><hashdigest type="sha1">cf311717fb9bde0be2af1c06733c305ff4409263</hashdigest>
    </fileobject><fileobject><filename>DEV/.</filename><partition>1</partition><id>7</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>8</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2009-12-29T22:50:14Z</mtime><atime>2009-12-29T08:00:00Z</atime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10244096" len="32768" img_offset="10276352"></byte_run>
      </byte_runs><hashdigest type="md5">17fab935cb68b5022ad612202dd670af</hashdigest><hashdigest type="sha1">cf311717fb9bde0be2af1c06733c305ff4409263</hashdigest>
    </fileobject><fileobject><filename>DEV/..</filename><partition>1</partition><id>8</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="9785344" len="32768" img_offset="9817600"></byte_run>
      </byte_runs><hashdigest type="md5">b34f577061aba5b04885728508b854df</hashdigest><hashdigest type="sha1">881e3739c34146bcab9d57310a6052c63b223c84</hashdigest>
    </fileobject><fileobject><filename>DEV/D011V200.SYS</filename><partition>1</partition><id>9</id><name_type>r</name_type><filesize>23426</filesize><alloc>1</alloc><used>1</used><inode>14341</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><atime>2009-12-29T08:00:00Z</atime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10276864" len="23426" img_offset="10309120"></byte_run>
      </byte_runs><hashdigest type="md5">0886af8138e647c5798517dfdbe4ae4c</hashdigest><hashdigest type="sha1">e82802d63ab62080d954b107ae1fee917b585156</hashdigest>
    </fileobject><fileobject><filename>P0000006.EXE</filename><partition>1</partition><id>10</id><name_type>r</name_type><filesize>25473</filesize><alloc>1</alloc><used>1</used><inode>9</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1998-05-12T03:01:00Z</mtime><atime>2010-09-05T07:00:00Z</atime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10309632" len="25473" img_offset="10341888"></byte_run>
      </byte_runs><hashdigest type="md5">5bd08551c96f27988fb844146b8ee4dc</hashdigest><hashdigest type="sha1">78e5fb1cc1259dddec7af505ffc91b8d9d7c76ac</hashdigest>
    </fileobject><fileobject><filename>P0000007</filename><partition>1</partition><id>11</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>12</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10342400" len="32768" img_offset="10374656"></byte_run>
      </byte_runs><hashdigest type="md5">70378303b41611635419d23e663b2396</hashdigest><hashdigest type="sha1">367c6b8e85576f98909b65032e09e7b653b11279</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008</filename><partition>1</partition><id>12</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>12</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10342400" len="32768" img_offset="10374656"></byte_run>
      </byte_runs><hashdigest type="md5">70378303b41611635419d23e663b2396</hashdigest><hashdigest type="sha1">367c6b8e85576f98909b65032e09e7b653b11279</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000009</filename><partition>1</partition><id>13</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="9785344" len="32768" img_offset="9817600"></byte_run>
      </byte_runs><hashdigest type="md5">b34f577061aba5b04885728508b854df</hashdigest><hashdigest type="sha1">881e3739c34146bcab9d57310a6052c63b223c84</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010</filename><partition>1</partition><id>14</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>17417</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10375168" len="32768" img_offset="10407424"></byte_run>
      </byte_runs><hashdigest type="md5">f3bd2e83b60b596c2bd3ae1a54dd85e9</hashdigest><hashdigest type="sha1">6c1365d38326696ba81b1466dcbf11eb0c9e3436</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010/P0000008</filename><partition>1</partition><id>15</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>17417</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10375168" len="32768" img_offset="10407424"></byte_run>
      </byte_runs><hashdigest type="md5">f3bd2e83b60b596c2bd3ae1a54dd85e9</hashdigest><hashdigest type="sha1">6c1365d38326696ba81b1466dcbf11eb0c9e3436</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010/P0000009</filename><partition>1</partition><id>16</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>12</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10342400" len="32768" img_offset="10374656"></byte_run>
      </byte_runs><hashdigest type="md5">70378303b41611635419d23e663b2396</hashdigest><hashdigest type="sha1">367c6b8e85576f98909b65032e09e7b653b11279</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010/P0000011</filename><partition>1</partition><id>17</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>18437</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10407936" len="32768" img_offset="10440192"></byte_run>
      </byte_runs><hashdigest type="md5">3c8b88052c09927e24a6a2c747ce7ea7</hashdigest><hashdigest type="sha1">1e319c2b2064489846cc13dd724a68f98aa0288a</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010/P0000011/P0000008</filename><partition>1</partition><id>18</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>18437</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10407936" len="32768" img_offset="10440192"></byte_run>
      </byte_runs><hashdigest type="md5">3c8b88052c09927e24a6a2c747ce7ea7</hashdigest><hashdigest type="sha1">1e319c2b2064489846cc13dd724a68f98aa0288a</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010/P0000011/P0000009</filename><partition>1</partition><id>19</id><name_type>d</name_type><filesize>32768</filesize><alloc>1</alloc><used>1</used><inode>17417</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10375168" len="32768" img_offset="10407424"></byte_run>
      </byte_runs><hashdigest type="md5">f3bd2e83b60b596c2bd3ae1a54dd85e9</hashdigest><hashdigest type="sha1">6c1365d38326696ba81b1466dcbf11eb0c9e3436</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010/P0000011/P0000012.log</filename><partition>1</partition><id>20</id><name_type>r</name_type><filesize>418</filesize><alloc>1</alloc><used>1</used><inode>19461</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-09-05T17:38:08Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>2010-09-05T17:38:07Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10473472" len="418" img_offset="10505728"></byte_run>
      </byte_runs><hashdigest type="md5">e8227efb56ca72cba08d77f90f1adab0</hashdigest><hashdigest type="sha1">bd8371d8e3a5f8398d6bcf21a87abc8df8f83f3b</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000010/P0000011/P0000013.EXE</filename><partition>1</partition><id>21</id><name_type>r</name_type><filesize>25473</filesize><alloc>1</alloc><used>1</used><inode>19462</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1998-05-12T03:01:00Z</mtime><atime>2010-09-05T07:00:00Z</atime><crtime>1980-01-01T08:00:00Z</crtime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="10440704" len="25473" img_offset="10472960"></byte_run>
      </byte_runs><hashdigest type="md5">5bd08551c96f27988fb844146b8ee4dc</hashdigest><hashdigest type="sha1">78e5fb1cc1259dddec7af505ffc91b8d9d7c76ac</hashdigest>
    </fileobject><fileobject><filename>P0000014</filename><partition>1</partition><id>22</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>1250177683</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x58, OEM-ID "MSWIN4.1", sectors/cluster 64, Media descriptor 0xf8, heads 240, hidden sectors 63, sectors 78155217 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 9540, reserved3 0x800000, serial number 0x1028160b, unlabeled</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">239f570f49021e277b19ddb9386b1654</hashdigest><hashdigest type="sha1">ac3741b01525e286e5b7cdfd65ed746d224922fa</hashdigest>
    </fileobject><fileobject><filename>P0000015</filename><partition>1</partition><id>23</id><name_type>v</name_type><filesize>4884480</filesize><alloc>1</alloc><used>1</used><inode>1250177684</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="16384" len="4884480" img_offset="48640"></byte_run>
      </byte_runs><hashdigest type="md5">5d6f78cea83917afab284f16f3e200b2</hashdigest><hashdigest type="sha1">aed7500122626f198be34f4c8cd9b01f3ef29f88</hashdigest>
    </fileobject><fileobject><filename>P0000016</filename><partition>1</partition><id>24</id><name_type>v</name_type><filesize>4884480</filesize><alloc>1</alloc><used>1</used><inode>1250177685</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4900864" len="4884480" img_offset="4933120"></byte_run>
      </byte_runs><hashdigest type="md5">5d6f78cea83917afab284f16f3e200b2</hashdigest><hashdigest type="sha1">aed7500122626f198be34f4c8cd9b01f3ef29f88</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>25</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>1250177686</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>51</user_seconds><system_seconds>84</system_seconds><maxrss>0</maxrss><reclaims>44663</reclaims><faults>94</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:42:03 2012</stop_time>
  </runstats></dfxml>