<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-0.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/in/IN10-0150/IN10-0150.xml -IMf /home/slgarfin/corp/drives/nus/in/IN10-0150/IN10-0150.E01</command_line><start_time>2012-03-04T05:02:07Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/in/IN10-0150/IN10-0150.E01</image_filename>
  </source><volume offset="32256"><partition_offset>32256</partition_offset><block_size>4096</block_size><ftype>1</ftype><ftype_str>ntfs</ftype_str><block_count>1574362</block_count><first_block>0</first_block><last_block>1574361</last_block><fileobject><filename>P0000001/P0000002</filename><partition>1</partition><id>1</id><name_type>d</name_type><filesize>344</filesize><alloc>1</alloc><used>1</used><inode>11</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:48:58Z</mtime><ctime>2010-02-09T13:48:58Z</ctime><atime>2010-02-09T13:48:58Z</atime><crtime>2010-02-09T13:48:58Z</crtime><seq>11</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="344" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">df9ebd6569c82fa4995fa0acb2d9eeba</hashdigest><hashdigest type="sha1">75804450a521f1ae240717b6d26c52d4b242b195</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000003</filename><partition>1</partition><id>2</id><name_type>d</name_type><filesize>56</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>48</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:48:58Z</crtime><seq>5</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="56" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">8e215da06984db90d45f84386e562799</hashdigest><hashdigest type="sha1">02d61a186293f7b5fc2c66b5dc3359ff6ebc683b</hashdigest>
    </fileobject><fileobject><filename>P0000002</filename><partition>1</partition><id>3</id><name_type>d</name_type><filesize>56</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>48</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:48:58Z</crtime><seq>5</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="56" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">8e215da06984db90d45f84386e562799</hashdigest><hashdigest type="sha1">02d61a186293f7b5fc2c66b5dc3359ff6ebc683b</hashdigest>
    </fileobject><fileobject><filename>P0000004</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>328</filesize><alloc>1</alloc><used>1</used><inode>29</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="328" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">32d23f2af56506866146fd405705d8e8</hashdigest><hashdigest type="sha1">1cf85846dd77bbaa9888f1d72e5a498bcf670697</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000002</filename><partition>1</partition><id>5</id><name_type>d</name_type><filesize>328</filesize><alloc>1</alloc><used>1</used><inode>29</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="328" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">32d23f2af56506866146fd405705d8e8</hashdigest><hashdigest type="sha1">1cf85846dd77bbaa9888f1d72e5a498bcf670697</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000003</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>56</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>48</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:48:58Z</crtime><seq>5</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="56" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">8e215da06984db90d45f84386e562799</hashdigest><hashdigest type="sha1">02d61a186293f7b5fc2c66b5dc3359ff6ebc683b</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000005</filename><partition>1</partition><id>7</id><name_type>d</name_type><filesize>248</filesize><alloc>1</alloc><used>1</used><inode>30</inode><meta_type>2</meta_type><mode>365</mode><nlink>2</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="248" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">49201d2c4716dadccd9b4421015c9be0</hashdigest><hashdigest type="sha1">739e1f3bfa3a05f072816f9ecd6c0683aa88e306</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000005/P0000002</filename><partition>1</partition><id>8</id><name_type>d</name_type><filesize>248</filesize><alloc>1</alloc><used>1</used><inode>30</inode><meta_type>2</meta_type><mode>365</mode><nlink>2</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="248" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">49201d2c4716dadccd9b4421015c9be0</hashdigest><hashdigest type="sha1">739e1f3bfa3a05f072816f9ecd6c0683aa88e306</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000005/P0000003</filename><partition>1</partition><id>9</id><name_type>d</name_type><filesize>328</filesize><alloc>1</alloc><used>1</used><inode>29</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="328" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">32d23f2af56506866146fd405705d8e8</hashdigest><hashdigest type="sha1">1cf85846dd77bbaa9888f1d72e5a498bcf670697</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000005/P0000006.ini</filename><partition>1</partition><id>10</id><name_type>r</name_type><filesize>65</filesize><alloc>1</alloc><used>1</used><inode>31</inode><meta_type>1</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="65" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">ad0b0b4416f06af436328a3c12dc491b</hashdigest><hashdigest type="sha1">743c7ad130780de78ccbf75aa6f84298720ad3fa</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000005/P0000007</filename><partition>1</partition><id>11</id><name_type>r</name_type><filesize>20</filesize><alloc>1</alloc><used>1</used><inode>32</inode><meta_type>1</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>Hitachi SH big-endian COFF object, not stripped</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="20" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">6b467c588be40ccdf492df4a5f914977</hashdigest><hashdigest type="sha1">5edd4f8d91886f8198617ba68c169bfc91bc5f28</hashdigest>
    </fileobject><fileobject><filename>P0000008</filename><partition>1</partition><id>12</id><name_type>d</name_type><filesize>296</filesize><alloc>1</alloc><used>1</used><inode>27</inode><meta_type>2</meta_type><mode>365</mode><nlink>2</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="296" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">4c133bf589a9bee6ffaedcae7d3ec717</hashdigest><hashdigest type="sha1">75b22da43836ddb68d54108a5c62228f8eed4b68</hashdigest>
    </fileobject><fileobject><filename>P0000008/P0000002</filename><partition>1</partition><id>13</id><name_type>d</name_type><filesize>296</filesize><alloc>1</alloc><used>1</used><inode>27</inode><meta_type>2</meta_type><mode>365</mode><nlink>2</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="296" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">4c133bf589a9bee6ffaedcae7d3ec717</hashdigest><hashdigest type="sha1">75b22da43836ddb68d54108a5c62228f8eed4b68</hashdigest>
    </fileobject><fileobject><filename>P0000008/P0000003</filename><partition>1</partition><id>14</id><name_type>d</name_type><filesize>56</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>365</mode><nlink>1</nlink><uid>48</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:48:58Z</crtime><seq>5</seq><libmagic>data</libmagic><byte_runs><byte_run type="resident" file_offset="0" fs_offset="0" len="56" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">8e215da06984db90d45f84386e562799</hashdigest><hashdigest type="sha1">02d61a186293f7b5fc2c66b5dc3359ff6ebc683b</hashdigest>
    </fileobject><fileobject><filename>P0000008/P0000009</filename><partition>1</partition><id>15</id><name_type>r</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>28</inode><meta_type>1</meta_type><mode>365</mode><nlink>2</nlink><uid>0</uid><gid>0</gid><mtime>2010-02-09T13:49:14Z</mtime><ctime>2010-02-09T13:49:14Z</ctime><atime>2010-02-09T13:49:14Z</atime><crtime>2010-02-09T13:49:14Z</crtime><seq>1</seq><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>0</user_seconds><system_seconds>0</system_seconds><maxrss>0</maxrss><reclaims>2979</reclaims><faults>7</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 21:02:20 2012</stop_time>
  </runstats></dfxml>