<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-15.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn10-01.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn10-01.aff</command_line><start_time>2012-03-04T04:09:08Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn10-01.aff</image_filename>
  </source><device_sn>0</device_sn><pagesize>16777216</pagesize><sectorsize>512</sectorsize><acquisition_seconds>171</acquisition_seconds><volume offset="32256"><partition_offset>32256</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>1000881</block_count><first_block>0</first_block><last_block>1000880</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>r</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>P0000002</filename><partition>1</partition><id>2</id><name_type>d</name_type><filesize>8192</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="267776" len="8192" img_offset="300032"></byte_run>
      </byte_runs><hashdigest type="md5">265e2e75a18a7f09755b9300200bef1d</hashdigest><hashdigest type="sha1">35305ed16d1cea15226f7e4343caec96820b0265</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000003</filename><partition>1</partition><id>3</id><name_type>d</name_type><filesize>8192</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="267776" len="8192" img_offset="300032"></byte_run>
      </byte_runs><hashdigest type="md5">265e2e75a18a7f09755b9300200bef1d</hashdigest><hashdigest type="sha1">35305ed16d1cea15226f7e4343caec96820b0265</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000004</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="251392" len="16384" img_offset="283648"></byte_run>
      </byte_runs><hashdigest type="md5">e57a48efc6c9c59eb1854e7b8edb8986</hashdigest><hashdigest type="sha1">e63ea9c726796732324c07fcf1a954bdb5518944</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005</filename><partition>1</partition><id>5</id><name_type>d</name_type><filesize>8192</filesize><alloc>1</alloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="275968" len="8192" img_offset="308224"></byte_run>
      </byte_runs><hashdigest type="md5">f8c66e834b0140ccbad1969e4bca0663</hashdigest><hashdigest type="sha1">2794da3147d172f5fd00d492174b7d2504d14cdf</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005/P0000003</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>8192</filesize><alloc>1</alloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="275968" len="8192" img_offset="308224"></byte_run>
      </byte_runs><hashdigest type="md5">f8c66e834b0140ccbad1969e4bca0663</hashdigest><hashdigest type="sha1">2794da3147d172f5fd00d492174b7d2504d14cdf</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005/P0000004</filename><partition>1</partition><id>7</id><name_type>d</name_type><filesize>8192</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="267776" len="8192" img_offset="300032"></byte_run>
      </byte_runs><hashdigest type="md5">265e2e75a18a7f09755b9300200bef1d</hashdigest><hashdigest type="sha1">35305ed16d1cea15226f7e4343caec96820b0265</hashdigest>
    </fileobject><fileobject><filename>P0000006</filename><partition>1</partition><id>8</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>16006243</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector; partition 3: ID=0x70, starthead 0, startsector 3072, 0 sectors; partition 4: ID=0x42, starthead 0, startsector 1126178895, 2147503439 sectors, code offset 0x3e, OEM-ID "PwrShot ", sectors/cluster 16, root entries 512, Media descriptor 0xf8, sectors/FAT 245, heads 16, hidden sectors 63, sectors 1000881 (volumes > 32 MB) , serial number 0x5ed544e1, label: "CANON_DC   ", FAT (16 bit)</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">1ff0ddf242cdeaf541321ca9b13a5ba5</hashdigest><hashdigest type="sha1">4e8c15032e4d9e420068ba84470ece05567582bc</hashdigest>
    </fileobject><fileobject><filename>P0000007</filename><partition>1</partition><id>9</id><name_type>v</name_type><filesize>125440</filesize><alloc>1</alloc><used>1</used><inode>16006244</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="512" len="125440" img_offset="32768"></byte_run>
      </byte_runs><hashdigest type="md5">2469827cb587b58f3d708011a88b0778</hashdigest><hashdigest type="sha1">2b0b1610e2ae971827541c7d9c5dcb56212a105e</hashdigest>
    </fileobject><fileobject><filename>P0000008</filename><partition>1</partition><id>10</id><name_type>v</name_type><filesize>125440</filesize><alloc>1</alloc><used>1</used><inode>16006245</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="125952" len="125440" img_offset="158208"></byte_run>
      </byte_runs><hashdigest type="md5">2469827cb587b58f3d708011a88b0778</hashdigest><hashdigest type="sha1">2b0b1610e2ae971827541c7d9c5dcb56212a105e</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>11</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>16006246</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/IMG_0001.JPG</filename><partition>1</partition><id>12</id><name_type>-</name_type><filesize>863603</filesize><unalloc>1</unalloc><used>1</used><inode>1029</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>JPEG image data, EXIF standard 2.21</libmagic><byte_runs><byte_run file_offset="0" fs_offset="292352" len="863603" img_offset="324608"></byte_run>
      </byte_runs><hashdigest type="md5">26f815d5489a6c0eac10cefedd002d67</hashdigest><hashdigest type="sha1">4b0f3ca4436a61ff5fdf9364e21cafd35e97cac0</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_utorun.pif</filename><partition>1</partition><id>13</id><name_type>-</name_type><filesize>280626</filesize><unalloc>1</unalloc><used>1</used><inode>8998149</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2005-10-16T19:00:00Z</mtime><atime>2007-07-22T07:00:00Z</atime><crtime>2007-07-22T17:24:16Z</crtime><libmagic>PE32 executable for MS Windows (GUI) Intel 80386 32-bit</libmagic><byte_runs><byte_run file_offset="0" fs_offset="288200192" len="280626" img_offset="288232448"></byte_run>
      </byte_runs><hashdigest type="md5">c011cb3625e42d1b7bc5b9c1c1ebb746</hashdigest><hashdigest type="sha1">bc763215a5dabe20fe47e8f60310725f4e344ef1</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_utorun.pif</filename><partition>1</partition><id>14</id><name_type>-</name_type><filesize>280626</filesize><unalloc>1</unalloc><used>1</used><inode>8998150</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2005-10-16T19:00:00Z</mtime><atime>2007-07-22T07:00:00Z</atime><crtime>2007-07-22T17:24:16Z</crtime><libmagic>PE32 executable for MS Windows (GUI) Intel 80386 32-bit</libmagic><byte_runs><byte_run file_offset="0" fs_offset="288200192" len="280626" img_offset="288232448"></byte_run>
      </byte_runs><hashdigest type="md5">c011cb3625e42d1b7bc5b9c1c1ebb746</hashdigest><hashdigest type="sha1">bc763215a5dabe20fe47e8f60310725f4e344ef1</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_utorun.pif</filename><partition>1</partition><id>15</id><name_type>-</name_type><filesize>280626</filesize><unalloc>1</unalloc><used>1</used><inode>8998151</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2005-10-16T19:00:00Z</mtime><atime>2007-07-22T07:00:00Z</atime><crtime>2007-07-22T17:24:16Z</crtime><libmagic>PE32 executable for MS Windows (GUI) Intel 80386 32-bit</libmagic><byte_runs><byte_run file_offset="0" fs_offset="256456192" len="280626" img_offset="256488448"></byte_run>
      </byte_runs><hashdigest type="md5">c011cb3625e42d1b7bc5b9c1c1ebb746</hashdigest><hashdigest type="sha1">bc763215a5dabe20fe47e8f60310725f4e344ef1</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/autorun.pif</filename><partition>1</partition><id>16</id><name_type>-</name_type><filesize>280626</filesize><unalloc>1</unalloc><used>1</used><inode>8998152</inode><meta_type>1</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2005-10-16T19:00:00Z</mtime><atime>2007-07-22T07:00:00Z</atime><crtime>2007-07-22T17:24:16Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="284160" len="280626" img_offset="316416"></byte_run>
      </byte_runs><hashdigest type="md5">76971d75be422cddedadac2b7f518699</hashdigest><hashdigest type="sha1">375d23bb7985a359e56cb15b0f92d4a1bf238911</hashdigest>
    </fileobject>
  </volume><runstats><user_seconds>16</user_seconds><system_seconds>2</system_seconds><maxrss>0</maxrss><reclaims>222346</reclaims><faults>1</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:15:01 2012</stop_time>
  </runstats></dfxml>