<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-17.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn10-14.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn10-14.aff</command_line><start_time>2012-03-04T04:11:47Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn10-14.aff</image_filename>
  </source><device_sn>0</device_sn><pagesize>16777216</pagesize><sectorsize>512</sectorsize><acquisition_seconds>50</acquisition_seconds><volume offset="16384"><partition_offset>16384</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>235744</block_count><first_block>0</first_block><last_block>235743</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>d</name_type><filesize>2048</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4762112" len="2048" img_offset="4778496"></byte_run>
      </byte_runs><hashdigest type="md5">f29805f8ade765203ffa6ca572586d81</hashdigest><hashdigest type="sha1">965481e4b9149d70640330b842c0d3d6000959f2</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000002</filename><partition>1</partition><id>2</id><name_type>d</name_type><filesize>2048</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4762112" len="2048" img_offset="4778496"></byte_run>
      </byte_runs><hashdigest type="md5">f29805f8ade765203ffa6ca572586d81</hashdigest><hashdigest type="sha1">965481e4b9149d70640330b842c0d3d6000959f2</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000003</filename><partition>1</partition><id>3</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="236032" len="16384" img_offset="252416"></byte_run>
      </byte_runs><hashdigest type="md5">ec710d536e7a4bc7bc8281734eb99d1f</hashdigest><hashdigest type="sha1">d992f411ca7326caee1fb5aad5753903ff702017</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>2048</filesize><alloc>1</alloc><used>1</used><inode>141445</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4764160" len="2048" img_offset="4780544"></byte_run>
      </byte_runs><hashdigest type="md5">86d0372ed829203e13fd9308d8bea46b</hashdigest><hashdigest type="sha1">2331d386667d238f18314708dc411720075ac263</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000002</filename><partition>1</partition><id>5</id><name_type>d</name_type><filesize>2048</filesize><alloc>1</alloc><used>1</used><inode>141445</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4764160" len="2048" img_offset="4780544"></byte_run>
      </byte_runs><hashdigest type="md5">86d0372ed829203e13fd9308d8bea46b</hashdigest><hashdigest type="sha1">2331d386667d238f18314708dc411720075ac263</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000003</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>2048</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4762112" len="2048" img_offset="4778496"></byte_run>
      </byte_runs><hashdigest type="md5">f29805f8ade765203ffa6ca572586d81</hashdigest><hashdigest type="sha1">965481e4b9149d70640330b842c0d3d6000959f2</hashdigest>
    </fileobject><fileobject><filename>P0000005</filename><partition>1</partition><id>7</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>3764531</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, mkdosfs boot message display, code offset 0x3c, OEM-ID "DOGS_1.0", sectors/cluster 4, root entries 512, Media descriptor 0xf8, sectors/FAT 230, heads 8, hidden sectors 32, sectors 235744 (volumes > 32 MB) , serial number 0x513437d2, unlabeled, FAT (16 bit)</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="16384"></byte_run>
      </byte_runs><hashdigest type="md5">0fee32e92519944408518f8c018738ae</hashdigest><hashdigest type="sha1">d6d2dfc9da2890838c18a9c8cb410ced8cf86c60</hashdigest>
    </fileobject><fileobject><filename>P0000006</filename><partition>1</partition><id>8</id><name_type>v</name_type><filesize>117760</filesize><alloc>1</alloc><used>1</used><inode>3764532</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="512" len="117760" img_offset="16896"></byte_run>
      </byte_runs><hashdigest type="md5">f2d2ea47f4760bda9a4d1b40014b1aa4</hashdigest><hashdigest type="sha1">c1335995b744deccebf54b504d44dd8f21e45136</hashdigest>
    </fileobject><fileobject><filename>P0000007</filename><partition>1</partition><id>9</id><name_type>v</name_type><filesize>117760</filesize><alloc>1</alloc><used>1</used><inode>3764533</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="118272" len="117760" img_offset="134656"></byte_run>
      </byte_runs><hashdigest type="md5">f2d2ea47f4760bda9a4d1b40014b1aa4</hashdigest><hashdigest type="sha1">c1335995b744deccebf54b504d44dd8f21e45136</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>10</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3764534</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON</filename><partition>1</partition><id>11</id><name_type>-</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2030-02-06T09:09:16Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="256512" len="2048" img_offset="272896"></byte_run>
      </byte_runs><hashdigest type="md5">013cd8705e250280b3579787fe7ab100</hashdigest><hashdigest type="sha1">a891e96b0150b4c3fb45f931085628cede93bf75</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/.</filename><partition>1</partition><id>12</id><name_type>d</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2030-02-06T09:09:16Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="256512" len="2048" img_offset="272896"></byte_run>
      </byte_runs><hashdigest type="md5">013cd8705e250280b3579787fe7ab100</hashdigest><hashdigest type="sha1">a891e96b0150b4c3fb45f931085628cede93bf75</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/..</filename><partition>1</partition><id>13</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3764534</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/_MG_0001.JPG</filename><partition>1</partition><id>14</id><name_type>r</name_type><filesize>1094801</filesize><unalloc>1</unalloc><used>1</used><inode>645</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2030-02-06T09:10:30Z</mtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="258560" len="1094801" img_offset="274944"></byte_run>
      </byte_runs><hashdigest type="md5">39debf09eace628794416c7100249a5b</hashdigest><hashdigest type="sha1">122af4730806f3596599e4a0d4eceba15c7b4aa8</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/_MG_0002.JPG</filename><partition>1</partition><id>15</id><name_type>r</name_type><filesize>1031408</filesize><unalloc>1</unalloc><used>1</used><inode>646</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2030-02-06T09:10:56Z</mtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1356288" len="1031408" img_offset="1372672"></byte_run>
      </byte_runs><hashdigest type="md5">2d670c8fd2275dceedfaf3252454ac59</hashdigest><hashdigest type="sha1">c8fcec45c1212534bfac061da0c27c647698fd62</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/_MG_0003.JPG</filename><partition>1</partition><id>16</id><name_type>r</name_type><filesize>1813836</filesize><unalloc>1</unalloc><used>1</used><inode>647</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:02:10Z</mtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="254464" len="1813836" img_offset="270848"></byte_run>
      </byte_runs><hashdigest type="md5">29f8ea0f6ba582837a394c9657cc2b0b</hashdigest><hashdigest type="sha1">48001d66df1daf41699a9a8159981a6802426dca</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/_MG_0004.JPG</filename><partition>1</partition><id>17</id><name_type>r</name_type><filesize>1008285</filesize><unalloc>1</unalloc><used>1</used><inode>648</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:02:52Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4211200" len="550912" img_offset="4227584"></byte_run><byte_run file_offset="550912" fs_offset="4766208" len="457373" img_offset="4782592"></byte_run>
      </byte_runs><hashdigest type="md5">aef6342b5f5d42961bfcedcbf42cc802</hashdigest><hashdigest type="sha1">996f4e3a922c00bc0ee452cb95ade7418fe01eb2</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC</filename><partition>1</partition><id>18</id><name_type>-</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>518</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2030-02-06T09:10:30Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1354240" len="2048" img_offset="1370624"></byte_run>
      </byte_runs><hashdigest type="md5">f244f239d038b0ed62970391be44fe61</hashdigest><hashdigest type="sha1">3f064cad026b01dddc349aaa75ae60ac91c773f8</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC/.</filename><partition>1</partition><id>19</id><name_type>d</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>518</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2030-02-06T09:10:30Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1354240" len="2048" img_offset="1370624"></byte_run>
      </byte_runs><hashdigest type="md5">f244f239d038b0ed62970391be44fe61</hashdigest><hashdigest type="sha1">3f064cad026b01dddc349aaa75ae60ac91c773f8</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC/..</filename><partition>1</partition><id>20</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3764534</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC/_00.CTG</filename><partition>1</partition><id>21</id><name_type>r</name_type><filesize>6638</filesize><unalloc>1</unalloc><used>1</used><inode>34949</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:02:52Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="5220864" len="6638" img_offset="5237248"></byte_run>
      </byte_runs><hashdigest type="md5">e6b4b4d37580619183e6072745f27fd5</hashdigest><hashdigest type="sha1">ab9d826540d5ab8702e4bf973584d028f39690a3</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC/_.CTG</filename><partition>1</partition><id>22</id><name_type>r</name_type><filesize>383</filesize><unalloc>1</unalloc><used>1</used><inode>34950</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:02:52Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="5229056" len="383" img_offset="5245440"></byte_run>
      </byte_runs><hashdigest type="md5">099282af960977ed2042ae6b869e0595</hashdigest><hashdigest type="sha1">91ea77d6879ef8430f00fa8c4f43d9f83a46b256</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_S.CK</filename><partition>1</partition><id>23</id><name_type>-</name_type><filesize>0</filesize><unalloc>1</unalloc><used>1</used><inode>519</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:00Z</mtime><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON</filename><partition>1</partition><id>24</id><name_type>-</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>67269</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:00Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2390528" len="2048" img_offset="2406912"></byte_run>
      </byte_runs><hashdigest type="md5">51d40f5ef4eec626f6bb02ef9c043425</hashdigest><hashdigest type="sha1">11301912c6606f4cc80f398308fbeb9d53005c2f</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/.</filename><partition>1</partition><id>25</id><name_type>d</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>67269</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:00Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2390528" len="2048" img_offset="2406912"></byte_run>
      </byte_runs><hashdigest type="md5">51d40f5ef4eec626f6bb02ef9c043425</hashdigest><hashdigest type="sha1">11301912c6606f4cc80f398308fbeb9d53005c2f</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/..</filename><partition>1</partition><id>26</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3764534</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/_MG_0001.JPG</filename><partition>1</partition><id>27</id><name_type>r</name_type><filesize>1227668</filesize><unalloc>1</unalloc><used>1</used><inode>67333</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:04Z</mtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2392576" len="1227668" img_offset="2408960"></byte_run>
      </byte_runs><hashdigest type="md5">4bdfa927afdb9f487f89e7bddf180d32</hashdigest><hashdigest type="sha1">35f8dca83c3d22e5858e968e3c28d0f8cd48a2a5</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_00CANON/_MG_0002.JPG</filename><partition>1</partition><id>28</id><name_type>r</name_type><filesize>1137343</filesize><unalloc>1</unalloc><used>1</used><inode>67334</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="3621376" len="1137343" img_offset="3637760"></byte_run>
      </byte_runs><hashdigest type="md5">1b03182fab49b880857658bf2ee85e26</hashdigest><hashdigest type="sha1">d0caf0ba10158badfb021e362c40e5094fc151d3</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC</filename><partition>1</partition><id>29</id><name_type>-</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>67270</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4760064" len="2048" img_offset="4776448"></byte_run>
      </byte_runs><hashdigest type="md5">9268107691217c84534bdac23d4e1a54</hashdigest><hashdigest type="sha1">ce5d9313bfbda9b2f675c5872ad1d2889fc9faee</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC/.</filename><partition>1</partition><id>30</id><name_type>d</name_type><filesize>2048</filesize><unalloc>1</unalloc><used>1</used><inode>67270</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>1980-01-01T08:00:20Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4760064" len="2048" img_offset="4776448"></byte_run>
      </byte_runs><hashdigest type="md5">9268107691217c84534bdac23d4e1a54</hashdigest><hashdigest type="sha1">ce5d9313bfbda9b2f675c5872ad1d2889fc9faee</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/_ANONMSC/..</filename><partition>1</partition><id>31</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3764534</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>0</user_seconds><system_seconds>0</system_seconds><maxrss>0</maxrss><reclaims>37794</reclaims><faults>65</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:13:14 2012</stop_time>
  </runstats></dfxml>