<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-36.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn16-31.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn16-31.aff</command_line><start_time>2012-03-04T04:06:26Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn16-31.aff</image_filename>
  </source><sectorsize>512</sectorsize><pagesize>16777216</pagesize><acquisition_seconds>768</acquisition_seconds><volume offset="32256"><partition_offset>32256</partition_offset><block_size>512</block_size><ftype>8</ftype><ftype_str>fat32</ftype_str><block_count>8290753</block_count><first_block>0</first_block><last_block>8290752</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>r</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-22T00:28:42Z</mtime><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>P0000002.exe</filename><partition>1</partition><id>2</id><name_type>r</name_type><filesize>18356</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>1</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-03-28T22:53:10Z</mtime><atime>2008-04-12T07:00:00Z</atime><crtime>2008-03-19T03:56:47Z</crtime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="8298496" len="18356" img_offset="8330752"></byte_run>
      </byte_runs><hashdigest type="md5">724ba6915165a17724e2977c5c5f5c9a</hashdigest><hashdigest type="sha1">049c19aac78904f1582f619366e23f3d92ea334e</hashdigest>
    </fileobject><fileobject><filename>P0000003.inf</filename><partition>1</partition><id>3</id><name_type>r</name_type><filesize>78</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>1</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-04-12T21:29:16Z</mtime><atime>2008-04-12T07:00:00Z</atime><crtime>2008-03-19T03:56:47Z</crtime><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="8318976" len="78" img_offset="8351232"></byte_run>
      </byte_runs><hashdigest type="md5">74dc19c72895a5c21bd53f83ac613061</hashdigest><hashdigest type="sha1">70aa739fe284317052227961ef7970480684fc4e</hashdigest>
    </fileobject><fileobject><filename>P0000004</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>4096</filesize><alloc>1</alloc><used>1</used><inode>7</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-03-19T03:57:44Z</mtime><atime>2008-03-18T07:00:00Z</atime><crtime>2008-03-19T03:57:43Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="8323072" len="4096" img_offset="8355328"></byte_run>
      </byte_runs><hashdigest type="md5">c2910e700a23613393169f71376e25ca</hashdigest><hashdigest type="sha1">111817041bc77cb0473cc8491df729521df1a2b0</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000005</filename><partition>1</partition><id>5</id><name_type>d</name_type><filesize>4096</filesize><alloc>1</alloc><used>1</used><inode>7</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-03-19T03:57:44Z</mtime><atime>2008-03-18T07:00:00Z</atime><crtime>2008-03-19T03:57:43Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="8323072" len="4096" img_offset="8355328"></byte_run>
      </byte_runs><hashdigest type="md5">c2910e700a23613393169f71376e25ca</hashdigest><hashdigest type="sha1">111817041bc77cb0473cc8491df729521df1a2b0</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000006</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>4096</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="8294400" len="4096" img_offset="8326656"></byte_run>
      </byte_runs><hashdigest type="md5">66032dcc5a745f37d536b195cf64ce4d</hashdigest><hashdigest type="sha1">ef599eb0bc3195da1685b1c78c490452169b8d89</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000007.exe</filename><partition>1</partition><id>7</id><name_type>r</name_type><filesize>6489914</filesize><alloc>1</alloc><used>1</used><inode>903</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2003-01-17T01:52:44Z</mtime><atime>2008-03-18T07:00:00Z</atime><crtime>2008-03-19T03:57:43Z</crtime><libmagic>PE32 executable for MS Windows (GUI) Intel 80386 32-bit</libmagic><byte_runs><byte_run file_offset="0" fs_offset="8327168" len="6489914" img_offset="8359424"></byte_run>
      </byte_runs><hashdigest type="md5">52b05fd14c2c79cbf6191d6330791228</hashdigest><hashdigest type="sha1">7929ea44fcc72b16a1d51d011a9bf2f14a5d3bd4</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000007.txt</filename><partition>1</partition><id>8</id><name_type>r</name_type><filesize>1205</filesize><alloc>1</alloc><used>1</used><inode>906</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2003-01-17T01:52:44Z</mtime><atime>2008-03-18T07:00:00Z</atime><crtime>2008-03-19T03:57:49Z</crtime><libmagic>ISO-8859 text, with very long lines, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="14819328" len="1205" img_offset="14851584"></byte_run>
      </byte_runs><hashdigest type="md5">9dde74d1d30427c0e5e7c2b60a229524</hashdigest><hashdigest type="sha1">2e9c67d923e659389359b58b7edbeb741b04983f</hashdigest>
    </fileobject><fileobject><filename>P0000004/P0000008.ini</filename><partition>1</partition><id>9</id><name_type>r</name_type><filesize>9</filesize><alloc>1</alloc><used>1</used><inode>907</inode><meta_type>1</meta_type><mode>365</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2007-05-16T17:08:28Z</mtime><atime>2008-03-18T07:00:00Z</atime><crtime>2008-03-19T03:57:49Z</crtime><libmagic>ASCII text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="14823424" len="9" img_offset="14855680"></byte_run>
      </byte_runs><hashdigest type="md5">61a63959dea57d1f4c381630eaed98a3</hashdigest><hashdigest type="sha1">012f756a5cd69cbb1d4a95b77ad5b583d71a8d94</hashdigest>
    </fileobject><fileobject><filename>P0000009</filename><partition>1</partition><id>10</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>132392851</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x58, OEM-ID "MSDOS5.0", sectors/cluster 8, reserved sectors 38, Media descriptor 0xf8, heads 255, hidden sectors 63, sectors 8290753 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 8081, serial number 0x706a7a5a, unlabeled</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">75cc2d1b3a54ce3a582119dfcc179aed</hashdigest><hashdigest type="sha1">f2d9383b38803a22d04fec9f1c2b317bc632c13b</hashdigest>
    </fileobject><fileobject><filename>P0000010</filename><partition>1</partition><id>11</id><name_type>v</name_type><filesize>4137472</filesize><alloc>1</alloc><used>1</used><inode>132392852</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="19456" len="4137472" img_offset="51712"></byte_run>
      </byte_runs><hashdigest type="md5">cd131018033410d0db2f3ae3056fd285</hashdigest><hashdigest type="sha1">6601bea12fe07868383bdcc148401c23194c183f</hashdigest>
    </fileobject><fileobject><filename>P0000011</filename><partition>1</partition><id>12</id><name_type>v</name_type><filesize>4137472</filesize><alloc>1</alloc><used>1</used><inode>132392853</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="4156928" len="4137472" img_offset="4189184"></byte_run>
      </byte_runs><hashdigest type="md5">cd131018033410d0db2f3ae3056fd285</hashdigest><hashdigest type="sha1">6601bea12fe07868383bdcc148401c23194c183f</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>13</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>132392854</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>18</user_seconds><system_seconds>0</system_seconds><maxrss>0</maxrss><reclaims>137085</reclaims><faults>0</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:12:45 2012</stop_time>
  </runstats></dfxml>