<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-40.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn18-15.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn18-15.aff</command_line><start_time>2012-03-04T04:12:25Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn18-15.aff</image_filename>
  </source><sectorsize>512</sectorsize><pagesize>16777216</pagesize><acquisition_seconds>343</acquisition_seconds><volume offset="16384"><partition_offset>16384</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>1986528</block_count><first_block>0</first_block><last_block>1986527</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-01-12T21:46:32Z</mtime><atime>2008-01-12T08:00:00Z</atime><crtime>2008-01-12T21:46:32Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="278528" len="16384" img_offset="294912"></byte_run>
      </byte_runs><hashdigest type="md5">7165d1f0186c008925a3fe9f33f9188f</hashdigest><hashdigest type="sha1">aad6a32ae535818928107b68704b8362c2b8bd10</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000002</filename><partition>1</partition><id>2</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-01-12T21:46:32Z</mtime><atime>2008-01-12T08:00:00Z</atime><crtime>2008-01-12T21:46:32Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="278528" len="16384" img_offset="294912"></byte_run>
      </byte_runs><hashdigest type="md5">7165d1f0186c008925a3fe9f33f9188f</hashdigest><hashdigest type="sha1">aad6a32ae535818928107b68704b8362c2b8bd10</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000003</filename><partition>1</partition><id>3</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="262144" len="16384" img_offset="278528"></byte_run>
      </byte_runs><hashdigest type="md5">3571f12c1da9a54ac7ebe4b3a844f8f5</hashdigest><hashdigest type="sha1">c46f210a0c1250371f6c7d9d6b7e1835130077ba</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-01-12T21:46:32Z</mtime><atime>2008-01-12T08:00:00Z</atime><crtime>2008-01-12T21:46:32Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="294912" len="16384" img_offset="311296"></byte_run>
      </byte_runs><hashdigest type="md5">5fd4e190d825657e6c716d819bee1c4f</hashdigest><hashdigest type="sha1">33f1079cb9a4c56656dca399652ae45a676f3df4</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000002</filename><partition>1</partition><id>5</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-01-12T21:46:32Z</mtime><atime>2008-01-12T08:00:00Z</atime><crtime>2008-01-12T21:46:32Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="294912" len="16384" img_offset="311296"></byte_run>
      </byte_runs><hashdigest type="md5">5fd4e190d825657e6c716d819bee1c4f</hashdigest><hashdigest type="sha1">33f1079cb9a4c56656dca399652ae45a676f3df4</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000003</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-01-12T21:46:32Z</mtime><atime>2008-01-12T08:00:00Z</atime><crtime>2008-01-12T21:46:32Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="278528" len="16384" img_offset="294912"></byte_run>
      </byte_runs><hashdigest type="md5">7165d1f0186c008925a3fe9f33f9188f</hashdigest><hashdigest type="sha1">aad6a32ae535818928107b68704b8362c2b8bd10</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000005.JPG</filename><partition>1</partition><id>7</id><name_type>r</name_type><filesize>2510762</filesize><alloc>1</alloc><used>1</used><inode>1029</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-01-12T21:46:32Z</mtime><atime>2008-01-12T08:00:00Z</atime><crtime>2008-01-12T21:46:32Z</crtime><libmagic>JPEG image data, EXIF standard 2.21</libmagic><byte_runs><byte_run file_offset="0" fs_offset="311296" len="2510762" img_offset="327680"></byte_run>
      </byte_runs><hashdigest type="md5">af34a92da411ef356d4daf76d455740e</hashdigest><hashdigest type="sha1">f32951421e1ab2b616235a8b12dd6a6e2c7cccab</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000006.JPG</filename><partition>1</partition><id>8</id><name_type>r</name_type><filesize>2327991</filesize><alloc>1</alloc><used>1</used><inode>1030</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-01-12T21:47:50Z</mtime><atime>2008-01-12T08:00:00Z</atime><crtime>2008-01-12T21:47:50Z</crtime><libmagic>JPEG image data, EXIF standard 2.21</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2834432" len="2327991" img_offset="2850816"></byte_run>
      </byte_runs><hashdigest type="md5">881a8899c5000a0f2e0fdc332160943e</hashdigest><hashdigest type="sha1">45481b98bb2df4909dc58cf4f5ec797c960c365c</hashdigest>
    </fileobject><fileobject><filename>P0000007</filename><partition>1</partition><id>9</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>31776259</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x3c, OEM-ID "        ", sectors/cluster 32, root entries 512, Media descriptor 0xf8, sectors/FAT 243, heads 128, hidden sectors 32, sectors 1986528 (volumes > 32 MB) </libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="16384"></byte_run>
      </byte_runs><hashdigest type="md5">43905be4974f0afc4587ba535a13e60a</hashdigest><hashdigest type="sha1">3330deea9af8733e85bd9181f3f143e39ae67155</hashdigest>
    </fileobject><fileobject><filename>P0000008</filename><partition>1</partition><id>10</id><name_type>v</name_type><filesize>124416</filesize><alloc>1</alloc><used>1</used><inode>31776260</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="13312" len="124416" img_offset="29696"></byte_run>
      </byte_runs><hashdigest type="md5">32bf69c4218d53d6d31ab8f4552943d1</hashdigest><hashdigest type="sha1">cf2fd4c35e5322f1135ec8a24437d7295a2e42b8</hashdigest>
    </fileobject><fileobject><filename>P0000009</filename><partition>1</partition><id>11</id><name_type>v</name_type><filesize>124416</filesize><alloc>1</alloc><used>1</used><inode>31776261</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="137728" len="124416" img_offset="154112"></byte_run>
      </byte_runs><hashdigest type="md5">32bf69c4218d53d6d31ab8f4552943d1</hashdigest><hashdigest type="sha1">cf2fd4c35e5322f1135ec8a24437d7295a2e42b8</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>12</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>31776262</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/^^^6^eV^.9^x</filename><partition>1</partition><id>13</id><name_type>-</name_type><filesize>17317888</filesize><unalloc>1</unalloc><used>1</used><inode>4430771</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2036-02-02T08:08:02Z</mtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="8896512" len="17317888" img_offset="8912896"></byte_run>
      </byte_runs><hashdigest type="md5">70f5d261cdeb6da060ee5a6eb0e35390</hashdigest><hashdigest type="sha1">69ecf076ece5899f80af87118cac9b3005651d88</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/^h4^g^^^.^4^</filename><partition>1</partition><id>14</id><name_type>-</name_type><filesize>899876450</filesize><unalloc>1</unalloc><used>1</used><inode>13093107</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><atime>1993-09-26T07:00:00Z</atime><crtime>1996-01-26T06:59:34Z</crtime><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>19</user_seconds><system_seconds>2</system_seconds><maxrss>0</maxrss><reclaims>287970</reclaims><faults>0</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:17:13 2012</stop_time>
  </runstats></dfxml>