<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-19.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn19-12.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn19-12.aff</command_line><start_time>2012-03-04T23:24:56Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn19-12.aff</image_filename>
  </source><sectorsize>512</sectorsize><pagesize>16777216</pagesize><acquisition_seconds>136</acquisition_seconds><volume offset="121344"><partition_offset>121344</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>984851</block_count><first_block>0</first_block><last_block>984850</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>r</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2006-02-01T08:00:00Z</mtime><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>P0000002</filename><partition>1</partition><id>2</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2006-06-13T01:01:48Z</mtime><atime>2006-06-12T07:00:00Z</atime><crtime>2006-06-13T01:01:48Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="140800" len="16384" img_offset="262144"></byte_run>
      </byte_runs><hashdigest type="md5">1e398e0a67dc0ab99fbaf86c492db19b</hashdigest><hashdigest type="sha1">bad22788a061123fedcea897ce7e8dc8f6c412d3</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000003</filename><partition>1</partition><id>3</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2006-06-13T01:01:48Z</mtime><atime>2006-06-12T07:00:00Z</atime><crtime>2006-06-13T01:01:48Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="140800" len="16384" img_offset="262144"></byte_run>
      </byte_runs><hashdigest type="md5">1e398e0a67dc0ab99fbaf86c492db19b</hashdigest><hashdigest type="sha1">bad22788a061123fedcea897ce7e8dc8f6c412d3</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000004</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="124416" len="16384" img_offset="245760"></byte_run>
      </byte_runs><hashdigest type="md5">069404127db1bfc9c36b453db6cdab23</hashdigest><hashdigest type="sha1">33cddad334db7fdadae18d5a22ff0def12653199</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005</filename><partition>1</partition><id>5</id><name_type>d</name_type><filesize>16384</filesize><unalloc>1</unalloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-04-13T21:05:44Z</mtime><atime>2008-04-13T07:00:00Z</atime><crtime>2008-04-13T21:05:44Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="157184" len="16384" img_offset="278528"></byte_run>
      </byte_runs><hashdigest type="md5">31cfba697da06d3901bc1eea293f8147</hashdigest><hashdigest type="sha1">2ec9bd4b661b45f12bd01614d068182038d99857</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005/P0000003</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>16384</filesize><unalloc>1</unalloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-04-13T21:05:44Z</mtime><atime>2008-04-13T07:00:00Z</atime><crtime>2008-04-13T21:05:44Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="157184" len="16384" img_offset="278528"></byte_run>
      </byte_runs><hashdigest type="md5">31cfba697da06d3901bc1eea293f8147</hashdigest><hashdigest type="sha1">2ec9bd4b661b45f12bd01614d068182038d99857</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005/P0000004</filename><partition>1</partition><id>7</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2006-06-13T01:01:48Z</mtime><atime>2006-06-12T07:00:00Z</atime><crtime>2006-06-13T01:01:48Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="140800" len="16384" img_offset="262144"></byte_run>
      </byte_runs><hashdigest type="md5">1e398e0a67dc0ab99fbaf86c492db19b</hashdigest><hashdigest type="sha1">bad22788a061123fedcea897ce7e8dc8f6c412d3</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005/P0000006.JPG</filename><partition>1</partition><id>8</id><name_type>r</name_type><filesize>1336165</filesize><unalloc>1</unalloc><used>1</used><inode>1029</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-04-13T21:05:44Z</mtime><atime>2008-04-13T07:00:00Z</atime><crtime>2008-04-13T21:05:44Z</crtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="173568" len="1336165" img_offset="294912"></byte_run>
      </byte_runs><hashdigest type="md5">56222c566d49c8288d7f2a3a5c992a50</hashdigest><hashdigest type="sha1">0d9edaddbbe28bc5372f147d768650e30f8549b7</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005</filename><partition>1</partition><id>9</id><name_type>d</name_type><filesize>16384</filesize><unalloc>1</unalloc><used>1</used><inode>518</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2006-10-05T03:11:46Z</mtime><atime>2006-10-04T07:00:00Z</atime><crtime>2006-10-05T03:11:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="632320" len="16384" img_offset="753664"></byte_run>
      </byte_runs><hashdigest type="md5">2f1b071026806488f4b57877a24fd373</hashdigest><hashdigest type="sha1">fd5c47279a563ef35c5747c742bba2153b96f0f2</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005</filename><partition>1</partition><id>10</id><name_type>d</name_type><filesize>16384</filesize><unalloc>1</unalloc><used>1</used><inode>519</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2006-10-05T03:12:38Z</mtime><atime>2006-10-04T07:00:00Z</atime><crtime>2006-10-05T03:12:38Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1385984" len="16384" img_offset="1507328"></byte_run>
      </byte_runs><hashdigest type="md5">364d1f6c594f6ec1129fab1e2ffa84b2</hashdigest><hashdigest type="sha1">94cc6e57707337be666ceddca9ee52c2a6f19638</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005</filename><partition>1</partition><id>11</id><name_type>d</name_type><filesize>16384</filesize><unalloc>1</unalloc><used>1</used><inode>520</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2006-10-05T03:13:32Z</mtime><atime>2006-10-04T07:00:00Z</atime><crtime>2006-10-05T03:13:32Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1795584" len="16384" img_offset="1916928"></byte_run>
      </byte_runs><hashdigest type="md5">9f52e96b5dc8e038b2770daaa9944ade</hashdigest><hashdigest type="sha1">c30dd5d27f7cf8386457c2a870822a0d9eded46f</hashdigest>
    </fileobject><fileobject><filename>P0000002/P0000005</filename><partition>1</partition><id>12</id><name_type>d</name_type><filesize>16384</filesize><unalloc>1</unalloc><used>1</used><inode>521</inode><meta_type>2</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2006-10-05T03:14:14Z</mtime><atime>2006-10-15T07:00:00Z</atime><crtime>2006-10-05T03:14:14Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2385408" len="16384" img_offset="2506752"></byte_run>
      </byte_runs><hashdigest type="md5">14386be62df8c52f0a79e2dca0c2e329</hashdigest><hashdigest type="sha1">d1cf109ba1985975577d2de02421e146682ea1dc</hashdigest>
    </fileobject><fileobject><filename>P0000007</filename><partition>1</partition><id>13</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2006-06-13T06:55:36Z</mtime><atime>2006-06-12T07:00:00Z</atime><crtime>2006-06-13T06:55:36Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2237952" len="16384" img_offset="2359296"></byte_run>
      </byte_runs><hashdigest type="md5">af5c6754144f7f8a3dfcbebf62bdf996</hashdigest><hashdigest type="sha1">5c73771158fcc599e731f389103753b033c8d593</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000003</filename><partition>1</partition><id>14</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2006-06-13T06:55:36Z</mtime><atime>2006-06-12T07:00:00Z</atime><crtime>2006-06-13T06:55:36Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2237952" len="16384" img_offset="2359296"></byte_run>
      </byte_runs><hashdigest type="md5">af5c6754144f7f8a3dfcbebf62bdf996</hashdigest><hashdigest type="sha1">5c73771158fcc599e731f389103753b033c8d593</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000004</filename><partition>1</partition><id>15</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="124416" len="16384" img_offset="245760"></byte_run>
      </byte_runs><hashdigest type="md5">069404127db1bfc9c36b453db6cdab23</hashdigest><hashdigest type="sha1">33cddad334db7fdadae18d5a22ff0def12653199</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008.MRK</filename><partition>1</partition><id>16</id><name_type>r</name_type><filesize>184</filesize><unalloc>1</unalloc><used>1</used><inode>66053</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2006-06-15T07:37:44Z</mtime><atime>2006-06-15T07:00:00Z</atime><crtime>2006-06-15T07:37:44Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="78980608" len="184" img_offset="79101952"></byte_run>
      </byte_runs><hashdigest type="md5">7405f335d3be325aea6eb1f7c5d1b8bc</hashdigest><hashdigest type="sha1">b6bf2a829627975a782a328f3a69d20052435e0d</hashdigest>
    </fileobject><fileobject><filename>P0000009</filename><partition>1</partition><id>17</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>15753731</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x3c, OEM-ID "MSDOS5.0", sectors/cluster 32, root entries 512, Media descriptor 0xf8, sectors/FAT 121, heads 16, hidden sectors 237, sectors 984851 (volumes > 32 MB) , serial number 0xff30b659, label: "Kingston   ", FAT (16 bit)</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="121344"></byte_run>
      </byte_runs><hashdigest type="md5">4d74d88178b7e76ab8b860fe7a248943</hashdigest><hashdigest type="sha1">c9b3ad7f91f9d74d7c58addf41e17c54bde2924f</hashdigest>
    </fileobject><fileobject><filename>P0000010</filename><partition>1</partition><id>18</id><name_type>v</name_type><filesize>61952</filesize><alloc>1</alloc><used>1</used><inode>15753732</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="512" len="61952" img_offset="121856"></byte_run>
      </byte_runs><hashdigest type="md5">7e2a801c62ae530d07aba0908cdedebc</hashdigest><hashdigest type="sha1">256922d23ecf1076032346001cc64d6b7fe0138e</hashdigest>
    </fileobject><fileobject><filename>P0000011</filename><partition>1</partition><id>19</id><name_type>v</name_type><filesize>61952</filesize><alloc>1</alloc><used>1</used><inode>15753733</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="62464" len="61952" img_offset="183808"></byte_run>
      </byte_runs><hashdigest type="md5">7e2a801c62ae530d07aba0908cdedebc</hashdigest><hashdigest type="sha1">256922d23ecf1076032346001cc64d6b7fe0138e</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>20</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>15753734</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>15</user_seconds><system_seconds>3</system_seconds><maxrss>0</maxrss><reclaims>353414</reclaims><faults>1</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sun Mar  4 15:38:14 2012</stop_time>
  </runstats></dfxml>