<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-3.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn27-35.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn27-35.aff</command_line><start_time>2012-03-04T23:31:46Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn27-35.aff</image_filename>
  </source><device_sn>0</device_sn><sectorsize>512</sectorsize><pagesize>16777216</pagesize><acquisition_seconds>236</acquisition_seconds><volume offset="127488"><partition_offset>127488</partition_offset><block_size>512</block_size><ftype>8</ftype><ftype_str>fat32</ftype_str><block_count>1983751</block_count><first_block>0</first_block><last_block>1983750</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>r</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-03-16T17:49:32Z</mtime><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>P0000002.inf</filename><partition>1</partition><id>2</id><name_type>r</name_type><filesize>110</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>1</meta_type><mode>73</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-03-16T17:49:32Z</mtime><atime>2008-03-16T07:00:00Z</atime><crtime>2008-03-16T17:49:30Z</crtime><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2002944" len="110" img_offset="2130432"></byte_run>
      </byte_runs><hashdigest type="md5">f4a5bd8f4468a1b8de7f02e070c987a2</hashdigest><hashdigest type="sha1">ed7745eb9e85a3eb9039cb0c20504e3a2e363596</hashdigest>
    </fileobject><fileobject><filename>P0000003</filename><partition>1</partition><id>3</id><name_type>r</name_type><filesize>10000</filesize><alloc>1</alloc><used>1</used><inode>6</inode><meta_type>1</meta_type><mode>73</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-03-16T17:49:32Z</mtime><atime>2008-03-16T07:00:00Z</atime><crtime>2008-03-16T17:49:31Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2007040" len="10000" img_offset="2134528"></byte_run>
      </byte_runs><hashdigest type="md5">57b1c200f2637afe69d5afb3109d1897</hashdigest><hashdigest type="sha1">0d624c9491d106d94cb92d127fdf53062d0382fb</hashdigest>
    </fileobject><fileobject><filename>P0000004</filename><partition>1</partition><id>4</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>31677555</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x58, OEM-ID "MSDOS5.0", sectors/cluster 8, reserved sectors 36, Media descriptor 0xf8, heads 255, hidden sectors 249, sectors 1983751 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 1934, serial number 0xb85adf71, unlabeled</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="127488"></byte_run>
      </byte_runs><hashdigest type="md5">58917ac70e994f6485cba094c2c499ca</hashdigest><hashdigest type="sha1">a760b6c88895d30b869a46615bf6fbd561da6e18</hashdigest>
    </fileobject><fileobject><filename>P0000005</filename><partition>1</partition><id>5</id><name_type>v</name_type><filesize>990208</filesize><alloc>1</alloc><used>1</used><inode>31677556</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="18432" len="990208" img_offset="145920"></byte_run>
      </byte_runs><hashdigest type="md5">c679f25fa1673f06e753acc728b3303a</hashdigest><hashdigest type="sha1">ab774edb05cbc46e561107b60c27ef9cfe9e4f21</hashdigest>
    </fileobject><fileobject><filename>P0000006</filename><partition>1</partition><id>6</id><name_type>v</name_type><filesize>990208</filesize><alloc>1</alloc><used>1</used><inode>31677557</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1008640" len="990208" img_offset="1136128"></byte_run>
      </byte_runs><hashdigest type="md5">c679f25fa1673f06e753acc728b3303a</hashdigest><hashdigest type="sha1">ab774edb05cbc46e561107b60c27ef9cfe9e4f21</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>7</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>31677558</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>6</user_seconds><system_seconds>1</system_seconds><maxrss>0</maxrss><reclaims>201985</reclaims><faults>25</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sun Mar  4 15:38:38 2012</stop_time>
  </runstats></dfxml>