<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-0-24.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn27-62.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn27-62.aff</command_line><start_time>2012-03-04T23:04:17Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn27-62.aff</image_filename>
  </source><sectorsize>512</sectorsize><pagesize>16777216</pagesize><acquisition_seconds>97</acquisition_seconds><volume offset="123392"><partition_offset>123392</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>967439</block_count><first_block>0</first_block><last_block>967438</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="138752" len="16384" img_offset="262144"></byte_run>
      </byte_runs><hashdigest type="md5">1f68f0a6ee5a003bf4ad54582abb9000</hashdigest><hashdigest type="sha1">09eff09158a6108ddf7136913a8262b4f8cee76c</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000002</filename><partition>1</partition><id>2</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="138752" len="16384" img_offset="262144"></byte_run>
      </byte_runs><hashdigest type="md5">1f68f0a6ee5a003bf4ad54582abb9000</hashdigest><hashdigest type="sha1">09eff09158a6108ddf7136913a8262b4f8cee76c</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000003</filename><partition>1</partition><id>3</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="122368" len="16384" img_offset="245760"></byte_run>
      </byte_runs><hashdigest type="md5">e72464d3296eeaad561e0335c20beca6</hashdigest><hashdigest type="sha1">ece92339ca0e49f12f1cc52f4b0f21e286e0528f</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="171520" len="16384" img_offset="294912"></byte_run>
      </byte_runs><hashdigest type="md5">ae505112b78d3691089e39026356041b</hashdigest><hashdigest type="sha1">ac167a38054de18cda754fecf53b17ac755b2938</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000002</filename><partition>1</partition><id>5</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>517</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="171520" len="16384" img_offset="294912"></byte_run>
      </byte_runs><hashdigest type="md5">ae505112b78d3691089e39026356041b</hashdigest><hashdigest type="sha1">ac167a38054de18cda754fecf53b17ac755b2938</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000003</filename><partition>1</partition><id>6</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="138752" len="16384" img_offset="262144"></byte_run>
      </byte_runs><hashdigest type="md5">1f68f0a6ee5a003bf4ad54582abb9000</hashdigest><hashdigest type="sha1">09eff09158a6108ddf7136913a8262b4f8cee76c</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000005</filename><partition>1</partition><id>7</id><name_type>r</name_type><filesize>256</filesize><alloc>1</alloc><used>1</used><inode>1541</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>ps database version 1 from kernel \\001</libmagic><byte_runs><byte_run file_offset="0" fs_offset="220672" len="256" img_offset="344064"></byte_run>
      </byte_runs><hashdigest type="md5">d9a57b28a04b6477c264de24129793ba</hashdigest><hashdigest type="sha1">d73b7b5bcfa749a74fe3149be3585ac45eb35d20</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000004/P0000006</filename><partition>1</partition><id>8</id><name_type>r</name_type><filesize>40</filesize><alloc>1</alloc><used>1</used><inode>1542</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>ps database version 2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="237056" len="40" img_offset="360448"></byte_run>
      </byte_runs><hashdigest type="md5">33189d8ad909357ef530bd54b9f2c602</hashdigest><hashdigest type="sha1">d5429a0073dce7ded0493c45f4857b310791a0c4</hashdigest>
    </fileobject><fileobject><filename>P0000007</filename><partition>1</partition><id>9</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="155136" len="16384" img_offset="278528"></byte_run>
      </byte_runs><hashdigest type="md5">091137ff1ac8f3b36aee0fed5f8a1e85</hashdigest><hashdigest type="sha1">dd31f207f6dc81771886e411e07afb1ba875018d</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000002</filename><partition>1</partition><id>10</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="155136" len="16384" img_offset="278528"></byte_run>
      </byte_runs><hashdigest type="md5">091137ff1ac8f3b36aee0fed5f8a1e85</hashdigest><hashdigest type="sha1">dd31f207f6dc81771886e411e07afb1ba875018d</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000003</filename><partition>1</partition><id>11</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="122368" len="16384" img_offset="245760"></byte_run>
      </byte_runs><hashdigest type="md5">e72464d3296eeaad561e0335c20beca6</hashdigest><hashdigest type="sha1">ece92339ca0e49f12f1cc52f4b0f21e286e0528f</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008</filename><partition>1</partition><id>12</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>1029</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-07T00:34:20Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-07T00:34:20Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="253440" len="16384" img_offset="376832"></byte_run>
      </byte_runs><hashdigest type="md5">29c25d758dafa6e36a60941d6ae44860</hashdigest><hashdigest type="sha1">25ab6d9070c476f4a2e43fd7784a4ad289d0f67a</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008/P0000002</filename><partition>1</partition><id>13</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>1029</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-07T00:34:20Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-07T00:34:20Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="253440" len="16384" img_offset="376832"></byte_run>
      </byte_runs><hashdigest type="md5">29c25d758dafa6e36a60941d6ae44860</hashdigest><hashdigest type="sha1">25ab6d9070c476f4a2e43fd7784a4ad289d0f67a</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008/P0000003</filename><partition>1</partition><id>14</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="155136" len="16384" img_offset="278528"></byte_run>
      </byte_runs><hashdigest type="md5">091137ff1ac8f3b36aee0fed5f8a1e85</hashdigest><hashdigest type="sha1">dd31f207f6dc81771886e411e07afb1ba875018d</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008/P0000009.JPG</filename><partition>1</partition><id>15</id><name_type>r</name_type><filesize>645735</filesize><unalloc>1</unalloc><used>1</used><inode>4101</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-21T22:08:16Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-21T22:08:14Z</crtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="269824" len="645735" img_offset="393216"></byte_run>
      </byte_runs><hashdigest type="md5">d04c45215ecc80173d42cd86f1592bc7</hashdigest><hashdigest type="sha1">50ce8e51bdaed67e16dd51ca7193d730cdb62148</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008/P0000010.JPG</filename><partition>1</partition><id>16</id><name_type>r</name_type><filesize>638864</filesize><unalloc>1</unalloc><used>1</used><inode>4102</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-21T22:31:42Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-21T22:31:42Z</crtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="925184" len="638864" img_offset="1048576"></byte_run>
      </byte_runs><hashdigest type="md5">45a247d548462563bc8c0169f1f9b305</hashdigest><hashdigest type="sha1">66654dc685e3e6f229081eb56baefbf207157741</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008/P0000011.JPG</filename><partition>1</partition><id>17</id><name_type>r</name_type><filesize>611621</filesize><unalloc>1</unalloc><used>1</used><inode>4103</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-20T00:28:40Z</mtime><atime>2008-02-20T08:00:00Z</atime><crtime>2008-02-20T00:28:38Z</crtime><libmagic>Sendmail frozen configuration  - version \\226;\\233"P\\015\\315wr\\304b\\252\\253sA\\251\\336{d\\216-</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1547776" len="611621" img_offset="1671168"></byte_run>
      </byte_runs><hashdigest type="md5">1039cab29466528bfe78121e2be03236</hashdigest><hashdigest type="sha1">a33e4cb49a42061adf7e8bd786588f554a210d8f</hashdigest>
    </fileobject><fileobject><filename>P0000007/P0000008/P0000012.JPG</filename><partition>1</partition><id>18</id><name_type>r</name_type><filesize>598948</filesize><unalloc>1</unalloc><used>1</used><inode>4104</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-20T00:28:44Z</mtime><atime>2008-02-20T08:00:00Z</atime><crtime>2008-02-20T00:28:44Z</crtime><libmagic>JPEG image data, EXIF standard 2.2</libmagic><byte_runs><byte_run file_offset="0" fs_offset="2170368" len="598948" img_offset="2293760"></byte_run>
      </byte_runs><hashdigest type="md5">750290842241a351237918486440d5db</hashdigest><hashdigest type="sha1">9837014186fd6952dc4af6b9bbe06027fef89ce6</hashdigest>
    </fileobject><fileobject><filename>P0000013</filename><partition>1</partition><id>19</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-01T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="187904" len="16384" img_offset="311296"></byte_run>
      </byte_runs><hashdigest type="md5">f9cefad013289fb153414a016de6cefc</hashdigest><hashdigest type="sha1">a030563878b18de1e968a9a32538c81b5de4de79</hashdigest>
    </fileobject><fileobject><filename>P0000013/P0000002</filename><partition>1</partition><id>20</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-01T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="187904" len="16384" img_offset="311296"></byte_run>
      </byte_runs><hashdigest type="md5">f9cefad013289fb153414a016de6cefc</hashdigest><hashdigest type="sha1">a030563878b18de1e968a9a32538c81b5de4de79</hashdigest>
    </fileobject><fileobject><filename>P0000013/P0000003</filename><partition>1</partition><id>21</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="122368" len="16384" img_offset="245760"></byte_run>
      </byte_runs><hashdigest type="md5">e72464d3296eeaad561e0335c20beca6</hashdigest><hashdigest type="sha1">ece92339ca0e49f12f1cc52f4b0f21e286e0528f</hashdigest>
    </fileobject><fileobject><filename>P0000013/P0000014.MRK</filename><partition>1</partition><id>22</id><name_type>r</name_type><filesize>90</filesize><alloc>1</alloc><used>1</used><inode>2053</inode><meta_type>1</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-02T06:04:46Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-02T06:04:46Z</crtime><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="204288" len="90" img_offset="327680"></byte_run>
      </byte_runs><hashdigest type="md5">ba9518a3b1803df06e89ccd7274f2872</hashdigest><hashdigest type="sha1">1ee074c32ad810e5ddabe70bf0b7f1230bd7e278</hashdigest>
    </fileobject><fileobject><filename>P0000013/P0000015.TMP</filename><partition>1</partition><id>23</id><name_type>r</name_type><filesize>0</filesize><unalloc>1</unalloc><used>1</used><inode>2054</inode><meta_type>1</meta_type><mode>511</mode><nlink>0</nlink><uid>0</uid><gid>0</gid><mtime>2008-02-21T22:32:28Z</mtime><atime>2008-02-21T08:00:00Z</atime><crtime>2008-02-21T22:32:28Z</crtime><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>P0000016</filename><partition>1</partition><id>24</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>15475203</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="123392"></byte_run>
      </byte_runs><hashdigest type="md5">1ca3e0813fc1899ea80a38514f709956</hashdigest><hashdigest type="sha1">137f947a8844e07664ddaf13cd3a3dc07c44be05</hashdigest>
    </fileobject><fileobject><filename>P0000017</filename><partition>1</partition><id>25</id><name_type>v</name_type><filesize>60928</filesize><alloc>1</alloc><used>1</used><inode>15475204</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="512" len="60928" img_offset="123904"></byte_run>
      </byte_runs><hashdigest type="md5">261f3827a09668ef36ff25e98ab12c93</hashdigest><hashdigest type="sha1">13481d70702805a4e5130f7c19a0e2a1fd6ab140</hashdigest>
    </fileobject><fileobject><filename>P0000018</filename><partition>1</partition><id>26</id><name_type>v</name_type><filesize>60928</filesize><alloc>1</alloc><used>1</used><inode>15475205</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="61440" len="60928" img_offset="184832"></byte_run>
      </byte_runs><hashdigest type="md5">261f3827a09668ef36ff25e98ab12c93</hashdigest><hashdigest type="sha1">13481d70702805a4e5130f7c19a0e2a1fd6ab140</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>27</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>15475206</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>2</user_seconds><system_seconds>0</system_seconds><maxrss>0</maxrss><reclaims>126729</reclaims><faults>0</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sun Mar  4 15:35:39 2012</stop_time>
  </runstats></dfxml>