<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-25.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn31-53.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn31-53.aff</command_line><start_time>2012-03-04T04:15:20Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn31-53.aff</image_filename>
  </source><sectorsize>512</sectorsize><pagesize>16777216</pagesize><acquisition_seconds>171</acquisition_seconds><volume offset="27136"><partition_offset>27136</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>1023051</block_count><first_block>0</first_block><last_block>1023050</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="136704" len="16384" img_offset="163840"></byte_run>
      </byte_runs><hashdigest type="md5">a81d81fed3a677b31eebc5fd5b60a374</hashdigest><hashdigest type="sha1">a94fbe0a58eb6dc29e750916e71d710d6edea364</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000002</filename><partition>1</partition><id>2</id><name_type>d</name_type><filesize>16384</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>2</meta_type><mode>511</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="136704" len="16384" img_offset="163840"></byte_run>
      </byte_runs><hashdigest type="md5">a81d81fed3a677b31eebc5fd5b60a374</hashdigest><hashdigest type="sha1">a94fbe0a58eb6dc29e750916e71d710d6edea364</hashdigest>
    </fileobject><fileobject><filename>P0000001/P0000003</filename><partition>1</partition><id>3</id><name_type>d</name_type><filesize>8192</filesize><alloc>1</alloc><used>1</used><inode>2</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="128512" len="8192" img_offset="155648"></byte_run>
      </byte_runs><hashdigest type="md5">6c0ad6f393e0845114a7ffc570bd887c</hashdigest><hashdigest type="sha1">0e1f365cd46ea7f6d9b52d1b277d506f1e163b95</hashdigest>
    </fileobject><fileobject><filename>P0000004</filename><partition>1</partition><id>4</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>16364803</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="27136"></byte_run>
      </byte_runs><hashdigest type="md5">4e1f40dad13f21d247201ece7aa88a0b</hashdigest><hashdigest type="sha1">bd6cf924da4b3d2e8d381300a708d906d072ead2</hashdigest>
    </fileobject><fileobject><filename>P0000005</filename><partition>1</partition><id>5</id><name_type>v</name_type><filesize>64000</filesize><alloc>1</alloc><used>1</used><inode>16364804</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="512" len="64000" img_offset="27648"></byte_run>
      </byte_runs><hashdigest type="md5">dbf0e9b04be16007b634f817cee87e31</hashdigest><hashdigest type="sha1">a185eb55730d1ca455073824781f119746b5d6cf</hashdigest>
    </fileobject><fileobject><filename>P0000006</filename><partition>1</partition><id>6</id><name_type>v</name_type><filesize>64000</filesize><alloc>1</alloc><used>1</used><inode>16364805</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="64512" len="64000" img_offset="91648"></byte_run>
      </byte_runs><hashdigest type="md5">dbf0e9b04be16007b634f817cee87e31</hashdigest><hashdigest type="sha1">a185eb55730d1ca455073824781f119746b5d6cf</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>7</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>16364806</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>2</user_seconds><system_seconds>0</system_seconds><maxrss>0</maxrss><reclaims>132967</reclaims><faults>0</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:15:24 2012</stop_time>
  </runstats></dfxml>