<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-24.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/cn/cn6-11.xml -IMf /home/slgarfin/corp/drives/nus/cn/cn6-11.aff</command_line><start_time>2012-03-04T04:23:58Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/cn/cn6-11.aff</image_filename>
  </source><device_sn>0</device_sn><pagesize>16777216</pagesize><sectorsize>512</sectorsize><acquisition_seconds>208</acquisition_seconds><volume offset="32256"><partition_offset>32256</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>2088387</block_count><first_block>0</first_block><last_block>2088386</last_block><fileobject><filename>P0000001</filename><partition>1</partition><id>1</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>33406003</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x3c, OEM-ID "MSDOS5.0", sectors/cluster 32, root entries 512, Media descriptor 0xf8, sectors/FAT 255, heads 255, hidden sectors 63, sectors 2088387 (volumes > 32 MB) , serial number 0xbcb8e45d, unlabeled, FAT (16 bit)</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">6477cc061a4313bed14a0fc5e7dbbb5a</hashdigest><hashdigest type="sha1">0448577d519dc0d9b12e470f297a02d955fa321f</hashdigest>
    </fileobject><fileobject><filename>P0000002</filename><partition>1</partition><id>2</id><name_type>v</name_type><filesize>130560</filesize><alloc>1</alloc><used>1</used><inode>33406004</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="1024" len="130560" img_offset="33280"></byte_run>
      </byte_runs><hashdigest type="md5">9234c4f5129db5f4d3a8c3ffcfbef104</hashdigest><hashdigest type="sha1">e60f1a7e9a3b14a3966a1173583b20f1bd6799bb</hashdigest>
    </fileobject><fileobject><filename>P0000003</filename><partition>1</partition><id>3</id><name_type>v</name_type><filesize>130560</filesize><alloc>1</alloc><used>1</used><inode>33406005</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="131584" len="130560" img_offset="163840"></byte_run>
      </byte_runs><hashdigest type="md5">9234c4f5129db5f4d3a8c3ffcfbef104</hashdigest><hashdigest type="sha1">e60f1a7e9a3b14a3966a1173583b20f1bd6799bb</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>4</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>33406006</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject><fileobject><filename>$OrphanFiles/^^^(^d01.wb^</filename><partition>1</partition><id>5</id><name_type>-</name_type><filesize>611725883</filesize><unalloc>1</unalloc><used>1</used><inode>5480051</inode><meta_type>1</meta_type><mode>219</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1998-11-13T16:38:42Z</mtime><crtime>2017-05-13T16:10:50Z</crtime><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="105103360" len="611725883" img_offset="105135616"></byte_run>
      </byte_runs><hashdigest type="md5">d51c8bab73e0d31e50dc7f14b37ff7c8</hashdigest><hashdigest type="sha1">048a35db3ea0860be19080c26723b35b9b38c5cd</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles/^^^^o{01.wb^</filename><partition>1</partition><id>6</id><name_type>-</name_type><filesize>342080169</filesize><unalloc>1</unalloc><used>1</used><inode>11003049</inode><meta_type>1</meta_type><mode>219</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><atime>1983-08-21T07:00:00Z</atime><libmagic>DOS executable (device driver)</libmagic><byte_runs><byte_run file_offset="0" fs_offset="635600896" len="342080169" img_offset="635633152"></byte_run>
      </byte_runs><hashdigest type="md5">3d531fc43c8b2a76d31256b9b2c48445</hashdigest><hashdigest type="sha1">c16bb8726d21aa774622258557f60e45ed7efd09</hashdigest>
    </fileobject>
  </volume><runstats><user_seconds>40</user_seconds><system_seconds>11</system_seconds><maxrss>0</maxrss><reclaims>540824</reclaims><faults>10</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:28:45 2012</stop_time>
  </runstats></dfxml>