<dfxml version="1.0"><metadata xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/"><dc:type>Disk Image</dc:type>
  </metadata><creator version="1.0"><program>fiwalk</program><version>0.6.16</version><build_environment><compiler>GCC 4.1</compiler><library version="3.2.3" name="tsk"></library><library version="3.6.14" name="afflib"></library><library version="20111015" name="libewf"></library>
    </build_environment><execution_environment><os_sysname>Linux</os_sysname><os_release>2.6.18-194.17.1.el5</os_release><os_version>#1 SMP Wed Sep 29 12:50:31 EDT 2010</os_version><host>compute-6-14.local</host><arch>x86_64</arch><command_line>fiwalk -X /home/slgarfin/corp/drives/nus/il/il2-0073.xml -IMf /home/slgarfin/corp/drives/nus/il/il2-0073.aff</command_line><start_time>2012-03-04T04:33:13Z</start_time>
    </execution_environment>
  </creator><source><image_filename>/home/slgarfin/corp/drives/nus/il/il2-0073.aff</image_filename>
  </source><cylinders>8912</cylinders><heads>15</heads><sectors_per_track>63</sectors_per_track><sectorsize>512</sectorsize><pagesize>16777216</pagesize><acquisition_seconds>754</acquisition_seconds><volume offset="32256"><partition_offset>32256</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>4188177</block_count><first_block>0</first_block><last_block>4188176</last_block><fileobject><filename>P0000001.SYS</filename><partition>1</partition><id>1</id><name_type>r</name_type><filesize>223148</filesize><alloc>1</alloc><used>1</used><inode>3</inode><meta_type>1</meta_type><mode>73</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1995-06-30T19:19:54Z</mtime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="279040" len="223148" img_offset="311296"></byte_run>
      </byte_runs><hashdigest type="md5">5a18167042bdf9823ef7f70ca7af805b</hashdigest><hashdigest type="sha1">22924f93dd0f9ea6a4624ccdd1bbcdf5eb43a308</hashdigest>
    </fileobject><fileobject><filename>P0000002.SYS</filename><partition>1</partition><id>2</id><name_type>r</name_type><filesize>9</filesize><alloc>1</alloc><used>1</used><inode>4</inode><meta_type>1</meta_type><mode>73</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1995-06-30T19:19:54Z</mtime><libmagic>ASCII text, with CRLF line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="508416" len="9" img_offset="540672"></byte_run>
      </byte_runs><hashdigest type="md5">734040ec3565b902d87a3ebf89bedd77</hashdigest><hashdigest type="sha1">958d342c1801ae248d3bf83dc07f17c934d37212</hashdigest>
    </fileobject><fileobject><filename>P0000003.COM</filename><partition>1</partition><id>3</id><name_type>r</name_type><filesize>92870</filesize><alloc>1</alloc><used>1</used><inode>5</inode><meta_type>1</meta_type><mode>219</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><mtime>1995-06-30T09:21:02Z</mtime><libmagic>MS-DOS executable, MZ for MS-DOS</libmagic><byte_runs><byte_run file_offset="0" fs_offset="541184" len="92870" img_offset="573440"></byte_run>
      </byte_runs><hashdigest type="md5">ea923fa01468598ff2c54c90620fd450</hashdigest><hashdigest type="sha1">67696207c3963a0dc9afab8cf37dbdb966c1f663</hashdigest>
    </fileobject><fileobject><filename>P0000004</filename><partition>1</partition><id>4</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>67002627</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x3c, OEM-ID "MSDOS7.0", sectors/cluster 64, root entries 512, Media descriptor 0xf8, sectors/FAT 256, heads 240, hidden sectors 63, sectors 4188177 (volumes > 32 MB) , serial number 0xfaa8ce59, unlabeled, FAT (16 bit)</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="32256"></byte_run>
      </byte_runs><hashdigest type="md5">aac7bc7f06048b1811e162d3cdf2b59a</hashdigest><hashdigest type="sha1">81ab5b47e8dbdf15ff1ed80e93f98c2f4a601f5f</hashdigest>
    </fileobject><fileobject><filename>P0000005</filename><partition>1</partition><id>5</id><name_type>v</name_type><filesize>131072</filesize><alloc>1</alloc><used>1</used><inode>67002628</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="512" len="131072" img_offset="32768"></byte_run>
      </byte_runs><hashdigest type="md5">9adfde7856cebe18f5c4c0aeb8d7d67d</hashdigest><hashdigest type="sha1">be46ac68109e2f36cc6a462d10ecded818480276</hashdigest>
    </fileobject><fileobject><filename>P0000006</filename><partition>1</partition><id>6</id><name_type>v</name_type><filesize>131072</filesize><alloc>1</alloc><used>1</used><inode>67002629</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>data</libmagic><byte_runs><byte_run file_offset="0" fs_offset="131584" len="131072" img_offset="163840"></byte_run>
      </byte_runs><hashdigest type="md5">9adfde7856cebe18f5c4c0aeb8d7d67d</hashdigest><hashdigest type="sha1">be46ac68109e2f36cc6a462d10ecded818480276</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>1</partition><id>7</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>67002630</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><volume offset="2144411136"><partition_offset>2144411136</partition_offset><block_size>512</block_size><ftype>4</ftype><ftype_str>fat16</ftype_str><block_count>4188177</block_count><first_block>0</first_block><last_block>4188176</last_block><fileobject><filename>P0000004</filename><partition>2</partition><id>8</id><name_type>v</name_type><filesize>512</filesize><alloc>1</alloc><used>1</used><inode>51730179</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>x86 boot sector, code offset 0x3c, OEM-ID "MSDOS7.0", sectors/cluster 64, root entries 512, Media descriptor 0xf8, sectors/FAT 256, heads 240, hidden sectors 63, sectors 4188177 (volumes > 32 MB) , serial number 0xfadfce59, unlabeled, FAT (16 bit)</libmagic><byte_runs><byte_run file_offset="0" fs_offset="0" len="512" img_offset="2144411136"></byte_run>
      </byte_runs><hashdigest type="md5">0f8bfd80050d79c3cf9c2743cc9c4ba9</hashdigest><hashdigest type="sha1">4c821fcfda941a88ee741eac94090e8490ee050f</hashdigest>
    </fileobject><fileobject><filename>P0000005</filename><partition>2</partition><id>9</id><name_type>v</name_type><filesize>131072</filesize><alloc>1</alloc><used>1</used><inode>51730180</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="512" len="131072" img_offset="2144411648"></byte_run>
      </byte_runs><hashdigest type="md5">7ae86af6db96dbaf5977629e4191abd2</hashdigest><hashdigest type="sha1">849c18808de67bd5731c0b1222a7850c62901ba3</hashdigest>
    </fileobject><fileobject><filename>P0000006</filename><partition>2</partition><id>10</id><name_type>v</name_type><filesize>131072</filesize><alloc>1</alloc><used>1</used><inode>51730181</inode><meta_type>10</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>ISO-8859 text, with no line terminators</libmagic><byte_runs><byte_run file_offset="0" fs_offset="131584" len="131072" img_offset="2144542720"></byte_run>
      </byte_runs><hashdigest type="md5">7ae86af6db96dbaf5977629e4191abd2</hashdigest><hashdigest type="sha1">849c18808de67bd5731c0b1222a7850c62901ba3</hashdigest>
    </fileobject><fileobject><filename>$OrphanFiles</filename><partition>2</partition><id>11</id><name_type>d</name_type><filesize>0</filesize><alloc>1</alloc><used>1</used><inode>51730182</inode><meta_type>2</meta_type><mode>0</mode><nlink>1</nlink><uid>0</uid><gid>0</gid><libmagic>empty</libmagic>
    </fileobject>
  </volume><runstats><user_seconds>14</user_seconds><system_seconds>0</system_seconds><maxrss>0</maxrss><reclaims>134105</reclaims><faults>81</faults><swaps>0</swaps><inputs>0</inputs><outputs>0</outputs><stop_time>Sat Mar  3 20:36:27 2012</stop_time>
  </runstats></dfxml>