DFXML-Beispiele
Diese Beispiele wurden mit IsoBuster 4.1 unter Verwendung der eingebetteten Funktionalität 'Ordnerbaum und Dateiinformationen' erstellt, die eine Liste / einen Bericht unter Verwendung des vordefinierten Layouts exportiert
Vom UDF-Dateisystem auf einer einfachen CD
Dieses spezielle Beispiel wurde von einer sehr einfachen CD, ausgehend vom UDF-Dateisystem, ausgewählt.
<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'
xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>
<metadata>
<dc:type>CD</dc:type>
</metadata>
<creator>
<program>IsoBuster</program>
<version>4.1.0.00</version>
<execution_environment>
<start_time>14/12/2017 04:38:32</start_time>
<os_version>Windows 10 (2.10.0.15063)</os_version>
<username>Peter</username>
</execution_environment>
</creator>
<source>
<device_model>HL-DT-ST DVDRAM GUE1N</device_model>
<image_filename></image_filename>
<image_size></image_size>
<sectorsize>2048</sectorsize>
<devicesectors coding='base10'>6016</devicesectors>
</source>
<volume>
<ftype_str>UDF</ftype_str>
<partition_offset>0</partition_offset>
<fileobject>
<filename>\AUTORUN.INF</filename>
<name_type>r</name_type>
<filesize>131</filesize>
<alloc>1</alloc>
<inode>267</inode>
<mtime>01/08/2003 15:32:30</mtime>
<hfs:HFStype_creator>INF File/ImgBurn</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='555008' len='131' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Install.exe</filename>
<name_type>r</name_type>
<filesize>11624920</filesize>
<alloc>1</alloc>
<inode>268</inode>
<mtime>13/12/2017 00:00:51</mtime>
<hfs:HFStype_creator>EXE File/ImgBurn</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='557056' len='11624920' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\IsoBuster.ico</filename>
<name_type>r</name_type>
<filesize>105303</filesize>
<alloc>1</alloc>
<inode>269</inode>
<mtime>16/12/2008 17:19:52</mtime>
<hfs:HFStype_creator>ICO File/ImgBurn</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='12183552' len='105303' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Online.html</filename>
<name_type>r</name_type>
<filesize>1881</filesize>
<alloc>1</alloc>
<inode>270</inode>
<mtime>22/06/2016 14:31:40</mtime>
<hfs:HFStype_creator>HTML File/ImgBurn</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='12290048' len='1881' />
</byte_runs>
</fileobject>
</volume>
<runstats>
<stop_time>14/12/2017 04:38:32</stop_time>
<clock_seconds>0</clock_seconds>
</runstats>
</dfxml>
Von einer NTFS-formatierten VHDX-Bilddatei
Dieses spezielle Beispiel wurde von einer NTFS-formatierten USB-Stick-Bilddatei aufgenommen und zeigt sowohl fragmentierte Dateien (mit mehreren Erweiterungen) als auch alternative Datenströme (ADS oder einfach "Streams"), die an die Dateien und Ordner angehängt sind.
<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'
xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>
<metadata>
<dc:type>Image File</dc:type>
</metadata>
<creator>
<program>IsoBuster</program>
<version>4.1.0.00</version>
<execution_environment>
<start_time>14/12/2017 04:40:10</start_time>
<os_version>Windows 10 (2.10.0.15063)</os_version>
<username>Peter</username>
</execution_environment>
</creator>
<source>
<device_model>Thumb drive.vhdx</device_model>
<image_filename>C:\Users\Peter\Desktop\Thumb drive.vhdx</image_filename>
<image_size>440401920</image_size>
<sectorsize>512</sectorsize>
<devicesectors coding='base10'>4194304</devicesectors>
</source>
<volume>
<ftype_str>NTFS</ftype_str>
<partition_offset>33619968</partition_offset>
<fileobject>
<filename>\$Extend</filename>
<name_type>d</name_type>
<filesize>536</filesize>
<alloc>1</alloc>
<inode>11</inode>
<mtime>14/12/2017 04:20:47</mtime>
<byte_runs>
<byte_run img_offset='737573888' len='536' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$Deleted</filename>
<name_type>d</name_type>
<filesize>32</filesize>
<alloc>1</alloc>
<inode>29</inode>
<mtime>14/12/2017 04:20:48</mtime>
<byte_runs>
<byte_run img_offset='737592320' len='32' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$ObjId</filename>
<name_type>r</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<inode>25</inode>
<mtime>14/12/2017 04:20:48</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='0' len='0' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$Quota</filename>
<name_type>r</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<inode>24</inode>
<mtime>14/12/2017 04:20:48</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='0' len='0' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$Reparse</filename>
<name_type>r</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<inode>26</inode>
<mtime>14/12/2017 04:20:48</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='0' len='0' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata</filename>
<name_type>d</name_type>
<filesize>320</filesize>
<alloc>1</alloc>
<inode>27</inode>
<mtime>14/12/2017 04:20:48</mtime>
<byte_runs>
<byte_run img_offset='737590272' len='320' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata\$Repair</filename>
<name_type>r</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<inode>28</inode>
<mtime>14/12/2017 04:20:48</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='0' len='0' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\$Extend\$RmMetadata\$Repair:$Config</filename>
<name_type>-</name_type>
<filesize>8</filesize>
<alloc>1</alloc>
<inode>28</inode>
<mtime>14/12/2017 04:20:48</mtime>
<byte_runs>
<byte_run img_offset='737591296' len='8' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata\$Txf</filename>
<name_type>d</name_type>
<filesize>32</filesize>
<alloc>1</alloc>
<inode>31</inode>
<mtime>14/12/2017 04:20:48</mtime>
<byte_runs>
<byte_run img_offset='737594368' len='32' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata\$TxfLog</filename>
<name_type>d</name_type>
<filesize>552</filesize>
<alloc>1</alloc>
<inode>30</inode>
<mtime>14/12/2017 04:20:48</mtime>
<byte_runs>
<byte_run img_offset='737593344' len='552' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata\$TxfLog\$Tops</filename>
<name_type>r</name_type>
<filesize>100</filesize>
<alloc>1</alloc>
<inode>32</inode>
<mtime>14/12/2017 04:20:48</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737595392' len='100' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\$Extend\$RmMetadata\$TxfLog\$Tops:$T</filename>
<name_type>-</name_type>
<filesize>1048576</filesize>
<alloc>1</alloc>
<inode>32</inode>
<mtime>14/12/2017 04:20:48</mtime>
<byte_runs>
<byte_run img_offset='731504640' len='1048576' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf</filename>
<name_type>r</name_type>
<filesize>65536</filesize>
<alloc>1</alloc>
<inode>33</inode>
<mtime>14/12/2017 04:34:17</mtime>
<hfs:HFStype_creator>BLF File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='732553216' len='65536' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog1</filename>
<name_type>r</name_type>
<filesize>2097152</filesize>
<alloc>1</alloc>
<inode>34</inode>
<mtime>14/12/2017 04:34:17</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='732618752' len='2097152' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog2</filename>
<name_type>r</name_type>
<filesize>2097152</filesize>
<alloc>1</alloc>
<inode>35</inode>
<mtime>14/12/2017 04:34:17</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='734715904' len='2097152' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$RECYCLE.BIN</filename>
<name_type>d</name_type>
<filesize>208</filesize>
<alloc>1</alloc>
<inode>39</inode>
<mtime>14/12/2017 04:21:45</mtime>
<byte_runs>
<byte_run img_offset='737602560' len='208' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$RECYCLE.BIN\S-1-5-21-1419736714</filename>
<name_type>d</name_type>
<filesize>552</filesize>
<alloc>1</alloc>
<inode>40</inode>
<mtime>14/12/2017 04:32:18</mtime>
<byte_runs>
<byte_run img_offset='737603584' len='552' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IIKZQZA</filename>
<name_type>r</name_type>
<filesize>74</filesize>
<alloc>1</alloc>
<inode>56</inode>
<mtime>14/12/2017 04:32:18</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737619968' len='74' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IW8ACSL</filename>
<name_type>r</name_type>
<filesize>72</filesize>
<alloc>1</alloc>
<inode>55</inode>
<mtime>14/12/2017 04:32:18</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737618944' len='72' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RIKZQZA</filename>
<name_type>d</name_type>
<filesize>32</filesize>
<alloc>1</alloc>
<inode>45</inode>
<mtime>20/11/2017 22:49:35</mtime>
<byte_runs>
<byte_run img_offset='737608704' len='32' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RW8ACSL</filename>
<name_type>d</name_type>
<filesize>32</filesize>
<alloc>1</alloc>
<inode>52</inode>
<mtime>20/11/2017 22:46:56</mtime>
<byte_runs>
<byte_run img_offset='737615872' len='32' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$RECYCLE.BIN\S-1-5-21-1419736714\desktop.ini</filename>
<name_type>r</name_type>
<filesize>129</filesize>
<alloc>1</alloc>
<inode>41</inode>
<mtime>14/12/2017 04:21:45</mtime>
<hfs:HFStype_creator>INI File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737604608' len='129' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Compressed Folder</filename>
<name_type>d</name_type>
<filesize>456</filesize>
<alloc>1</alloc>
<inode>43</inode>
<mtime>14/12/2017 04:31:48</mtime>
<byte_runs>
<byte_run img_offset='737606656' len='456' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Compressed Folder\IsoBuster.exe</filename>
<name_type>r</name_type>
<filesize>7948184</filesize>
<alloc>1</alloc>
<inode>53</inode>
<mtime>12/12/2017 23:57:56</mtime>
<hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='345038848' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='345104384' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='345169920' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='345235456' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='345300992' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='345366528' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='345432064' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='345497600' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='345563136' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='345628672' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='345694208' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='345759744' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='345825280' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='345890816' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='345956352' len='32768' />
<byte_run img_offset='0' len='32768' />
<byte_run img_offset='346021888' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='346087424' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346152960' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346218496' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='346284032' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346349568' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='346415104' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='346480640' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346546176' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346611712' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='346677248' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346742784' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346808320' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346873856' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='346939392' len='32768' />
<byte_run img_offset='0' len='32768' />
<byte_run img_offset='347004928' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='347070464' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='347136000' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='347201536' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='347267072' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='347332608' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='347398144' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='347463680' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='347529216' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='347594752' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='347660288' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='347725824' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='347791360' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='347856896' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='347922432' len='53248' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='347987968' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='348053504' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='348119040' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='348184576' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='348250112' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='348315648' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='348381184' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='348446720' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='348512256' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='348577792' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='348643328' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='348708864' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='348774400' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='348839936' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='348905472' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='348971008' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='349036544' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='349102080' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='349167616' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='349233152' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='349298688' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='349364224' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='349429760' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='349495296' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='349560832' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='349626368' len='12288' />
<byte_run img_offset='0' len='53248' />
<byte_run img_offset='349691904' len='4096' />
<byte_run img_offset='0' len='61440' />
<byte_run img_offset='349757440' len='32768' />
<byte_run img_offset='0' len='32768' />
<byte_run img_offset='349822976' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='349888512' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='349954048' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='350019584' len='32768' />
<byte_run img_offset='0' len='32768' />
<byte_run img_offset='350085120' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='350150656' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='350216192' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='350281728' len='32768' />
<byte_run img_offset='0' len='32768' />
<byte_run img_offset='350347264' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='350412800' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='350478336' len='118784' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='350609408' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='350674944' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='350740480' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='350806016' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='350871552' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='350937088' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='351002624' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='351068160' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='351133696' len='16384' />
<byte_run img_offset='0' len='49152' />
<byte_run img_offset='351199232' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='351264768' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='351330304' len='53248' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='351395840' len='57344' />
<byte_run img_offset='0' len='8192' />
<byte_run img_offset='351461376' len='53248' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='351526912' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='351592448' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='351657984' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='351723520' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='351789056' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='351854592' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='351920128' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='351985664' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='352051200' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='352116736' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='352182272' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='352247808' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='352313344' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='352378880' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='352444416' len='16384' />
<byte_run img_offset='0' len='49152' />
<byte_run img_offset='352509952' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='352575488' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='352641024' len='45056' />
<byte_run img_offset='0' len='20480' />
<byte_run img_offset='352706560' len='184320' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='352903168' len='49152' />
<byte_run img_offset='0' len='16384' />
<byte_run img_offset='33771520' len='16384' />
<byte_run img_offset='0' len='49152' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Compressed Folder\Links.zip</filename>
<name_type>r</name_type>
<filesize>3448</filesize>
<alloc>1</alloc>
<inode>49</inode>
<mtime>15/10/2014 13:57:07</mtime>
<hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='42442752' len='4096' />
<byte_run img_offset='0' len='61440' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Compressed Folder\logo.eps</filename>
<name_type>r</name_type>
<filesize>294221</filesize>
<alloc>1</alloc>
<inode>47</inode>
<mtime>08/08/2003 21:22:42</mtime>
<hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='42250240' len='28672' />
<byte_run img_offset='0' len='36864' />
<byte_run img_offset='42315776' len='40960' />
<byte_run img_offset='0' len='24576' />
<byte_run img_offset='42381312' len='61440' />
<byte_run img_offset='0' len='4096' />
<byte_run img_offset='42446848' len='53248' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='737308672' len='16384' />
<byte_run img_offset='0' len='49152' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Compressed Folder\logo.eps:AFP_AfpInfo</filename>
<name_type>-</name_type>
<filesize>60</filesize>
<alloc>1</alloc>
<inode>47</inode>
<mtime>08/08/2003 21:22:42</mtime>
<byte_runs>
<byte_run img_offset='737610752' len='60' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Compressed Folder\logo.eps:AFP_Resource</filename>
<name_type>-</name_type>
<filesize>197056</filesize>
<alloc>1</alloc>
<inode>47</inode>
<mtime>08/08/2003 21:22:42</mtime>
<byte_runs>
<byte_run img_offset='42577920' len='24576' />
<byte_run img_offset='0' len='40960' />
<byte_run img_offset='42643456' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='42708992' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='42774528' len='4096' />
<byte_run img_offset='0' len='61440' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Compressed Folder\Video.mp4</filename>
<name_type>r</name_type>
<filesize>151132575</filesize>
<alloc>1</alloc>
<inode>48</inode>
<mtime>16/04/2014 10:33:57</mtime>
<hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='42778624' len='12288' />
<byte_run img_offset='0' len='53248' />
<byte_run img_offset='42844160' len='12288' />
<byte_run img_offset='0' len='53248' />
<byte_run img_offset='42909696' len='12288' />
<byte_run img_offset='0' len='53248' />
<byte_run img_offset='42975232' len='20480' />
<byte_run img_offset='0' len='45056' />
<byte_run img_offset='43040768' len='53248' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='43106304' len='53248' />
<byte_run img_offset='0' len='12288' />
<byte_run img_offset='43171840' len='32768' />
<byte_run img_offset='0' len='32768' />
<byte_run img_offset='43237376' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='43302912' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='43368448' len='36864' />
<byte_run img_offset='0' len='28672' />
<byte_run img_offset='43433984' len='150470656' />
<byte_run img_offset='42356736' len='8192' />
<byte_run img_offset='0' len='57344' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Folder</filename>
<name_type>d</name_type>
<filesize>456</filesize>
<alloc>1</alloc>
<inode>44</inode>
<mtime>14/12/2017 04:31:52</mtime>
<byte_runs>
<byte_run img_offset='737607680' len='456' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Folder\IsoBuster.exe</filename>
<name_type>r</name_type>
<filesize>7948184</filesize>
<alloc>1</alloc>
<inode>54</inode>
<mtime>12/12/2017 23:57:56</mtime>
<hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='353034240' len='7948184' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Folder\Links.zip</filename>
<name_type>r</name_type>
<filesize>3448</filesize>
<alloc>1</alloc>
<inode>50</inode>
<mtime>15/10/2014 13:57:07</mtime>
<hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='43094016' len='3448' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Folder\logo.eps</filename>
<name_type>r</name_type>
<filesize>294221</filesize>
<alloc>1</alloc>
<inode>46</inode>
<mtime>08/08/2003 21:22:42</mtime>
<hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='41754624' len='294221' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Folder\logo.eps:AFP_AfpInfo</filename>
<name_type>-</name_type>
<filesize>60</filesize>
<alloc>1</alloc>
<inode>46</inode>
<mtime>08/08/2003 21:22:42</mtime>
<byte_runs>
<byte_run img_offset='737609728' len='60' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Folder\logo.eps:AFP_Resource</filename>
<name_type>-</name_type>
<filesize>197056</filesize>
<alloc>1</alloc>
<inode>46</inode>
<mtime>08/08/2003 21:22:42</mtime>
<byte_runs>
<byte_run img_offset='42049536' len='197056' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Folder\Video.mp4</filename>
<name_type>r</name_type>
<filesize>151132575</filesize>
<alloc>1</alloc>
<inode>51</inode>
<mtime>16/04/2014 10:33:57</mtime>
<hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='193904640' len='151132575' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Folder with Stream</filename>
<name_type>d</name_type>
<filesize>32</filesize>
<alloc>1</alloc>
<inode>57</inode>
<mtime>20/11/2017 22:46:56</mtime>
<byte_runs>
<byte_run img_offset='737620992' len='32' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Folder with Stream\Folder with Stream:Text_In_Stream.txt</filename>
<name_type>-</name_type>
<filesize>25</filesize>
<alloc>1</alloc>
<inode>57</inode>
<mtime>20/11/2017 22:46:56</mtime>
<byte_runs>
<byte_run img_offset='737620992' len='25' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\Folder with Streams</filename>
<name_type>d</name_type>
<filesize>32</filesize>
<alloc>1</alloc>
<inode>58</inode>
<mtime>20/11/2017 22:49:35</mtime>
<byte_runs>
<byte_run img_offset='737622528' len='32' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Folder with Streams\Folder with Streams:Text_In_Stream.txt</filename>
<name_type>-</name_type>
<filesize>25</filesize>
<alloc>1</alloc>
<inode>58</inode>
<mtime>20/11/2017 22:49:35</mtime>
<byte_runs>
<byte_run img_offset='737622016' len='25' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Folder with Streams\Folder with Streams:Text_In_Stream2.txt</filename>
<name_type>-</name_type>
<filesize>29</filesize>
<alloc>1</alloc>
<inode>58</inode>
<mtime>20/11/2017 22:49:35</mtime>
<byte_runs>
<byte_run img_offset='737622016' len='29' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Folder with Streams\Folder with Streams:Text_In_Stream3.txt</filename>
<name_type>-</name_type>
<filesize>37</filesize>
<alloc>1</alloc>
<inode>58</inode>
<mtime>20/11/2017 22:49:35</mtime>
<byte_runs>
<byte_run img_offset='43098112' len='37' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\Folder with Streams\Folder with Streams:Text_In_Stream4.txt</filename>
<name_type>-</name_type>
<filesize>41</filesize>
<alloc>1</alloc>
<inode>58</inode>
<mtime>20/11/2017 22:49:35</mtime>
<byte_runs>
<byte_run img_offset='43102208' len='41' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\System Volume Information</filename>
<name_type>d</name_type>
<filesize>144</filesize>
<alloc>1</alloc>
<inode>36</inode>
<mtime>14/12/2017 04:21:16</mtime>
<byte_runs>
<byte_run img_offset='737599488' len='144' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\System Volume Information\WPSettings.dat</filename>
<name_type>r</name_type>
<filesize>12</filesize>
<alloc>1</alloc>
<inode>37</inode>
<mtime>14/12/2017 04:21:16</mtime>
<hfs:HFStype_creator>DAT File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737600512' len='12' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$AttrDef</filename>
<name_type>r</name_type>
<filesize>2560</filesize>
<alloc>1</alloc>
<inode>4</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='731500544' len='2560' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$BadClus</filename>
<name_type>r</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<inode>8</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737570816' len='0' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\$BadClus:$Bad</filename>
<name_type>-</name_type>
<filesize>2111827968</filesize>
<alloc>1</alloc>
<inode>8</inode>
<mtime>14/12/2017 04:20:47</mtime>
<byte_runs>
<byte_run img_offset='0' len='2111827968' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Bitmap</filename>
<name_type>r</name_type>
<filesize>64448</filesize>
<alloc>1</alloc>
<inode>6</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737488896' len='64448' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Boot</filename>
<name_type>r</name_type>
<filesize>8192</filesize>
<alloc>1</alloc>
<inode>7</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='33619968' len='8192' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$LogFile</filename>
<name_type>r</name_type>
<filesize>6324224</filesize>
<alloc>1</alloc>
<inode>2</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='724840448' len='6324224' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$MFT</filename>
<name_type>r</name_type>
<filesize>262144</filesize>
<alloc>1</alloc>
<inode>0</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737562624' len='262144' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$MFTMirr</filename>
<name_type>r</name_type>
<filesize>4096</filesize>
<alloc>1</alloc>
<inode>1</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='33628160' len='4096' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Secure</filename>
<name_type>r</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<inode>9</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='0' len='0' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\$Secure:$SDS</filename>
<name_type>-</name_type>
<filesize>264668</filesize>
<alloc>1</alloc>
<inode>9</inode>
<mtime>14/12/2017 04:20:47</mtime>
<byte_runs>
<byte_run img_offset='731234304' len='264668' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$UpCase</filename>
<name_type>r</name_type>
<filesize>131072</filesize>
<alloc>1</alloc>
<inode>10</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='33632256' len='131072' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\$UpCase:$Info</filename>
<name_type>-</name_type>
<filesize>32</filesize>
<alloc>1</alloc>
<inode>10</inode>
<mtime>14/12/2017 04:20:47</mtime>
<byte_runs>
<byte_run img_offset='737572864' len='32' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\$Volume</filename>
<name_type>r</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<inode>3</inode>
<mtime>14/12/2017 04:20:47</mtime>
<hfs:HFStype_creator>File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='737565696' len='0' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\IsoBuster.exe</filename>
<name_type>r</name_type>
<filesize>7948184</filesize>
<alloc>1</alloc>
<inode>38</inode>
<mtime>12/12/2017 23:57:56</mtime>
<hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='33804288' len='7948184' />
</byte_runs>
</fileobject>
<fileobject>
<filename>\logo1.eps</filename>
<name_type>r</name_type>
<filesize>294221</filesize>
<alloc>1</alloc>
<inode>42</inode>
<mtime>08/08/2003 21:22:42</mtime>
<hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
<byte_runs>
<byte_run img_offset='736813056' len='294221' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\logo1.eps:AFP_AfpInfo</filename>
<name_type>-</name_type>
<filesize>60</filesize>
<alloc>1</alloc>
<inode>42</inode>
<mtime>08/08/2003 21:22:42</mtime>
<byte_runs>
<byte_run img_offset='737605632' len='60' />
</byte_runs>
</fileobject>
<fileobject><!--Stream or Resource Fork-->
<filename>\logo1.eps:AFP_Resource</filename>
<name_type>-</name_type>
<filesize>197056</filesize>
<alloc>1</alloc>
<inode>42</inode>
<mtime>08/08/2003 21:22:42</mtime>
<byte_runs>
<byte_run img_offset='737107968' len='197056' />
</byte_runs>
</fileobject>
</volume>
<runstats>
<stop_time>14/12/2017 04:40:11</stop_time>
<clock_seconds>0</clock_seconds>
</runstats>
</dfxml>
<!-- For more information: https://www.isobuster.com/reports -->