DFXML examples

These samples were created with IsoBuster 4.1, using the embedded 'Folder tree and file information' functionality, which exports a list / report, using the pre-defined layout shown here

From UDF file system on a simple CD

This particular sample was taken from a very simple CD, starting from the UDF file system.

<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
      xmlns:dc='http://purl.org/dc/elements/1.1/'
      xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>

   <metadata>
      <dc:type>CD</dc:type>
   </metadata>

   <creator>
      <program>IsoBuster</program>
      <version>4.1.0.00</version>
      <execution_environment>
        <start_time>14/12/2017 04:38:32</start_time>
        <os_version>Windows 10 (2.10.0.15063)</os_version>
        <username>Peter</username>
      </execution_environment>
   </creator>

   <source>
       <device_model>HL-DT-ST  DVDRAM GUE1N</device_model>
       <image_filename></image_filename>
       <image_size></image_size>
       <sectorsize>2048</sectorsize>
       <devicesectors coding='base10'>6016</devicesectors>
   </source>

   <volume>
      <ftype_str>UDF</ftype_str>
      <partition_offset>0</partition_offset>

      <fileobject>
         <filename>\AUTORUN.INF</filename>
         <name_type>r</name_type>
         <filesize>131</filesize>
         <alloc>1</alloc>
         <inode>267</inode>
         <mtime>01/08/2003 15:32:30</mtime>
         <hfs:HFStype_creator>INF File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='555008' len='131' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Install.exe</filename>
         <name_type>r</name_type>
         <filesize>11624920</filesize>
         <alloc>1</alloc>
         <inode>268</inode>
         <mtime>13/12/2017 00:00:51</mtime>
         <hfs:HFStype_creator>EXE File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='557056' len='11624920' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\IsoBuster.ico</filename>
         <name_type>r</name_type>
         <filesize>105303</filesize>
         <alloc>1</alloc>
         <inode>269</inode>
         <mtime>16/12/2008 17:19:52</mtime>
         <hfs:HFStype_creator>ICO File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='12183552' len='105303' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Online.html</filename>
         <name_type>r</name_type>
         <filesize>1881</filesize>
         <alloc>1</alloc>
         <inode>270</inode>
         <mtime>22/06/2016 14:31:40</mtime>
         <hfs:HFStype_creator>HTML File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='12290048' len='1881' />
         </byte_runs>
      </fileobject>
   </volume>

   <runstats>
      <stop_time>14/12/2017 04:38:32</stop_time>
      <clock_seconds>0</clock_seconds>
   </runstats>

</dfxml>

From NTFS formatted VHDX image file

This particular sample was taken from an NTFS formatted USB-stick Image file, and it shows fragmented files (multiple extents) as well as Alternate Data Streams (ADS or simply 'Streams') attached to the files and folders.

<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
      xmlns:dc='http://purl.org/dc/elements/1.1/'
      xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>

   <metadata>
      <dc:type>Image File</dc:type>
   </metadata>

   <creator>
      <program>IsoBuster</program>
      <version>4.1.0.00</version>
      <execution_environment>
        <start_time>14/12/2017 04:40:10</start_time>
        <os_version>Windows 10 (2.10.0.15063)</os_version>
        <username>Peter</username>
      </execution_environment>
   </creator>

   <source>
       <device_model>Thumb drive.vhdx</device_model>
       <image_filename>C:\Users\Peter\Desktop\Thumb drive.vhdx</image_filename>
       <image_size>440401920</image_size>
       <sectorsize>512</sectorsize>
       <devicesectors coding='base10'>4194304</devicesectors>
   </source>

   <volume>
      <ftype_str>NTFS</ftype_str>
      <partition_offset>33619968</partition_offset>

      <fileobject>
         <filename>\$Extend</filename>
         <name_type>d</name_type>
         <filesize>536</filesize>
         <alloc>1</alloc>
         <inode>11</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='737573888' len='536' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Deleted</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>29</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737592320' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$ObjId</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>25</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Quota</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>24</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Reparse</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>26</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata</filename>
         <name_type>d</name_type>
         <filesize>320</filesize>
         <alloc>1</alloc>
         <inode>27</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737590272' len='320' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$Repair</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>28</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Extend\$RmMetadata\$Repair:$Config</filename>
         <name_type>-</name_type>
         <filesize>8</filesize>
         <alloc>1</alloc>
         <inode>28</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737591296' len='8' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$Txf</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>31</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737594368' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog</filename>
         <name_type>d</name_type>
         <filesize>552</filesize>
         <alloc>1</alloc>
         <inode>30</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737593344' len='552' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$Tops</filename>
         <name_type>r</name_type>
         <filesize>100</filesize>
         <alloc>1</alloc>
         <inode>32</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737595392' len='100' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Extend\$RmMetadata\$TxfLog\$Tops:$T</filename>
         <name_type>-</name_type>
         <filesize>1048576</filesize>
         <alloc>1</alloc>
         <inode>32</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='731504640' len='1048576' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf</filename>
         <name_type>r</name_type>
         <filesize>65536</filesize>
         <alloc>1</alloc>
         <inode>33</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>BLF File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='732553216' len='65536' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog1</filename>
         <name_type>r</name_type>
         <filesize>2097152</filesize>
         <alloc>1</alloc>
         <inode>34</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='732618752' len='2097152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog2</filename>
         <name_type>r</name_type>
         <filesize>2097152</filesize>
         <alloc>1</alloc>
         <inode>35</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='734715904' len='2097152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN</filename>
         <name_type>d</name_type>
         <filesize>208</filesize>
         <alloc>1</alloc>
         <inode>39</inode>
         <mtime>14/12/2017 04:21:45</mtime>
         <byte_runs>
            <byte_run img_offset='737602560' len='208' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714</filename>
         <name_type>d</name_type>
         <filesize>552</filesize>
         <alloc>1</alloc>
         <inode>40</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <byte_runs>
            <byte_run img_offset='737603584' len='552' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IIKZQZA</filename>
         <name_type>r</name_type>
         <filesize>74</filesize>
         <alloc>1</alloc>
         <inode>56</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737619968' len='74' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IW8ACSL</filename>
         <name_type>r</name_type>
         <filesize>72</filesize>
         <alloc>1</alloc>
         <inode>55</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737618944' len='72' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RIKZQZA</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>45</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737608704' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RW8ACSL</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>52</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737615872' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\desktop.ini</filename>
         <name_type>r</name_type>
         <filesize>129</filesize>
         <alloc>1</alloc>
         <inode>41</inode>
         <mtime>14/12/2017 04:21:45</mtime>
         <hfs:HFStype_creator>INI File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737604608' len='129' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder</filename>
         <name_type>d</name_type>
         <filesize>456</filesize>
         <alloc>1</alloc>
         <inode>43</inode>
         <mtime>14/12/2017 04:31:48</mtime>
         <byte_runs>
            <byte_run img_offset='737606656' len='456' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>53</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='345038848' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345104384' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345169920' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345235456' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345300992' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345366528' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345432064' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345497600' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345563136' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345628672' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345694208' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345759744' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345825280' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345890816' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345956352' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='346021888' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346087424' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346152960' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346218496' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346284032' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346349568' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346415104' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346480640' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346546176' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346611712' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346677248' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346742784' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346808320' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346873856' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346939392' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='347004928' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='347070464' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='347136000' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='347201536' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='347267072' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='347332608' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347398144' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347463680' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347529216' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347594752' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347660288' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347725824' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347791360' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347856896' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347922432' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='347987968' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='348053504' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='348119040' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='348184576' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348250112' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348315648' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348381184' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='348446720' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348512256' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348577792' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348643328' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348708864' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348774400' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348839936' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348905472' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348971008' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='349036544' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='349102080' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='349167616' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='349233152' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='349298688' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349364224' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='349429760' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349495296' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349560832' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='349626368' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='349691904' len='4096' />
            <byte_run img_offset='0' len='61440' />
            <byte_run img_offset='349757440' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='349822976' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='349888512' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349954048' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='350019584' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='350085120' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='350150656' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350216192' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='350281728' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='350347264' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='350412800' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350478336' len='118784' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='350609408' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='350674944' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='350740480' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='350806016' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350871552' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='350937088' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='351002624' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351068160' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351133696' len='16384' />
            <byte_run img_offset='0' len='49152' />
            <byte_run img_offset='351199232' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351264768' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351330304' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='351395840' len='57344' />
            <byte_run img_offset='0' len='8192' />
            <byte_run img_offset='351461376' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='351526912' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='351592448' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351657984' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='351723520' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351789056' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351854592' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351920128' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351985664' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352051200' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='352116736' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352182272' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352247808' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='352313344' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352378880' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352444416' len='16384' />
            <byte_run img_offset='0' len='49152' />
            <byte_run img_offset='352509952' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352575488' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352641024' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='352706560' len='184320' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='352903168' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='33771520' len='16384' />
            <byte_run img_offset='0' len='49152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\Links.zip</filename>
         <name_type>r</name_type>
         <filesize>3448</filesize>
         <alloc>1</alloc>
         <inode>49</inode>
         <mtime>15/10/2014 13:57:07</mtime>
         <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42442752' len='4096' />
            <byte_run img_offset='0' len='61440' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\logo.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42250240' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='42315776' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='42381312' len='61440' />
            <byte_run img_offset='0' len='4096' />
            <byte_run img_offset='42446848' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='737308672' len='16384' />
            <byte_run img_offset='0' len='49152' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Compressed Folder\logo.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737610752' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Compressed Folder\logo.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='42577920' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='42643456' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='42708992' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='42774528' len='4096' />
            <byte_run img_offset='0' len='61440' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\Video.mp4</filename>
         <name_type>r</name_type>
         <filesize>151132575</filesize>
         <alloc>1</alloc>
         <inode>48</inode>
         <mtime>16/04/2014 10:33:57</mtime>
         <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42778624' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42844160' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42909696' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42975232' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='43040768' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='43106304' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='43171840' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='43237376' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43302912' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43368448' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43433984' len='150470656' />
            <byte_run img_offset='42356736' len='8192' />
            <byte_run img_offset='0' len='57344' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder</filename>
         <name_type>d</name_type>
         <filesize>456</filesize>
         <alloc>1</alloc>
         <inode>44</inode>
         <mtime>14/12/2017 04:31:52</mtime>
         <byte_runs>
            <byte_run img_offset='737607680' len='456' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>54</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='353034240' len='7948184' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\Links.zip</filename>
         <name_type>r</name_type>
         <filesize>3448</filesize>
         <alloc>1</alloc>
         <inode>50</inode>
         <mtime>15/10/2014 13:57:07</mtime>
         <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='43094016' len='3448' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\logo.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='41754624' len='294221' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder\logo.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737609728' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder\logo.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='42049536' len='197056' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\Video.mp4</filename>
         <name_type>r</name_type>
         <filesize>151132575</filesize>
         <alloc>1</alloc>
         <inode>51</inode>
         <mtime>16/04/2014 10:33:57</mtime>
         <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='193904640' len='151132575' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder with Stream</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>57</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737620992' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Stream\Folder with Stream:Text_In_Stream.txt</filename>
         <name_type>-</name_type>
         <filesize>25</filesize>
         <alloc>1</alloc>
         <inode>57</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737620992' len='25' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder with Streams</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622528' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream.txt</filename>
         <name_type>-</name_type>
         <filesize>25</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622016' len='25' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream2.txt</filename>
         <name_type>-</name_type>
         <filesize>29</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622016' len='29' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream3.txt</filename>
         <name_type>-</name_type>
         <filesize>37</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='43098112' len='37' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream4.txt</filename>
         <name_type>-</name_type>
         <filesize>41</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='43102208' len='41' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\System Volume Information</filename>
         <name_type>d</name_type>
         <filesize>144</filesize>
         <alloc>1</alloc>
         <inode>36</inode>
         <mtime>14/12/2017 04:21:16</mtime>
         <byte_runs>
            <byte_run img_offset='737599488' len='144' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\System Volume Information\WPSettings.dat</filename>
         <name_type>r</name_type>
         <filesize>12</filesize>
         <alloc>1</alloc>
         <inode>37</inode>
         <mtime>14/12/2017 04:21:16</mtime>
         <hfs:HFStype_creator>DAT File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737600512' len='12' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$AttrDef</filename>
         <name_type>r</name_type>
         <filesize>2560</filesize>
         <alloc>1</alloc>
         <inode>4</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='731500544' len='2560' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$BadClus</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>8</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737570816' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$BadClus:$Bad</filename>
         <name_type>-</name_type>
         <filesize>2111827968</filesize>
         <alloc>1</alloc>
         <inode>8</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='0' len='2111827968' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Bitmap</filename>
         <name_type>r</name_type>
         <filesize>64448</filesize>
         <alloc>1</alloc>
         <inode>6</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737488896' len='64448' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Boot</filename>
         <name_type>r</name_type>
         <filesize>8192</filesize>
         <alloc>1</alloc>
         <inode>7</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33619968' len='8192' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$LogFile</filename>
         <name_type>r</name_type>
         <filesize>6324224</filesize>
         <alloc>1</alloc>
         <inode>2</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='724840448' len='6324224' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$MFT</filename>
         <name_type>r</name_type>
         <filesize>262144</filesize>
         <alloc>1</alloc>
         <inode>0</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737562624' len='262144' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$MFTMirr</filename>
         <name_type>r</name_type>
         <filesize>4096</filesize>
         <alloc>1</alloc>
         <inode>1</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33628160' len='4096' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Secure</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>9</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Secure:$SDS</filename>
         <name_type>-</name_type>
         <filesize>264668</filesize>
         <alloc>1</alloc>
         <inode>9</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='731234304' len='264668' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$UpCase</filename>
         <name_type>r</name_type>
         <filesize>131072</filesize>
         <alloc>1</alloc>
         <inode>10</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33632256' len='131072' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$UpCase:$Info</filename>
         <name_type>-</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>10</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='737572864' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Volume</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>3</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737565696' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>38</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33804288' len='7948184' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\logo1.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='736813056' len='294221' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\logo1.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737605632' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\logo1.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737107968' len='197056' />
         </byte_runs>
      </fileobject>
   </volume>

   <runstats>
      <stop_time>14/12/2017 04:40:11</stop_time>
      <clock_seconds>0</clock_seconds>
   </runstats>

</dfxml>
<!-- For more information: https://www.isobuster.com/reports -->

IsoBuster

DFXML examples

From UDF file system on a simple CD

From NTFS formatted VHDX image file

Also interesting: