DFXML voorbeelden

Volgende voorbeelden werden met IsoBuster 4.1 gemaakt, gebruik makend van de standaard 'Mapstructuur en bestandsinformatie' functionaliteit, dewelke een lijst of rapport exporteert, gebruik makend van deze layout

Van een UDF bestandssysteem op een eenvoudige CD

Dit voorbeeld werd gemaakt van een simpele CD, startend van het UDF bestandssysteem.

<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
      xmlns:dc='http://purl.org/dc/elements/1.1/'
      xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>

   <metadata>
      <dc:type>CD</dc:type>
   </metadata>

   <creator>
      <program>IsoBuster</program>
      <version>4.1.0.00</version>
      <execution_environment>
        <start_time>14/12/2017 04:38:32</start_time>
        <os_version>Windows 10 (2.10.0.15063)</os_version>
        <username>Peter</username>
      </execution_environment>
   </creator>

   <source>
       <device_model>HL-DT-ST  DVDRAM GUE1N</device_model>
       <image_filename></image_filename>
       <image_size></image_size>
       <sectorsize>2048</sectorsize>
       <devicesectors coding='base10'>6016</devicesectors>
   </source>

   <volume>
      <ftype_str>UDF</ftype_str>
      <partition_offset>0</partition_offset>

      <fileobject>
         <filename>\AUTORUN.INF</filename>
         <name_type>r</name_type>
         <filesize>131</filesize>
         <alloc>1</alloc>
         <inode>267</inode>
         <mtime>01/08/2003 15:32:30</mtime>
         <hfs:HFStype_creator>INF File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='555008' len='131' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Install.exe</filename>
         <name_type>r</name_type>
         <filesize>11624920</filesize>
         <alloc>1</alloc>
         <inode>268</inode>
         <mtime>13/12/2017 00:00:51</mtime>
         <hfs:HFStype_creator>EXE File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='557056' len='11624920' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\IsoBuster.ico</filename>
         <name_type>r</name_type>
         <filesize>105303</filesize>
         <alloc>1</alloc>
         <inode>269</inode>
         <mtime>16/12/2008 17:19:52</mtime>
         <hfs:HFStype_creator>ICO File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='12183552' len='105303' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Online.html</filename>
         <name_type>r</name_type>
         <filesize>1881</filesize>
         <alloc>1</alloc>
         <inode>270</inode>
         <mtime>22/06/2016 14:31:40</mtime>
         <hfs:HFStype_creator>HTML File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='12290048' len='1881' />
         </byte_runs>
      </fileobject>
   </volume>

   <runstats>
      <stop_time>14/12/2017 04:38:32</stop_time>
      <clock_seconds>0</clock_seconds>
   </runstats>

</dfxml>

Van een met NTFS geformatteerd VHDX bestand

Dit voorbeeld werd gemaakt van een met NTFS geformatteerd VHDX bestand (vb. een USB stick image), en het toont gefragmenteerde bestanden (meerdere extents) en 'Alternate Data Streams' (ADS of simpelweg 'Streams') geassocieerd met de bestanden en mappen.

<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
      xmlns:dc='http://purl.org/dc/elements/1.1/'
      xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>

   <metadata>
      <dc:type>Image File</dc:type>
   </metadata>

   <creator>
      <program>IsoBuster</program>
      <version>4.1.0.00</version>
      <execution_environment>
        <start_time>14/12/2017 04:40:10</start_time>
        <os_version>Windows 10 (2.10.0.15063)</os_version>
        <username>Peter</username>
      </execution_environment>
   </creator>

   <source>
       <device_model>Thumb drive.vhdx</device_model>
       <image_filename>C:\Users\Peter\Desktop\Thumb drive.vhdx</image_filename>
       <image_size>440401920</image_size>
       <sectorsize>512</sectorsize>
       <devicesectors coding='base10'>4194304</devicesectors>
   </source>

   <volume>
      <ftype_str>NTFS</ftype_str>
      <partition_offset>33619968</partition_offset>

      <fileobject>
         <filename>\$Extend</filename>
         <name_type>d</name_type>
         <filesize>536</filesize>
         <alloc>1</alloc>
         <inode>11</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='737573888' len='536' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Deleted</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>29</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737592320' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$ObjId</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>25</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Quota</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>24</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Reparse</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>26</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata</filename>
         <name_type>d</name_type>
         <filesize>320</filesize>
         <alloc>1</alloc>
         <inode>27</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737590272' len='320' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$Repair</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>28</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Extend\$RmMetadata\$Repair:$Config</filename>
         <name_type>-</name_type>
         <filesize>8</filesize>
         <alloc>1</alloc>
         <inode>28</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737591296' len='8' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$Txf</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>31</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737594368' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog</filename>
         <name_type>d</name_type>
         <filesize>552</filesize>
         <alloc>1</alloc>
         <inode>30</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737593344' len='552' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$Tops</filename>
         <name_type>r</name_type>
         <filesize>100</filesize>
         <alloc>1</alloc>
         <inode>32</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737595392' len='100' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Extend\$RmMetadata\$TxfLog\$Tops:$T</filename>
         <name_type>-</name_type>
         <filesize>1048576</filesize>
         <alloc>1</alloc>
         <inode>32</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='731504640' len='1048576' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf</filename>
         <name_type>r</name_type>
         <filesize>65536</filesize>
         <alloc>1</alloc>
         <inode>33</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>BLF File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='732553216' len='65536' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog1</filename>
         <name_type>r</name_type>
         <filesize>2097152</filesize>
         <alloc>1</alloc>
         <inode>34</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='732618752' len='2097152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog2</filename>
         <name_type>r</name_type>
         <filesize>2097152</filesize>
         <alloc>1</alloc>
         <inode>35</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='734715904' len='2097152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN</filename>
         <name_type>d</name_type>
         <filesize>208</filesize>
         <alloc>1</alloc>
         <inode>39</inode>
         <mtime>14/12/2017 04:21:45</mtime>
         <byte_runs>
            <byte_run img_offset='737602560' len='208' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714</filename>
         <name_type>d</name_type>
         <filesize>552</filesize>
         <alloc>1</alloc>
         <inode>40</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <byte_runs>
            <byte_run img_offset='737603584' len='552' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IIKZQZA</filename>
         <name_type>r</name_type>
         <filesize>74</filesize>
         <alloc>1</alloc>
         <inode>56</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737619968' len='74' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IW8ACSL</filename>
         <name_type>r</name_type>
         <filesize>72</filesize>
         <alloc>1</alloc>
         <inode>55</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737618944' len='72' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RIKZQZA</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>45</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737608704' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RW8ACSL</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>52</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737615872' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\desktop.ini</filename>
         <name_type>r</name_type>
         <filesize>129</filesize>
         <alloc>1</alloc>
         <inode>41</inode>
         <mtime>14/12/2017 04:21:45</mtime>
         <hfs:HFStype_creator>INI File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737604608' len='129' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder</filename>
         <name_type>d</name_type>
         <filesize>456</filesize>
         <alloc>1</alloc>
         <inode>43</inode>
         <mtime>14/12/2017 04:31:48</mtime>
         <byte_runs>
            <byte_run img_offset='737606656' len='456' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>53</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='345038848' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345104384' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345169920' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345235456' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345300992' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345366528' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345432064' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345497600' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345563136' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345628672' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345694208' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345759744' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345825280' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345890816' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345956352' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='346021888' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346087424' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346152960' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346218496' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346284032' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346349568' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346415104' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346480640' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346546176' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346611712' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346677248' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346742784' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346808320' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346873856' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346939392' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='347004928' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='347070464' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='347136000' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='347201536' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='347267072' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='347332608' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347398144' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347463680' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347529216' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347594752' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347660288' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347725824' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347791360' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347856896' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347922432' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='347987968' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='348053504' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='348119040' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='348184576' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348250112' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348315648' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348381184' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='348446720' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348512256' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348577792' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348643328' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348708864' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348774400' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348839936' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348905472' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348971008' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='349036544' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='349102080' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='349167616' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='349233152' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='349298688' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349364224' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='349429760' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349495296' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349560832' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='349626368' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='349691904' len='4096' />
            <byte_run img_offset='0' len='61440' />
            <byte_run img_offset='349757440' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='349822976' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='349888512' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349954048' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='350019584' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='350085120' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='350150656' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350216192' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='350281728' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='350347264' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='350412800' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350478336' len='118784' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='350609408' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='350674944' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='350740480' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='350806016' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350871552' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='350937088' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='351002624' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351068160' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351133696' len='16384' />
            <byte_run img_offset='0' len='49152' />
            <byte_run img_offset='351199232' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351264768' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351330304' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='351395840' len='57344' />
            <byte_run img_offset='0' len='8192' />
            <byte_run img_offset='351461376' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='351526912' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='351592448' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351657984' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='351723520' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351789056' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351854592' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351920128' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351985664' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352051200' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='352116736' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352182272' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352247808' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='352313344' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352378880' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352444416' len='16384' />
            <byte_run img_offset='0' len='49152' />
            <byte_run img_offset='352509952' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352575488' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352641024' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='352706560' len='184320' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='352903168' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='33771520' len='16384' />
            <byte_run img_offset='0' len='49152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\Links.zip</filename>
         <name_type>r</name_type>
         <filesize>3448</filesize>
         <alloc>1</alloc>
         <inode>49</inode>
         <mtime>15/10/2014 13:57:07</mtime>
         <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42442752' len='4096' />
            <byte_run img_offset='0' len='61440' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\logo.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42250240' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='42315776' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='42381312' len='61440' />
            <byte_run img_offset='0' len='4096' />
            <byte_run img_offset='42446848' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='737308672' len='16384' />
            <byte_run img_offset='0' len='49152' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Compressed Folder\logo.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737610752' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Compressed Folder\logo.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='42577920' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='42643456' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='42708992' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='42774528' len='4096' />
            <byte_run img_offset='0' len='61440' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\Video.mp4</filename>
         <name_type>r</name_type>
         <filesize>151132575</filesize>
         <alloc>1</alloc>
         <inode>48</inode>
         <mtime>16/04/2014 10:33:57</mtime>
         <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42778624' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42844160' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42909696' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42975232' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='43040768' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='43106304' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='43171840' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='43237376' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43302912' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43368448' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43433984' len='150470656' />
            <byte_run img_offset='42356736' len='8192' />
            <byte_run img_offset='0' len='57344' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder</filename>
         <name_type>d</name_type>
         <filesize>456</filesize>
         <alloc>1</alloc>
         <inode>44</inode>
         <mtime>14/12/2017 04:31:52</mtime>
         <byte_runs>
            <byte_run img_offset='737607680' len='456' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>54</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='353034240' len='7948184' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\Links.zip</filename>
         <name_type>r</name_type>
         <filesize>3448</filesize>
         <alloc>1</alloc>
         <inode>50</inode>
         <mtime>15/10/2014 13:57:07</mtime>
         <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='43094016' len='3448' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\logo.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='41754624' len='294221' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder\logo.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737609728' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder\logo.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='42049536' len='197056' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\Video.mp4</filename>
         <name_type>r</name_type>
         <filesize>151132575</filesize>
         <alloc>1</alloc>
         <inode>51</inode>
         <mtime>16/04/2014 10:33:57</mtime>
         <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='193904640' len='151132575' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder with Stream</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>57</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737620992' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Stream\Folder with Stream:Text_In_Stream.txt</filename>
         <name_type>-</name_type>
         <filesize>25</filesize>
         <alloc>1</alloc>
         <inode>57</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737620992' len='25' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder with Streams</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622528' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream.txt</filename>
         <name_type>-</name_type>
         <filesize>25</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622016' len='25' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream2.txt</filename>
         <name_type>-</name_type>
         <filesize>29</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622016' len='29' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream3.txt</filename>
         <name_type>-</name_type>
         <filesize>37</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='43098112' len='37' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream4.txt</filename>
         <name_type>-</name_type>
         <filesize>41</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='43102208' len='41' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\System Volume Information</filename>
         <name_type>d</name_type>
         <filesize>144</filesize>
         <alloc>1</alloc>
         <inode>36</inode>
         <mtime>14/12/2017 04:21:16</mtime>
         <byte_runs>
            <byte_run img_offset='737599488' len='144' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\System Volume Information\WPSettings.dat</filename>
         <name_type>r</name_type>
         <filesize>12</filesize>
         <alloc>1</alloc>
         <inode>37</inode>
         <mtime>14/12/2017 04:21:16</mtime>
         <hfs:HFStype_creator>DAT File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737600512' len='12' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$AttrDef</filename>
         <name_type>r</name_type>
         <filesize>2560</filesize>
         <alloc>1</alloc>
         <inode>4</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='731500544' len='2560' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$BadClus</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>8</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737570816' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$BadClus:$Bad</filename>
         <name_type>-</name_type>
         <filesize>2111827968</filesize>
         <alloc>1</alloc>
         <inode>8</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='0' len='2111827968' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Bitmap</filename>
         <name_type>r</name_type>
         <filesize>64448</filesize>
         <alloc>1</alloc>
         <inode>6</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737488896' len='64448' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Boot</filename>
         <name_type>r</name_type>
         <filesize>8192</filesize>
         <alloc>1</alloc>
         <inode>7</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33619968' len='8192' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$LogFile</filename>
         <name_type>r</name_type>
         <filesize>6324224</filesize>
         <alloc>1</alloc>
         <inode>2</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='724840448' len='6324224' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$MFT</filename>
         <name_type>r</name_type>
         <filesize>262144</filesize>
         <alloc>1</alloc>
         <inode>0</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737562624' len='262144' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$MFTMirr</filename>
         <name_type>r</name_type>
         <filesize>4096</filesize>
         <alloc>1</alloc>
         <inode>1</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33628160' len='4096' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Secure</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>9</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Secure:$SDS</filename>
         <name_type>-</name_type>
         <filesize>264668</filesize>
         <alloc>1</alloc>
         <inode>9</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='731234304' len='264668' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$UpCase</filename>
         <name_type>r</name_type>
         <filesize>131072</filesize>
         <alloc>1</alloc>
         <inode>10</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33632256' len='131072' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$UpCase:$Info</filename>
         <name_type>-</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>10</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='737572864' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Volume</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>3</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737565696' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>38</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33804288' len='7948184' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\logo1.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='736813056' len='294221' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\logo1.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737605632' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\logo1.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737107968' len='197056' />
         </byte_runs>
      </fileobject>
   </volume>

   <runstats>
      <stop_time>14/12/2017 04:40:11</stop_time>
      <clock_seconds>0</clock_seconds>
   </runstats>

</dfxml>
<!-- For more information: https://www.isobuster.com/reports -->

IsoBuster

DFXML voorbeelden

Van een UDF bestandssysteem op een eenvoudige CD

Van een met NTFS geformatteerd VHDX bestand

Ook interessant: