Closed bitsgalore closed 1 year ago
Example command:
fiwalk -X test.xml test.img
Resulting file:
<?xml version='1.0' encoding='UTF-8'?>
<dfxml
xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
xmlns:dc='http://purl.org/dc/elements/1.1/'
version='1.0'>
<metadata>
<dc:type>Disk Image</dc:type>
</metadata>
<creator version='1.0'>
<program>fiwalk</program>
<version>4.6.7</version>
<build_environment>
<compiler>GCC 9.3</compiler>
<library name="afflib" version="3.7.18"/>
<library name="libewf" version="20140807"/>
</build_environment>
<execution_environment>
<command_line>fiwalk -X test.xml test.img</command_line>
<start_time>2022-09-28T16:56:51Z</start_time>
</execution_environment>
</creator>
<source>
<image_filename>test.img</image_filename>
</source>
<!-- fs start: 0 -->
<volume offset='0'>
<partition_offset>0</partition_offset>
<sector_size>512</sector_size>
<block_size>1024</block_size>
<ftype>2</ftype>
<ftype_str>fat12</ftype_str>
<block_count>1440</block_count>
<first_block>0</first_block>
<last_block>1439</last_block>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>NORMAL.D</filename>
<partition>1</partition>
<id>1</id>
<name_type>r</name_type>
<filesize>16898</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>3</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-14T13:56:30</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='7168' img_offset='7168' len='16898'/>
</byte_runs>
<hashdigest type='md5'>219846af6da1c4bc82c89e1e32cb9c97</hashdigest>
<hashdigest type='sha1'>1dc1bf558f225012480d2d1b6845ffcab4eefd53</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>LASTPLOT.CSG</filename>
<partition>1</partition>
<id>2</id>
<name_type>r</name_type>
<filesize>5542</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>4</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-14T13:51:36</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='24576' img_offset='24576' len='5542'/>
</byte_runs>
<hashdigest type='md5'>0037440042ffe1b4c1471e3aa6523d5a</hashdigest>
<hashdigest type='sha1'>583974868518045659ce63f23be3b290ff0a468b</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>KSBASE.CSS</filename>
<partition>1</partition>
<id>3</id>
<name_type>r</name_type>
<filesize>10320</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>5</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-10T14:26:04</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='30720' img_offset='30720' len='10320'/>
</byte_runs>
<hashdigest type='md5'>4307f44612e9bda55eb5fe9f88c73fb5</hashdigest>
<hashdigest type='sha1'>6cb19097d48439d49bdbd0e814cae11f0e695d7e</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>MNSDKS.CSG</filename>
<partition>1</partition>
<id>4</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>6</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-10T15:38:10</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='41984' img_offset='41984' len='5798'/>
</byte_runs>
<hashdigest type='md5'>bb31bed36df1cd957641a2771f77b03a</hashdigest>
<hashdigest type='sha1'>0269d5405a146f0dba65be1d09f06aca734e93d3</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>KSBASE.D</filename>
<partition>1</partition>
<id>5</id>
<name_type>r</name_type>
<filesize>5814</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>7</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-11T16:36:50</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='48128' img_offset='48128' len='5814'/>
</byte_runs>
<hashdigest type='md5'>f638b9069b60f1380775905a46575084</hashdigest>
<hashdigest type='sha1'>56c33e1162097ba65af556e72b39d442354f0059</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>ANOVARKS.D01</filename>
<partition>1</partition>
<id>6</id>
<name_type>r</name_type>
<filesize>987</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>8</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-11T12:20:52</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='54272' img_offset='54272' len='987'/>
</byte_runs>
<hashdigest type='md5'>17401241a0b8806265dda32c0a530faf</hashdigest>
<hashdigest type='sha1'>aae57aeb89c01fac1bc71d32af1e93c675547818</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>TEXT.D</filename>
<partition>1</partition>
<id>7</id>
<name_type>r</name_type>
<filesize>20217</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>9</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-14T17:17:00</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='55296' img_offset='55296' len='20217'/>
</byte_runs>
<hashdigest type='md5'>7840e653a0a0cac645abbbcaede6518d</hashdigest>
<hashdigest type='sha1'>44eabdd335d6cf3c304ed5c6c0a9a88f1bb89f4f</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>KRUSKALL.D</filename>
<partition>1</partition>
<id>8</id>
<name_type>r</name_type>
<filesize>8068</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>10</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-15T12:59:20</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='75776' img_offset='75776' len='8068'/>
</byte_runs>
<hashdigest type='md5'>1a6f4d9b0a2f6127a30789c1e95592db</hashdigest>
<hashdigest type='sha1'>d962bb931e143f2462a71f18164e96db1543476f</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>ASP.D01</filename>
<partition>1</partition>
<id>9</id>
<name_type>r</name_type>
<filesize>2831</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>11</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-17T10:00:18</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='83968' img_offset='83968' len='2831'/>
</byte_runs>
<hashdigest type='md5'>6bed62f483f7819b9ec7b7ed83b05731</hashdigest>
<hashdigest type='sha1'>918b723766808e837c8806f31721b50deae19153</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>ASP.D</filename>
<partition>1</partition>
<id>10</id>
<name_type>r</name_type>
<filesize>17964</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>12</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-15T14:44:40</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='87040' img_offset='87040' len='17964'/>
</byte_runs>
<hashdigest type='md5'>e86bc70061d34d7ed3e46ae630524d1e</hashdigest>
<hashdigest type='sha1'>f46c57e3b071b88a0fef4f55578c880a0706df89</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>KRUSKASP.D</filename>
<partition>1</partition>
<id>11</id>
<name_type>r</name_type>
<filesize>7327</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>13</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-17T10:02:08</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='105472' img_offset='105472' len='7327'/>
</byte_runs>
<hashdigest type='md5'>e6bbdab710170cb76f4ad6c14bc8f1da</hashdigest>
<hashdigest type='sha1'>da9d993fa68d31d7c9bf6edecb4deba7a2c6016d</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>DISTRIKS.CSG</filename>
<partition>1</partition>
<id>12</id>
<name_type>r</name_type>
<filesize>5574</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>14</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-14T16:36:46</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='113664' img_offset='113664' len='5574'/>
</byte_runs>
<hashdigest type='md5'>392a922a937d956d291d509333dd9286</hashdigest>
<hashdigest type='sha1'>87f9a74050ca0d79b3f40c6afd0f0af55fc0ef14</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>ASP.CSS</filename>
<partition>1</partition>
<id>13</id>
<name_type>r</name_type>
<filesize>2720</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>15</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-15T14:31:02</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='119808' img_offset='119808' len='2720'/>
</byte_runs>
<hashdigest type='md5'>57eb16b50eafb2e913ad86cc044a9dae</hashdigest>
<hashdigest type='sha1'>915069d7712327a8908eb34e68665c69efd89b2d</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>ASPLOT1.CSG</filename>
<partition>1</partition>
<id>14</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>16</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-17T09:57:30</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='122880' img_offset='122880' len='5798'/>
</byte_runs>
<hashdigest type='md5'>92268f49410a8498c21fe07510956b42</hashdigest>
<hashdigest type='sha1'>f9a459ea21d05ba09e586cc5fdd3df89712ffc6a</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>ASPLOT2.CSG</filename>
<partition>1</partition>
<id>15</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>17</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-17T09:58:44</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='129024' img_offset='129024' len='5798'/>
</byte_runs>
<hashdigest type='md5'>6701727b748287d3ed5f0138a8a60c23</hashdigest>
<hashdigest type='sha1'>82d02abacb6013cef549c6ad3501fae98a82a3c2</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>PEYNEVAL.CSS</filename>
<partition>1</partition>
<id>16</id>
<name_type>r</name_type>
<filesize>49760</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>18</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-22T13:23:28</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='135168' img_offset='135168' len='49760'/>
</byte_runs>
<hashdigest type='md5'>cbdea4874611443ebcad11c1f13a0dbb</hashdigest>
<hashdigest type='sha1'>3ea71874c3626e14f546e8d83d5f306cf2bb0116</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>MNSDSOIL.CSG</filename>
<partition>1</partition>
<id>17</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>19</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-14T16:48:14</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='185344' img_offset='185344' len='5798'/>
</byte_runs>
<hashdigest type='md5'>becd10bcaaa020e2e702d8572093d089</hashdigest>
<hashdigest type='sha1'>7f4c900d9ef1aa2095d44bf8231670a34564fb6d</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>MNSDTEXT.CSG</filename>
<partition>1</partition>
<id>18</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>20</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-14T16:50:20</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='191488' img_offset='191488' len='5798'/>
</byte_runs>
<hashdigest type='md5'>57ab37ecc98f480ae4b8cd2d1443a60b</hashdigest>
<hashdigest type='sha1'>399220898c84efae2dd3cbb5011b53f4db77cafd</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>DESCRIPT.D</filename>
<partition>1</partition>
<id>19</id>
<name_type>r</name_type>
<filesize>14841</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>21</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-23T10:25:16</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='197632' img_offset='197632' len='14841'/>
</byte_runs>
<hashdigest type='md5'>e18a93ae8dfc1978849e8346feef90b8</hashdigest>
<hashdigest type='sha1'>cea38ed7ab6788ee9528732fc5aa888a2bd59c12</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>BDLANDUS.D</filename>
<partition>1</partition>
<id>20</id>
<name_type>r</name_type>
<filesize>59566</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>22</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-22T14:12:28</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='212992' img_offset='212992' len='59566'/>
</byte_runs>
<hashdigest type='md5'>47ed9f57b92d4b478dd86e1d02a85314</hashdigest>
<hashdigest type='sha1'>1d9aa30f1cbf6a4f16a69d30c2bebd0b4f4006b6</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>BDLAND2.D</filename>
<partition>1</partition>
<id>21</id>
<name_type>r</name_type>
<filesize>2821</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>23</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-23T12:39:42</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='273408' img_offset='273408' len='2821'/>
</byte_runs>
<hashdigest type='md5'>ec51618f4f28face0c5fad6702bc383e</hashdigest>
<hashdigest type='sha1'>676a3d7f1472ba7f9bc733f9ec6af0a4ff854cfe</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>ASPOP.CSS</filename>
<partition>1</partition>
<id>22</id>
<name_type>r</name_type>
<filesize>3784</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>24</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-02T12:54:44</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='276480' img_offset='276480' len='3784'/>
</byte_runs>
<hashdigest type='md5'>fd98050c8a53bab15863027eb2248976</hashdigest>
<hashdigest type='sha1'>7e031bca1e1134e3a89fe6a04e02f4e1f91677f9</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>MSDBD510.CSG</filename>
<partition>1</partition>
<id>23</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>25</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-22T13:36:52</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='280576' img_offset='280576' len='5798'/>
</byte_runs>
<hashdigest type='md5'>a473745fa82b2523642c56fc37da50a2</hashdigest>
<hashdigest type='sha1'>be4e2c38adf5cde7840fdee95c43d700fc04c9a1</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>MSDBD152.CSG</filename>
<partition>1</partition>
<id>24</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>26</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-22T13:51:46</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='286720' img_offset='286720' len='5798'/>
</byte_runs>
<hashdigest type='md5'>c04ed0ba83513863ec8459b38c6d5b27</hashdigest>
<hashdigest type='sha1'>322aed9072796422944df1dbe7b54f75b359b4b8</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>MSDBD303.CSG</filename>
<partition>1</partition>
<id>25</id>
<name_type>r</name_type>
<filesize>5798</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>27</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-22T13:55:32</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='292864' img_offset='292864' len='5798'/>
</byte_runs>
<hashdigest type='md5'>f3d67b980d582c520a98808f533254fe</hashdigest>
<hashdigest type='sha1'>651951438c838ecf1cdf43109e6ea372f6f475b0</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>AUTOCOR.D</filename>
<partition>1</partition>
<id>26</id>
<name_type>r</name_type>
<filesize>8294</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>28</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-30T10:59:22</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='299008' img_offset='299008' len='8294'/>
</byte_runs>
<hashdigest type='md5'>3e8a5f484b082abc7a5f3dfdf31c250d</hashdigest>
<hashdigest type='sha1'>608b14fd63999318c18a7b799dda1cf49c226867</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>PEYNEVAL.QML</filename>
<partition>1</partition>
<id>27</id>
<name_type>r</name_type>
<filesize>51</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>29</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1996-10-30T16:04:24</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='309248' img_offset='309248' len='51'/>
</byte_runs>
<hashdigest type='md5'>1900baaa0130b04016000fbce4b52177</hashdigest>
<hashdigest type='sha1'>36dbfde2eea8676bc98674631285a4b463cce262</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>HEPRCOR.SCR</filename>
<partition>1</partition>
<id>28</id>
<name_type>r</name_type>
<filesize>2400</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>30</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1997-02-20T07:21:10</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='308224' img_offset='308224' len='1024'/>
<byte_run file_offset='1024' fs_offset='310272' img_offset='310272' len='1376'/>
</byte_runs>
<hashdigest type='md5'>3fd545722fd5408688b67d1055fcc1c3</hashdigest>
<hashdigest type='sha1'>027cc447e30df749a867132d9811b08fe3f18eaa</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>PRCR2.SCR</filename>
<partition>1</partition>
<id>29</id>
<name_type>r</name_type>
<filesize>1755</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>31</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1997-02-20T06:04:22</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='312320' img_offset='312320' len='1755'/>
</byte_runs>
<hashdigest type='md5'>b4c4cc350b454affa3e91a69e4524c73</hashdigest>
<hashdigest type='sha1'>534ca78b56b71cd3710ca4f403e2446767b74fce</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>PRECCOR.SCR</filename>
<partition>1</partition>
<id>30</id>
<name_type>r</name_type>
<filesize>7619</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>32</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1997-02-20T05:37:14</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='314368' img_offset='314368' len='7619'/>
</byte_runs>
<hashdigest type='md5'>ddf35b40dbedb291d54b7f55dbf66877</hashdigest>
<hashdigest type='sha1'>6ac1a0ba8f1bbaf93e7e916b596d74d2ba1d1305</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>PRECCOR.STG</filename>
<partition>1</partition>
<id>31</id>
<name_type>r</name_type>
<filesize>8321</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>33</inode>
<meta_type>1</meta_type>
<mode>511</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<mtime prec="2">1997-02-20T05:55:00</mtime>
<byte_runs>
<byte_run file_offset='0' fs_offset='322560' img_offset='322560' len='8321'/>
</byte_runs>
<hashdigest type='md5'>36f9f89af8d6c6d2ed9eb85615012927</hashdigest>
<hashdigest type='sha1'>7678b0bf7bdc370ea2108efd4fbc4ee67f0e893d</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>$MBR</filename>
<partition>1</partition>
<id>32</id>
<name_type>v</name_type>
<filesize>512</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>22931</inode>
<meta_type>10</meta_type>
<mode>0</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<byte_runs>
<byte_run file_offset='0' fs_offset='0' img_offset='0' len='512'/>
</byte_runs>
<hashdigest type='md5'>57bd5fe0fd1d6752a607c3639f2921d6</hashdigest>
<hashdigest type='sha1'>1b2e0ecf3ccbc07a917c4d74f98ed3f117cc367a</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>$FAT1</filename>
<partition>1</partition>
<id>33</id>
<name_type>v</name_type>
<filesize>1536</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>22932</inode>
<meta_type>10</meta_type>
<mode>0</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<byte_runs>
<byte_run file_offset='0' fs_offset='512' img_offset='512' len='1536'/>
</byte_runs>
<hashdigest type='md5'>9c205893c9ccd96153c8c3039a93ebdc</hashdigest>
<hashdigest type='sha1'>1656c2b74802754dc6f00758806684e18601204b</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>$FAT2</filename>
<partition>1</partition>
<id>34</id>
<name_type>v</name_type>
<filesize>1536</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>22933</inode>
<meta_type>10</meta_type>
<mode>0</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
<byte_runs>
<byte_run file_offset='0' fs_offset='2048' img_offset='2048' len='1536'/>
</byte_runs>
<hashdigest type='md5'>9c205893c9ccd96153c8c3039a93ebdc</hashdigest>
<hashdigest type='sha1'>1656c2b74802754dc6f00758806684e18601204b</hashdigest>
</fileobject>
<fileobject>
<parent_object>
<inode>2</inode>
</parent_object>
<filename>$OrphanFiles</filename>
<partition>1</partition>
<id>35</id>
<name_type>V</name_type>
<filesize>0</filesize>
<alloc>1</alloc>
<used>1</used>
<inode>22934</inode>
<meta_type>11</meta_type>
<mode>0</mode>
<nlink>1</nlink>
<uid>0</uid>
<gid>0</gid>
</fileobject>
</volume>
<!-- end of volume -->
<!-- clock: 0.013758 -->
<rusage>
<utime>0.026134</utime>
<stime>0.007466</stime>
<maxrss>13968</maxrss>
<minflt>1202</minflt>
<majflt>0</majflt>
<nswap>0</nswap>
<inblock>0</inblock>
<oublock>56</oublock>
<clocktime>0.013758</clocktime>
<!-- stop_time: Wed Sep 28 18:56:51 2022 -->
</rusage>
</dfxml>
Or use the Python implementation:
https://github.com/dfxml-working-group/dfxml_python
Install (no PyPi package exists):
git clone https://github.com/dfxml-working-group/dfxml_python.git
(or download and extract ZIP file from here)cd dfxml_python
pip3 install --user .
Result:
Successfully built dfxml
Installing collected packages: dfxml
Successfully installed dfxml-1.0.2
Problem is that it's no clear to me how to invoke it within Python, and my first attempt doesn't work:
https://github.com/dfxml-working-group/dfxml_python/issues/39
Now works https://github.com/KBNLresearch/ipmlab/commit/d39319a4afc29e81d5d8c40e60c93cd4ebb78fe4. Note that this solution will fail for large disk images as per comments here (OK for floppies though).
Could be fallback option in case Aaru integration doesn't work out:
https://manpages.debian.org/unstable/sleuthkit/fiwalk.1.en.html
Linux install: