search

KBNLresearch / ipmlab

Image Portable Media Like A Boss
Apache License 2.0
3 stars 1 forks source link

Generate metadata using Fiwalk #28

Closed bitsgalore closed 1 year ago

bitsgalore commented 1 year ago

Could be fallback option in case Aaru integration doesn't work out:

https://manpages.debian.org/unstable/sleuthkit/fiwalk.1.en.html

Linux install:

sudo apt install sleuthkit
bitsgalore commented 1 year ago

Example command:

fiwalk -X test.xml test.img

Resulting file:

<?xml version='1.0' encoding='UTF-8'?>
<dfxml 
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
  xmlns:dc='http://purl.org/dc/elements/1.1/'
  version='1.0'>
  <metadata>
    <dc:type>Disk Image</dc:type>
  </metadata>
  <creator version='1.0'>
    <program>fiwalk</program>
    <version>4.6.7</version>
    <build_environment>
      <compiler>GCC 9.3</compiler>
      <library name="afflib" version="3.7.18"/>
      <library name="libewf" version="20140807"/>
    </build_environment>
    <execution_environment>
      <command_line>fiwalk -X test.xml test.img</command_line>
      <start_time>2022-09-28T16:56:51Z</start_time>
    </execution_environment>
  </creator>
  <source>
    <image_filename>test.img</image_filename>
  </source>
<!-- fs start: 0 -->
  <volume offset='0'>
    <partition_offset>0</partition_offset>
    <sector_size>512</sector_size>
    <block_size>1024</block_size>
    <ftype>2</ftype>
    <ftype_str>fat12</ftype_str>
    <block_count>1440</block_count>
    <first_block>0</first_block>
    <last_block>1439</last_block>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>NORMAL.D</filename>
      <partition>1</partition>
      <id>1</id>
      <name_type>r</name_type>
      <filesize>16898</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>3</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-14T13:56:30</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='7168' img_offset='7168' len='16898'/>
      </byte_runs>
      <hashdigest type='md5'>219846af6da1c4bc82c89e1e32cb9c97</hashdigest>
      <hashdigest type='sha1'>1dc1bf558f225012480d2d1b6845ffcab4eefd53</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>LASTPLOT.CSG</filename>
      <partition>1</partition>
      <id>2</id>
      <name_type>r</name_type>
      <filesize>5542</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>4</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-14T13:51:36</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='24576' img_offset='24576' len='5542'/>
      </byte_runs>
      <hashdigest type='md5'>0037440042ffe1b4c1471e3aa6523d5a</hashdigest>
      <hashdigest type='sha1'>583974868518045659ce63f23be3b290ff0a468b</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>KSBASE.CSS</filename>
      <partition>1</partition>
      <id>3</id>
      <name_type>r</name_type>
      <filesize>10320</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>5</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-10T14:26:04</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='30720' img_offset='30720' len='10320'/>
      </byte_runs>
      <hashdigest type='md5'>4307f44612e9bda55eb5fe9f88c73fb5</hashdigest>
      <hashdigest type='sha1'>6cb19097d48439d49bdbd0e814cae11f0e695d7e</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>MNSDKS.CSG</filename>
      <partition>1</partition>
      <id>4</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>6</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-10T15:38:10</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='41984' img_offset='41984' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>bb31bed36df1cd957641a2771f77b03a</hashdigest>
      <hashdigest type='sha1'>0269d5405a146f0dba65be1d09f06aca734e93d3</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>KSBASE.D</filename>
      <partition>1</partition>
      <id>5</id>
      <name_type>r</name_type>
      <filesize>5814</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>7</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-11T16:36:50</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='48128' img_offset='48128' len='5814'/>
      </byte_runs>
      <hashdigest type='md5'>f638b9069b60f1380775905a46575084</hashdigest>
      <hashdigest type='sha1'>56c33e1162097ba65af556e72b39d442354f0059</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>ANOVARKS.D01</filename>
      <partition>1</partition>
      <id>6</id>
      <name_type>r</name_type>
      <filesize>987</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>8</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-11T12:20:52</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='54272' img_offset='54272' len='987'/>
      </byte_runs>
      <hashdigest type='md5'>17401241a0b8806265dda32c0a530faf</hashdigest>
      <hashdigest type='sha1'>aae57aeb89c01fac1bc71d32af1e93c675547818</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>TEXT.D</filename>
      <partition>1</partition>
      <id>7</id>
      <name_type>r</name_type>
      <filesize>20217</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>9</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-14T17:17:00</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='55296' img_offset='55296' len='20217'/>
      </byte_runs>
      <hashdigest type='md5'>7840e653a0a0cac645abbbcaede6518d</hashdigest>
      <hashdigest type='sha1'>44eabdd335d6cf3c304ed5c6c0a9a88f1bb89f4f</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>KRUSKALL.D</filename>
      <partition>1</partition>
      <id>8</id>
      <name_type>r</name_type>
      <filesize>8068</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>10</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-15T12:59:20</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='75776' img_offset='75776' len='8068'/>
      </byte_runs>
      <hashdigest type='md5'>1a6f4d9b0a2f6127a30789c1e95592db</hashdigest>
      <hashdigest type='sha1'>d962bb931e143f2462a71f18164e96db1543476f</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>ASP.D01</filename>
      <partition>1</partition>
      <id>9</id>
      <name_type>r</name_type>
      <filesize>2831</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>11</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-17T10:00:18</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='83968' img_offset='83968' len='2831'/>
      </byte_runs>
      <hashdigest type='md5'>6bed62f483f7819b9ec7b7ed83b05731</hashdigest>
      <hashdigest type='sha1'>918b723766808e837c8806f31721b50deae19153</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>ASP.D</filename>
      <partition>1</partition>
      <id>10</id>
      <name_type>r</name_type>
      <filesize>17964</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>12</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-15T14:44:40</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='87040' img_offset='87040' len='17964'/>
      </byte_runs>
      <hashdigest type='md5'>e86bc70061d34d7ed3e46ae630524d1e</hashdigest>
      <hashdigest type='sha1'>f46c57e3b071b88a0fef4f55578c880a0706df89</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>KRUSKASP.D</filename>
      <partition>1</partition>
      <id>11</id>
      <name_type>r</name_type>
      <filesize>7327</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>13</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-17T10:02:08</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='105472' img_offset='105472' len='7327'/>
      </byte_runs>
      <hashdigest type='md5'>e6bbdab710170cb76f4ad6c14bc8f1da</hashdigest>
      <hashdigest type='sha1'>da9d993fa68d31d7c9bf6edecb4deba7a2c6016d</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>DISTRIKS.CSG</filename>
      <partition>1</partition>
      <id>12</id>
      <name_type>r</name_type>
      <filesize>5574</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>14</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-14T16:36:46</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='113664' img_offset='113664' len='5574'/>
      </byte_runs>
      <hashdigest type='md5'>392a922a937d956d291d509333dd9286</hashdigest>
      <hashdigest type='sha1'>87f9a74050ca0d79b3f40c6afd0f0af55fc0ef14</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>ASP.CSS</filename>
      <partition>1</partition>
      <id>13</id>
      <name_type>r</name_type>
      <filesize>2720</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>15</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-15T14:31:02</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='119808' img_offset='119808' len='2720'/>
      </byte_runs>
      <hashdigest type='md5'>57eb16b50eafb2e913ad86cc044a9dae</hashdigest>
      <hashdigest type='sha1'>915069d7712327a8908eb34e68665c69efd89b2d</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>ASPLOT1.CSG</filename>
      <partition>1</partition>
      <id>14</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>16</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-17T09:57:30</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='122880' img_offset='122880' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>92268f49410a8498c21fe07510956b42</hashdigest>
      <hashdigest type='sha1'>f9a459ea21d05ba09e586cc5fdd3df89712ffc6a</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>ASPLOT2.CSG</filename>
      <partition>1</partition>
      <id>15</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>17</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-17T09:58:44</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='129024' img_offset='129024' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>6701727b748287d3ed5f0138a8a60c23</hashdigest>
      <hashdigest type='sha1'>82d02abacb6013cef549c6ad3501fae98a82a3c2</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>PEYNEVAL.CSS</filename>
      <partition>1</partition>
      <id>16</id>
      <name_type>r</name_type>
      <filesize>49760</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>18</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-22T13:23:28</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='135168' img_offset='135168' len='49760'/>
      </byte_runs>
      <hashdigest type='md5'>cbdea4874611443ebcad11c1f13a0dbb</hashdigest>
      <hashdigest type='sha1'>3ea71874c3626e14f546e8d83d5f306cf2bb0116</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>MNSDSOIL.CSG</filename>
      <partition>1</partition>
      <id>17</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>19</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-14T16:48:14</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='185344' img_offset='185344' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>becd10bcaaa020e2e702d8572093d089</hashdigest>
      <hashdigest type='sha1'>7f4c900d9ef1aa2095d44bf8231670a34564fb6d</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>MNSDTEXT.CSG</filename>
      <partition>1</partition>
      <id>18</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>20</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-14T16:50:20</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='191488' img_offset='191488' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>57ab37ecc98f480ae4b8cd2d1443a60b</hashdigest>
      <hashdigest type='sha1'>399220898c84efae2dd3cbb5011b53f4db77cafd</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>DESCRIPT.D</filename>
      <partition>1</partition>
      <id>19</id>
      <name_type>r</name_type>
      <filesize>14841</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>21</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-23T10:25:16</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='197632' img_offset='197632' len='14841'/>
      </byte_runs>
      <hashdigest type='md5'>e18a93ae8dfc1978849e8346feef90b8</hashdigest>
      <hashdigest type='sha1'>cea38ed7ab6788ee9528732fc5aa888a2bd59c12</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>BDLANDUS.D</filename>
      <partition>1</partition>
      <id>20</id>
      <name_type>r</name_type>
      <filesize>59566</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>22</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-22T14:12:28</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='212992' img_offset='212992' len='59566'/>
      </byte_runs>
      <hashdigest type='md5'>47ed9f57b92d4b478dd86e1d02a85314</hashdigest>
      <hashdigest type='sha1'>1d9aa30f1cbf6a4f16a69d30c2bebd0b4f4006b6</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>BDLAND2.D</filename>
      <partition>1</partition>
      <id>21</id>
      <name_type>r</name_type>
      <filesize>2821</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>23</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-23T12:39:42</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='273408' img_offset='273408' len='2821'/>
      </byte_runs>
      <hashdigest type='md5'>ec51618f4f28face0c5fad6702bc383e</hashdigest>
      <hashdigest type='sha1'>676a3d7f1472ba7f9bc733f9ec6af0a4ff854cfe</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>ASPOP.CSS</filename>
      <partition>1</partition>
      <id>22</id>
      <name_type>r</name_type>
      <filesize>3784</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>24</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-02T12:54:44</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='276480' img_offset='276480' len='3784'/>
      </byte_runs>
      <hashdigest type='md5'>fd98050c8a53bab15863027eb2248976</hashdigest>
      <hashdigest type='sha1'>7e031bca1e1134e3a89fe6a04e02f4e1f91677f9</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>MSDBD510.CSG</filename>
      <partition>1</partition>
      <id>23</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>25</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-22T13:36:52</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='280576' img_offset='280576' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>a473745fa82b2523642c56fc37da50a2</hashdigest>
      <hashdigest type='sha1'>be4e2c38adf5cde7840fdee95c43d700fc04c9a1</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>MSDBD152.CSG</filename>
      <partition>1</partition>
      <id>24</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>26</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-22T13:51:46</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='286720' img_offset='286720' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>c04ed0ba83513863ec8459b38c6d5b27</hashdigest>
      <hashdigest type='sha1'>322aed9072796422944df1dbe7b54f75b359b4b8</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>MSDBD303.CSG</filename>
      <partition>1</partition>
      <id>25</id>
      <name_type>r</name_type>
      <filesize>5798</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>27</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-22T13:55:32</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='292864' img_offset='292864' len='5798'/>
      </byte_runs>
      <hashdigest type='md5'>f3d67b980d582c520a98808f533254fe</hashdigest>
      <hashdigest type='sha1'>651951438c838ecf1cdf43109e6ea372f6f475b0</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>AUTOCOR.D</filename>
      <partition>1</partition>
      <id>26</id>
      <name_type>r</name_type>
      <filesize>8294</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>28</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-30T10:59:22</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='299008' img_offset='299008' len='8294'/>
      </byte_runs>
      <hashdigest type='md5'>3e8a5f484b082abc7a5f3dfdf31c250d</hashdigest>
      <hashdigest type='sha1'>608b14fd63999318c18a7b799dda1cf49c226867</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>PEYNEVAL.QML</filename>
      <partition>1</partition>
      <id>27</id>
      <name_type>r</name_type>
      <filesize>51</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>29</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1996-10-30T16:04:24</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='309248' img_offset='309248' len='51'/>
      </byte_runs>
      <hashdigest type='md5'>1900baaa0130b04016000fbce4b52177</hashdigest>
      <hashdigest type='sha1'>36dbfde2eea8676bc98674631285a4b463cce262</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>HEPRCOR.SCR</filename>
      <partition>1</partition>
      <id>28</id>
      <name_type>r</name_type>
      <filesize>2400</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>30</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1997-02-20T07:21:10</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='308224' img_offset='308224' len='1024'/>
       <byte_run file_offset='1024' fs_offset='310272' img_offset='310272' len='1376'/>
      </byte_runs>
      <hashdigest type='md5'>3fd545722fd5408688b67d1055fcc1c3</hashdigest>
      <hashdigest type='sha1'>027cc447e30df749a867132d9811b08fe3f18eaa</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>PRCR2.SCR</filename>
      <partition>1</partition>
      <id>29</id>
      <name_type>r</name_type>
      <filesize>1755</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>31</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1997-02-20T06:04:22</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='312320' img_offset='312320' len='1755'/>
      </byte_runs>
      <hashdigest type='md5'>b4c4cc350b454affa3e91a69e4524c73</hashdigest>
      <hashdigest type='sha1'>534ca78b56b71cd3710ca4f403e2446767b74fce</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>PRECCOR.SCR</filename>
      <partition>1</partition>
      <id>30</id>
      <name_type>r</name_type>
      <filesize>7619</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>32</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1997-02-20T05:37:14</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='314368' img_offset='314368' len='7619'/>
      </byte_runs>
      <hashdigest type='md5'>ddf35b40dbedb291d54b7f55dbf66877</hashdigest>
      <hashdigest type='sha1'>6ac1a0ba8f1bbaf93e7e916b596d74d2ba1d1305</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>PRECCOR.STG</filename>
      <partition>1</partition>
      <id>31</id>
      <name_type>r</name_type>
      <filesize>8321</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>33</inode>
      <meta_type>1</meta_type>
      <mode>511</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <mtime prec="2">1997-02-20T05:55:00</mtime>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='322560' img_offset='322560' len='8321'/>
      </byte_runs>
      <hashdigest type='md5'>36f9f89af8d6c6d2ed9eb85615012927</hashdigest>
      <hashdigest type='sha1'>7678b0bf7bdc370ea2108efd4fbc4ee67f0e893d</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$MBR</filename>
      <partition>1</partition>
      <id>32</id>
      <name_type>v</name_type>
      <filesize>512</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>22931</inode>
      <meta_type>10</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='0' img_offset='0' len='512'/>
      </byte_runs>
      <hashdigest type='md5'>57bd5fe0fd1d6752a607c3639f2921d6</hashdigest>
      <hashdigest type='sha1'>1b2e0ecf3ccbc07a917c4d74f98ed3f117cc367a</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$FAT1</filename>
      <partition>1</partition>
      <id>33</id>
      <name_type>v</name_type>
      <filesize>1536</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>22932</inode>
      <meta_type>10</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='512' img_offset='512' len='1536'/>
      </byte_runs>
      <hashdigest type='md5'>9c205893c9ccd96153c8c3039a93ebdc</hashdigest>
      <hashdigest type='sha1'>1656c2b74802754dc6f00758806684e18601204b</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$FAT2</filename>
      <partition>1</partition>
      <id>34</id>
      <name_type>v</name_type>
      <filesize>1536</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>22933</inode>
      <meta_type>10</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
      <byte_runs>
       <byte_run file_offset='0' fs_offset='2048' img_offset='2048' len='1536'/>
      </byte_runs>
      <hashdigest type='md5'>9c205893c9ccd96153c8c3039a93ebdc</hashdigest>
      <hashdigest type='sha1'>1656c2b74802754dc6f00758806684e18601204b</hashdigest>
    </fileobject>
    <fileobject>
      <parent_object>
        <inode>2</inode>
      </parent_object>
      <filename>$OrphanFiles</filename>
      <partition>1</partition>
      <id>35</id>
      <name_type>V</name_type>
      <filesize>0</filesize>
      <alloc>1</alloc>
      <used>1</used>
      <inode>22934</inode>
      <meta_type>11</meta_type>
      <mode>0</mode>
      <nlink>1</nlink>
      <uid>0</uid>
      <gid>0</gid>
    </fileobject>
  </volume>
<!-- end of volume -->
<!-- clock: 0.013758 -->
  <rusage>
    <utime>0.026134</utime>
    <stime>0.007466</stime>
    <maxrss>13968</maxrss>
    <minflt>1202</minflt>
    <majflt>0</majflt>
    <nswap>0</nswap>
    <inblock>0</inblock>
    <oublock>56</oublock>
    <clocktime>0.013758</clocktime>
<!-- stop_time: Wed Sep 28 18:56:51 2022 -->
  </rusage>
</dfxml>
bitsgalore commented 1 year ago

Or use the Python implementation:

https://github.com/dfxml-working-group/dfxml_python

Install (no PyPi package exists):

  1. git clone https://github.com/dfxml-working-group/dfxml_python.git (or download and extract ZIP file from here)
  2. cd dfxml_python
  3. pip3 install --user . 
    
Result:
Successfully built dfxml
Installing collected packages: dfxml
Successfully installed dfxml-1.0.2

Problem is that it's no clear to me how to invoke it within Python, and my first attempt doesn't work:

https://github.com/dfxml-working-group/dfxml_python/issues/39

bitsgalore commented 1 year ago

Now works https://github.com/KBNLresearch/ipmlab/commit/d39319a4afc29e81d5d8c40e60c93cd4ebb78fe4. Note that this solution will fail for large disk images as per comments here (OK for floppies though).