Esempi DFXML

I seguenti esempi sono stati creati con IsoBuster 4.1, utilizzando la funzionalità 'Struttura delle cartelle e informazioni sui file', la quale consente di esportare elenchi di file e report utilizzando il layout predefinito mostrato qui.

Da file system UDF di un semplice CD

Questo particolare esempio è stato preso da un semplice CD, a partire dal file system UDF.

<?xml version="1.0" encoding='UTF-8' ?> <dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'> <metadata> <dc:type>CD</dc:type> </metadata> <creator> <program>IsoBuster</program> <version>4.1.0.00</version> <execution_environment> <start_time>14/12/2017 04:38:32</start_time> <os_version>Windows 10 (2.10.0.15063)</os_version> <username>Peter</username> </execution_environment> </creator> <source> <device_model>HL-DT-ST DVDRAM GUE1N</device_model> <image_filename></image_filename> <image_size></image_size> <sectorsize>2048</sectorsize> <devicesectors coding='base10'>6016</devicesectors> </source> <volume> <ftype_str>UDF</ftype_str> <partition_offset>0</partition_offset> <fileobject> <filename>\AUTORUN.INF</filename> <name_type>r</name_type> <filesize>131</filesize> <alloc>1</alloc> <inode>267</inode> <mtime>01/08/2003 15:32:30</mtime> <hfs:HFStype_creator>INF File/ImgBurn</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='555008' len='131' /> </byte_runs> </fileobject> <fileobject> <filename>\Install.exe</filename> <name_type>r</name_type> <filesize>11624920</filesize> <alloc>1</alloc> <inode>268</inode> <mtime>13/12/2017 00:00:51</mtime> <hfs:HFStype_creator>EXE File/ImgBurn</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='557056' len='11624920' /> </byte_runs> </fileobject> <fileobject> <filename>\IsoBuster.ico</filename> <name_type>r</name_type> <filesize>105303</filesize> <alloc>1</alloc> <inode>269</inode> <mtime>16/12/2008 17:19:52</mtime> <hfs:HFStype_creator>ICO File/ImgBurn</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='12183552' len='105303' /> </byte_runs> </fileobject> <fileobject> <filename>\Online.html</filename> <name_type>r</name_type> <filesize>1881</filesize> <alloc>1</alloc> <inode>270</inode> <mtime>22/06/2016 14:31:40</mtime> <hfs:HFStype_creator>HTML File/ImgBurn</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='12290048' len='1881' /> </byte_runs> </fileobject> </volume> <runstats> <stop_time>14/12/2017 04:38:32</stop_time> <clock_seconds>0</clock_seconds> </runstats> </dfxml>

Da file immagine VHDX formattato NTFS

Questo particolare esempio è stato preso da un file immagine di una penna USB formattata NTFS e mostra sia i file frammentati (estensioni multiple), sia i flussi dati alternativi (Alternate Data Streams, ADS o semplicemente 'Flussi') allegati ai file e alle cartelle.

<?xml version="1.0" encoding='UTF-8' ?> <dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance' xmlns:dc='http://purl.org/dc/elements/1.1/' xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'> <metadata> <dc:type>Image File</dc:type> </metadata> <creator> <program>IsoBuster</program> <version>4.1.0.00</version> <execution_environment> <start_time>14/12/2017 04:40:10</start_time> <os_version>Windows 10 (2.10.0.15063)</os_version> <username>Peter</username> </execution_environment> </creator> <source> <device_model>Thumb drive.vhdx</device_model> <image_filename>C:\Users\Peter\Desktop\Thumb drive.vhdx</image_filename> <image_size>440401920</image_size> <sectorsize>512</sectorsize> <devicesectors coding='base10'>4194304</devicesectors> </source> <volume> <ftype_str>NTFS</ftype_str> <partition_offset>33619968</partition_offset> <fileobject> <filename>\$Extend</filename> <name_type>d</name_type> <filesize>536</filesize> <alloc>1</alloc> <inode>11</inode> <mtime>14/12/2017 04:20:47</mtime> <byte_runs> <byte_run img_offset='737573888' len='536' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$Deleted</filename> <name_type>d</name_type> <filesize>32</filesize> <alloc>1</alloc> <inode>29</inode> <mtime>14/12/2017 04:20:48</mtime> <byte_runs> <byte_run img_offset='737592320' len='32' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$ObjId</filename> <name_type>r</name_type> <filesize>0</filesize> <alloc>1</alloc> <inode>25</inode> <mtime>14/12/2017 04:20:48</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='0' len='0' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$Quota</filename> <name_type>r</name_type> <filesize>0</filesize> <alloc>1</alloc> <inode>24</inode> <mtime>14/12/2017 04:20:48</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='0' len='0' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$Reparse</filename> <name_type>r</name_type> <filesize>0</filesize> <alloc>1</alloc> <inode>26</inode> <mtime>14/12/2017 04:20:48</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='0' len='0' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata</filename> <name_type>d</name_type> <filesize>320</filesize> <alloc>1</alloc> <inode>27</inode> <mtime>14/12/2017 04:20:48</mtime> <byte_runs> <byte_run img_offset='737590272' len='320' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata\$Repair</filename> <name_type>r</name_type> <filesize>0</filesize> <alloc>1</alloc> <inode>28</inode> <mtime>14/12/2017 04:20:48</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='0' len='0' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\$Extend\$RmMetadata\$Repair:$Config</filename> <name_type>-</name_type> <filesize>8</filesize> <alloc>1</alloc> <inode>28</inode> <mtime>14/12/2017 04:20:48</mtime> <byte_runs> <byte_run img_offset='737591296' len='8' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata\$Txf</filename> <name_type>d</name_type> <filesize>32</filesize> <alloc>1</alloc> <inode>31</inode> <mtime>14/12/2017 04:20:48</mtime> <byte_runs> <byte_run img_offset='737594368' len='32' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata\$TxfLog</filename> <name_type>d</name_type> <filesize>552</filesize> <alloc>1</alloc> <inode>30</inode> <mtime>14/12/2017 04:20:48</mtime> <byte_runs> <byte_run img_offset='737593344' len='552' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata\$TxfLog\$Tops</filename> <name_type>r</name_type> <filesize>100</filesize> <alloc>1</alloc> <inode>32</inode> <mtime>14/12/2017 04:20:48</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737595392' len='100' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\$Extend\$RmMetadata\$TxfLog\$Tops:$T</filename> <name_type>-</name_type> <filesize>1048576</filesize> <alloc>1</alloc> <inode>32</inode> <mtime>14/12/2017 04:20:48</mtime> <byte_runs> <byte_run img_offset='731504640' len='1048576' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf</filename> <name_type>r</name_type> <filesize>65536</filesize> <alloc>1</alloc> <inode>33</inode> <mtime>14/12/2017 04:34:17</mtime> <hfs:HFStype_creator>BLF File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='732553216' len='65536' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog1</filename> <name_type>r</name_type> <filesize>2097152</filesize> <alloc>1</alloc> <inode>34</inode> <mtime>14/12/2017 04:34:17</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='732618752' len='2097152' /> </byte_runs> </fileobject> <fileobject> <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog2</filename> <name_type>r</name_type> <filesize>2097152</filesize> <alloc>1</alloc> <inode>35</inode> <mtime>14/12/2017 04:34:17</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='734715904' len='2097152' /> </byte_runs> </fileobject> <fileobject> <filename>\$RECYCLE.BIN</filename> <name_type>d</name_type> <filesize>208</filesize> <alloc>1</alloc> <inode>39</inode> <mtime>14/12/2017 04:21:45</mtime> <byte_runs> <byte_run img_offset='737602560' len='208' /> </byte_runs> </fileobject> <fileobject> <filename>\$RECYCLE.BIN\S-1-5-21-1419736714</filename> <name_type>d</name_type> <filesize>552</filesize> <alloc>1</alloc> <inode>40</inode> <mtime>14/12/2017 04:32:18</mtime> <byte_runs> <byte_run img_offset='737603584' len='552' /> </byte_runs> </fileobject> <fileobject> <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IIKZQZA</filename> <name_type>r</name_type> <filesize>74</filesize> <alloc>1</alloc> <inode>56</inode> <mtime>14/12/2017 04:32:18</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737619968' len='74' /> </byte_runs> </fileobject> <fileobject> <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IW8ACSL</filename> <name_type>r</name_type> <filesize>72</filesize> <alloc>1</alloc> <inode>55</inode> <mtime>14/12/2017 04:32:18</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737618944' len='72' /> </byte_runs> </fileobject> <fileobject> <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RIKZQZA</filename> <name_type>d</name_type> <filesize>32</filesize> <alloc>1</alloc> <inode>45</inode> <mtime>20/11/2017 22:49:35</mtime> <byte_runs> <byte_run img_offset='737608704' len='32' /> </byte_runs> </fileobject> <fileobject> <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RW8ACSL</filename> <name_type>d</name_type> <filesize>32</filesize> <alloc>1</alloc> <inode>52</inode> <mtime>20/11/2017 22:46:56</mtime> <byte_runs> <byte_run img_offset='737615872' len='32' /> </byte_runs> </fileobject> <fileobject> <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\desktop.ini</filename> <name_type>r</name_type> <filesize>129</filesize> <alloc>1</alloc> <inode>41</inode> <mtime>14/12/2017 04:21:45</mtime> <hfs:HFStype_creator>INI File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737604608' len='129' /> </byte_runs> </fileobject> <fileobject> <filename>\Compressed Folder</filename> <name_type>d</name_type> <filesize>456</filesize> <alloc>1</alloc> <inode>43</inode> <mtime>14/12/2017 04:31:48</mtime> <byte_runs> <byte_run img_offset='737606656' len='456' /> </byte_runs> </fileobject> <fileobject> <filename>\Compressed Folder\IsoBuster.exe</filename> <name_type>r</name_type> <filesize>7948184</filesize> <alloc>1</alloc> <inode>53</inode> <mtime>12/12/2017 23:57:56</mtime> <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='345038848' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='345104384' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='345169920' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='345235456' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='345300992' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='345366528' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='345432064' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='345497600' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='345563136' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='345628672' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='345694208' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='345759744' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='345825280' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='345890816' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='345956352' len='32768' /> <byte_run img_offset='0' len='32768' /> <byte_run img_offset='346021888' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='346087424' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346152960' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346218496' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='346284032' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346349568' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='346415104' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='346480640' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346546176' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346611712' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='346677248' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346742784' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346808320' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346873856' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='346939392' len='32768' /> <byte_run img_offset='0' len='32768' /> <byte_run img_offset='347004928' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='347070464' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='347136000' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='347201536' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='347267072' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='347332608' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='347398144' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='347463680' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='347529216' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='347594752' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='347660288' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='347725824' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='347791360' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='347856896' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='347922432' len='53248' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='347987968' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='348053504' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='348119040' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='348184576' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='348250112' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='348315648' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='348381184' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='348446720' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='348512256' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='348577792' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='348643328' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='348708864' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='348774400' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='348839936' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='348905472' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='348971008' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='349036544' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='349102080' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='349167616' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='349233152' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='349298688' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='349364224' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='349429760' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='349495296' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='349560832' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='349626368' len='12288' /> <byte_run img_offset='0' len='53248' /> <byte_run img_offset='349691904' len='4096' /> <byte_run img_offset='0' len='61440' /> <byte_run img_offset='349757440' len='32768' /> <byte_run img_offset='0' len='32768' /> <byte_run img_offset='349822976' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='349888512' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='349954048' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='350019584' len='32768' /> <byte_run img_offset='0' len='32768' /> <byte_run img_offset='350085120' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='350150656' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='350216192' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='350281728' len='32768' /> <byte_run img_offset='0' len='32768' /> <byte_run img_offset='350347264' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='350412800' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='350478336' len='118784' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='350609408' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='350674944' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='350740480' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='350806016' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='350871552' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='350937088' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='351002624' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='351068160' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='351133696' len='16384' /> <byte_run img_offset='0' len='49152' /> <byte_run img_offset='351199232' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='351264768' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='351330304' len='53248' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='351395840' len='57344' /> <byte_run img_offset='0' len='8192' /> <byte_run img_offset='351461376' len='53248' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='351526912' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='351592448' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='351657984' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='351723520' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='351789056' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='351854592' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='351920128' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='351985664' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='352051200' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='352116736' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='352182272' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='352247808' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='352313344' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='352378880' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='352444416' len='16384' /> <byte_run img_offset='0' len='49152' /> <byte_run img_offset='352509952' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='352575488' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='352641024' len='45056' /> <byte_run img_offset='0' len='20480' /> <byte_run img_offset='352706560' len='184320' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='352903168' len='49152' /> <byte_run img_offset='0' len='16384' /> <byte_run img_offset='33771520' len='16384' /> <byte_run img_offset='0' len='49152' /> </byte_runs> </fileobject> <fileobject> <filename>\Compressed Folder\Links.zip</filename> <name_type>r</name_type> <filesize>3448</filesize> <alloc>1</alloc> <inode>49</inode> <mtime>15/10/2014 13:57:07</mtime> <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='42442752' len='4096' /> <byte_run img_offset='0' len='61440' /> </byte_runs> </fileobject> <fileobject> <filename>\Compressed Folder\logo.eps</filename> <name_type>r</name_type> <filesize>294221</filesize> <alloc>1</alloc> <inode>47</inode> <mtime>08/08/2003 21:22:42</mtime> <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='42250240' len='28672' /> <byte_run img_offset='0' len='36864' /> <byte_run img_offset='42315776' len='40960' /> <byte_run img_offset='0' len='24576' /> <byte_run img_offset='42381312' len='61440' /> <byte_run img_offset='0' len='4096' /> <byte_run img_offset='42446848' len='53248' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='737308672' len='16384' /> <byte_run img_offset='0' len='49152' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Compressed Folder\logo.eps:AFP_AfpInfo</filename> <name_type>-</name_type> <filesize>60</filesize> <alloc>1</alloc> <inode>47</inode> <mtime>08/08/2003 21:22:42</mtime> <byte_runs> <byte_run img_offset='737610752' len='60' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Compressed Folder\logo.eps:AFP_Resource</filename> <name_type>-</name_type> <filesize>197056</filesize> <alloc>1</alloc> <inode>47</inode> <mtime>08/08/2003 21:22:42</mtime> <byte_runs> <byte_run img_offset='42577920' len='24576' /> <byte_run img_offset='0' len='40960' /> <byte_run img_offset='42643456' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='42708992' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='42774528' len='4096' /> <byte_run img_offset='0' len='61440' /> </byte_runs> </fileobject> <fileobject> <filename>\Compressed Folder\Video.mp4</filename> <name_type>r</name_type> <filesize>151132575</filesize> <alloc>1</alloc> <inode>48</inode> <mtime>16/04/2014 10:33:57</mtime> <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='42778624' len='12288' /> <byte_run img_offset='0' len='53248' /> <byte_run img_offset='42844160' len='12288' /> <byte_run img_offset='0' len='53248' /> <byte_run img_offset='42909696' len='12288' /> <byte_run img_offset='0' len='53248' /> <byte_run img_offset='42975232' len='20480' /> <byte_run img_offset='0' len='45056' /> <byte_run img_offset='43040768' len='53248' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='43106304' len='53248' /> <byte_run img_offset='0' len='12288' /> <byte_run img_offset='43171840' len='32768' /> <byte_run img_offset='0' len='32768' /> <byte_run img_offset='43237376' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='43302912' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='43368448' len='36864' /> <byte_run img_offset='0' len='28672' /> <byte_run img_offset='43433984' len='150470656' /> <byte_run img_offset='42356736' len='8192' /> <byte_run img_offset='0' len='57344' /> </byte_runs> </fileobject> <fileobject> <filename>\Folder</filename> <name_type>d</name_type> <filesize>456</filesize> <alloc>1</alloc> <inode>44</inode> <mtime>14/12/2017 04:31:52</mtime> <byte_runs> <byte_run img_offset='737607680' len='456' /> </byte_runs> </fileobject> <fileobject> <filename>\Folder\IsoBuster.exe</filename> <name_type>r</name_type> <filesize>7948184</filesize> <alloc>1</alloc> <inode>54</inode> <mtime>12/12/2017 23:57:56</mtime> <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='353034240' len='7948184' /> </byte_runs> </fileobject> <fileobject> <filename>\Folder\Links.zip</filename> <name_type>r</name_type> <filesize>3448</filesize> <alloc>1</alloc> <inode>50</inode> <mtime>15/10/2014 13:57:07</mtime> <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='43094016' len='3448' /> </byte_runs> </fileobject> <fileobject> <filename>\Folder\logo.eps</filename> <name_type>r</name_type> <filesize>294221</filesize> <alloc>1</alloc> <inode>46</inode> <mtime>08/08/2003 21:22:42</mtime> <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='41754624' len='294221' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Folder\logo.eps:AFP_AfpInfo</filename> <name_type>-</name_type> <filesize>60</filesize> <alloc>1</alloc> <inode>46</inode> <mtime>08/08/2003 21:22:42</mtime> <byte_runs> <byte_run img_offset='737609728' len='60' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Folder\logo.eps:AFP_Resource</filename> <name_type>-</name_type> <filesize>197056</filesize> <alloc>1</alloc> <inode>46</inode> <mtime>08/08/2003 21:22:42</mtime> <byte_runs> <byte_run img_offset='42049536' len='197056' /> </byte_runs> </fileobject> <fileobject> <filename>\Folder\Video.mp4</filename> <name_type>r</name_type> <filesize>151132575</filesize> <alloc>1</alloc> <inode>51</inode> <mtime>16/04/2014 10:33:57</mtime> <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='193904640' len='151132575' /> </byte_runs> </fileobject> <fileobject> <filename>\Folder with Stream</filename> <name_type>d</name_type> <filesize>32</filesize> <alloc>1</alloc> <inode>57</inode> <mtime>20/11/2017 22:46:56</mtime> <byte_runs> <byte_run img_offset='737620992' len='32' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Folder with Stream\Folder with Stream:Text_In_Stream.txt</filename> <name_type>-</name_type> <filesize>25</filesize> <alloc>1</alloc> <inode>57</inode> <mtime>20/11/2017 22:46:56</mtime> <byte_runs> <byte_run img_offset='737620992' len='25' /> </byte_runs> </fileobject> <fileobject> <filename>\Folder with Streams</filename> <name_type>d</name_type> <filesize>32</filesize> <alloc>1</alloc> <inode>58</inode> <mtime>20/11/2017 22:49:35</mtime> <byte_runs> <byte_run img_offset='737622528' len='32' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Folder with Streams\Folder with Streams:Text_In_Stream.txt</filename> <name_type>-</name_type> <filesize>25</filesize> <alloc>1</alloc> <inode>58</inode> <mtime>20/11/2017 22:49:35</mtime> <byte_runs> <byte_run img_offset='737622016' len='25' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Folder with Streams\Folder with Streams:Text_In_Stream2.txt</filename> <name_type>-</name_type> <filesize>29</filesize> <alloc>1</alloc> <inode>58</inode> <mtime>20/11/2017 22:49:35</mtime> <byte_runs> <byte_run img_offset='737622016' len='29' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Folder with Streams\Folder with Streams:Text_In_Stream3.txt</filename> <name_type>-</name_type> <filesize>37</filesize> <alloc>1</alloc> <inode>58</inode> <mtime>20/11/2017 22:49:35</mtime> <byte_runs> <byte_run img_offset='43098112' len='37' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\Folder with Streams\Folder with Streams:Text_In_Stream4.txt</filename> <name_type>-</name_type> <filesize>41</filesize> <alloc>1</alloc> <inode>58</inode> <mtime>20/11/2017 22:49:35</mtime> <byte_runs> <byte_run img_offset='43102208' len='41' /> </byte_runs> </fileobject> <fileobject> <filename>\System Volume Information</filename> <name_type>d</name_type> <filesize>144</filesize> <alloc>1</alloc> <inode>36</inode> <mtime>14/12/2017 04:21:16</mtime> <byte_runs> <byte_run img_offset='737599488' len='144' /> </byte_runs> </fileobject> <fileobject> <filename>\System Volume Information\WPSettings.dat</filename> <name_type>r</name_type> <filesize>12</filesize> <alloc>1</alloc> <inode>37</inode> <mtime>14/12/2017 04:21:16</mtime> <hfs:HFStype_creator>DAT File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737600512' len='12' /> </byte_runs> </fileobject> <fileobject> <filename>\$AttrDef</filename> <name_type>r</name_type> <filesize>2560</filesize> <alloc>1</alloc> <inode>4</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='731500544' len='2560' /> </byte_runs> </fileobject> <fileobject> <filename>\$BadClus</filename> <name_type>r</name_type> <filesize>0</filesize> <alloc>1</alloc> <inode>8</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737570816' len='0' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\$BadClus:$Bad</filename> <name_type>-</name_type> <filesize>2111827968</filesize> <alloc>1</alloc> <inode>8</inode> <mtime>14/12/2017 04:20:47</mtime> <byte_runs> <byte_run img_offset='0' len='2111827968' /> </byte_runs> </fileobject> <fileobject> <filename>\$Bitmap</filename> <name_type>r</name_type> <filesize>64448</filesize> <alloc>1</alloc> <inode>6</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737488896' len='64448' /> </byte_runs> </fileobject> <fileobject> <filename>\$Boot</filename> <name_type>r</name_type> <filesize>8192</filesize> <alloc>1</alloc> <inode>7</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='33619968' len='8192' /> </byte_runs> </fileobject> <fileobject> <filename>\$LogFile</filename> <name_type>r</name_type> <filesize>6324224</filesize> <alloc>1</alloc> <inode>2</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='724840448' len='6324224' /> </byte_runs> </fileobject> <fileobject> <filename>\$MFT</filename> <name_type>r</name_type> <filesize>262144</filesize> <alloc>1</alloc> <inode>0</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737562624' len='262144' /> </byte_runs> </fileobject> <fileobject> <filename>\$MFTMirr</filename> <name_type>r</name_type> <filesize>4096</filesize> <alloc>1</alloc> <inode>1</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='33628160' len='4096' /> </byte_runs> </fileobject> <fileobject> <filename>\$Secure</filename> <name_type>r</name_type> <filesize>0</filesize> <alloc>1</alloc> <inode>9</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='0' len='0' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\$Secure:$SDS</filename> <name_type>-</name_type> <filesize>264668</filesize> <alloc>1</alloc> <inode>9</inode> <mtime>14/12/2017 04:20:47</mtime> <byte_runs> <byte_run img_offset='731234304' len='264668' /> </byte_runs> </fileobject> <fileobject> <filename>\$UpCase</filename> <name_type>r</name_type> <filesize>131072</filesize> <alloc>1</alloc> <inode>10</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='33632256' len='131072' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\$UpCase:$Info</filename> <name_type>-</name_type> <filesize>32</filesize> <alloc>1</alloc> <inode>10</inode> <mtime>14/12/2017 04:20:47</mtime> <byte_runs> <byte_run img_offset='737572864' len='32' /> </byte_runs> </fileobject> <fileobject> <filename>\$Volume</filename> <name_type>r</name_type> <filesize>0</filesize> <alloc>1</alloc> <inode>3</inode> <mtime>14/12/2017 04:20:47</mtime> <hfs:HFStype_creator>File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='737565696' len='0' /> </byte_runs> </fileobject> <fileobject> <filename>\IsoBuster.exe</filename> <name_type>r</name_type> <filesize>7948184</filesize> <alloc>1</alloc> <inode>38</inode> <mtime>12/12/2017 23:57:56</mtime> <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='33804288' len='7948184' /> </byte_runs> </fileobject> <fileobject> <filename>\logo1.eps</filename> <name_type>r</name_type> <filesize>294221</filesize> <alloc>1</alloc> <inode>42</inode> <mtime>08/08/2003 21:22:42</mtime> <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator> <byte_runs> <byte_run img_offset='736813056' len='294221' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\logo1.eps:AFP_AfpInfo</filename> <name_type>-</name_type> <filesize>60</filesize> <alloc>1</alloc> <inode>42</inode> <mtime>08/08/2003 21:22:42</mtime> <byte_runs> <byte_run img_offset='737605632' len='60' /> </byte_runs> </fileobject> <fileobject><!--Stream or Resource Fork--> <filename>\logo1.eps:AFP_Resource</filename> <name_type>-</name_type> <filesize>197056</filesize> <alloc>1</alloc> <inode>42</inode> <mtime>08/08/2003 21:22:42</mtime> <byte_runs> <byte_run img_offset='737107968' len='197056' /> </byte_runs> </fileobject> </volume> <runstats> <stop_time>14/12/2017 04:40:11</stop_time> <clock_seconds>0</clock_seconds> </runstats> </dfxml> <!-- For more information: https://www.isobuster.com/reports -->

Altre informazioni interessanti: