DFXML Example: source tag - Revision history

Simsong: moved Source DFXML Example to DFXML Example: source tag

2012-06-12T14:48:28Z

moved Source DFXML Example to DFXML Example: source tag

Simsong at 00:48, 18 July 2011

2011-07-18T00:48:44Z

Simsong at 00:48, 18 July 2011

2011-07-18T00:48:13Z

Cgrenier: Fix typo

2011-04-27T15:09:47Z

Fix typo

Simsong at 12:54, 27 April 2011

2011-04-27T12:54:39Z

Simsong: Created page with "The '''<source>''' tag is used to introduce the source of forensic data. Currently we are using these for disk images, as the example below illustrates:

 
2011-04-27T12:46:40Z
Created page with "The '''<source>''' tag is used to introduce the source of forensic data. Currently we are using these for disk images, as the example below illustrates:  <pre> <source type..."
New page
The '''&lt;source&gt;''' tag is used to introduce the source of forensic data. Currently we are using these for disk images, as the example below illustrates:



<pre>

<source type='Disk Image'>

  <imagefile>/corp/images/nus/1040.aff</imagefile>

  <sectorsize>512</sectorsize>

  <device_model>SEAGATE ST32550W SUN2.1G 0418</device_model>

  <device_sn>01806486</device_sn>

  <acquisition_commandline>aimage scsi1 /project2/b28.aff</acquisition_commandline>

  <acquisition_device>/dev/da1</acquisition_device>

  <device_capabilities>pass2: &gt;SEAGATE ST32550W SUN2.1G 0418&lt; Fixed Direct Access SCSI-2 device 

pass2: Serial Number 01806486

pass2: 20.000MB/s transfers (10.000MHz, offset 15, 16bit), Tagged Queueing Enabled

  </device_capabilities>

  <sectorsize coding='base10'>512</sectorsize>

  <devicesectors coding='base10'>4194995</devicesectors>

  <acquisition_macaddr>00:0f:b5:42:6a:fe</acquisition_macaddr>

  <acquisition_date>2006-07-25T10:56:42</acquisition_date>

</source>

</pre>



After the '''source''' tag you may find some '''fileobject''' tags. They may be grouped within a '''volume''' tag:



<pre>

  <volume offset='32256'>

    <Partition_Offset>32256</Partition_Offset>

    <block_size>4096</block_size>

    <ftype>1</ftype>

    <ftype_str>ntfs</ftype_str>

    <block_count>4980142</block_count>

    <first_block>0</first_block>

    <last_block>4980141</last_block>

    <fileobject>

    ...

    </fileobject>

  </volume>

</pre>



==Coding==

Coding is assumed to be in base10, except for hash codes, which are assumed to be base16.

@@ Line 39: / Line 39: @@
 </pre>
-[[Category:DFXML]]
+[[Category:Digital Forensics XML]]
 ==Coding==
 Coding is assumed to be in base10, except for hash codes, which are assumed to be base16.