DFXML Example: source tag

From ForensicsWiki
Revision as of 12:54, 27 April 2011 by Simsong (Talk | contribs)

Jump to: navigation, search

The <source> tag is used to introduce the source of forensic data. Currently we are using these for disk images, as the example below illustrates:

<source type='Disk Image'>
  <device_model>SEAGATE ST32550W SUN2.1G 0418</device_model>
  <acquisition_commandline>aimage scsi1 /project2/b28.aff</acquisition_commandline>
  <device_capabilities>pass2: >SEAGATE ST32550W SUN2.1G 0418< Fixed Direct Access SCSI-2 device 
pass2: Serial Number 01806486
pass2: 20.000MB/s transfers (10.000MHz, offset 15, 16bit), Tagged Queueing Enabled
  <sectorsize coding='base10'>512</sectorsize>
  <devicesectors coding='base10'>4194995</devicesectors>

After the source tag you may find some fileobject tags. They may be grouped within a volume tag:

  <volume offset='32256'>
      <run offset='0' len='24900705' img_offset='32256'>


Coding is assumed to be in base10, except for hash codes, which are assumed to be base16.