fs_offset

< dfxml xmlns = "http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc = "http://purl.org/dc/elements/1.1/" version = "1.1.1" >

[...]

< metadata>

< dc:type>

Sample

</ dc:type>

</ metadata>

< creator>

< program>

vi

</ program>

< version>

8.0

</ version>

< build_environment>

< compiler>

GCC 4.6

</ compiler>

</ build_environment>

< execution_environment>

< command_line>

vi difference_test_2.xml

</ command_line>

</ execution_environment>

</ creator>

< source>

< image_filename>

/dev/null

</ image_filename>

</ source>

< volume offset = "1048576" >

< partition_offset>

1048576

</ partition_offset>

< sector_size>

512

</ sector_size>

< block_size>

4096

</ block_size>

< ftype_str>

FAT16

</ ftype_str>

< fileobject>

< filename>

CHANGE___move_from_P1M_to_P3G

</ filename>

< partition>

1

</ partition>

< filesize>

4097

</ filesize>