type 

This attribute is used to denote whether the file's contents are
resident in the file metadata structure. The SleuthKit uses this to denote residency in
the NTFS MFT entry, using the corresponding flags "TSK_FS_ATTR_RES" to denote a resident
file, and "TSK_FS_BLOCK_FLAG_RES" for the data block.

Attribute Information

Used By

Element dfxml:byte_run

Source 

<xs:attribute name="type" type="xs:string">
  <xs:annotation>
    <xs:documentation>This attribute is used to denote whether the file's contents are resident in the file metadata structure. The SleuthKit uses this to denote residency in the NTFS MFT entry, using the corresponding flags "TSK_FS_ATTR_RES" to denote a resident file, and "TSK_FS_BLOCK_FLAG_RES" for the data block.</xs:documentation>
  </xs:annotation>
</xs:attribute>

Sample

< fileobject xmlns = "http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" >

< filename>

CHANGE___move_from_P1M_to_P3G

</ filename>

< partition>

1

</ partition>

< filesize>

4097

</ filesize>

< inode>

3

</ inode>

< mtime>

2007-08-09T12:34:56Z

</ mtime>

< atime>

2007-08-09T12:34:56Z

</ atime>

< crtime>

2007-08-09T12:34:56Z

</ crtime>

< hashdigest type = "sha1" >

0000000000000000000000000000000000000000

</ hashdigest>

</ fileobject>