dfxml:alloc 

"1" implies the file was found in an allocated state. Unallocated discovery
can be shown with a "0" here, or using the unalloc element.

Element Information

Model

Used By

Complex Type dfxml:fileobject_type

Source 

<xs:element name="alloc" type="dfxml:bool01">
  <xs:annotation>
    <xs:documentation>"1" implies the file was found in an allocated state. Unallocated discovery can be shown with a "0" here, or using the unalloc element.</xs:documentation>
  </xs:annotation>
</xs:element>

Sample

< fileobject xmlns = "http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" >

< filename>

NO_CHANGE

</ filename>

< partition>

1

</ partition>

< filesize>

4097

</ filesize>

< alloc>

1

</ alloc>

< inode>

3

</ inode>

< mtime>

2007-08-09T12:34:56Z

</ mtime>

< atime>

2007-08-09T12:34:56Z

</ atime>

< crtime>

2007-08-09T12:34:56Z

</ crtime>

< hashdigest type = "sha1" >

3000000000000000000000000000000000000000

</ hashdigest>

</ fileobject>