dfxml:fileobject 

A file and its metadata. Byte-location information should be recorded when
possible. Note that due to restrictions of element repetitions in XML Schema 1.0's "all" and
"sequence" specificiers, the fileobject definition requires children appear in the order as
generated by an exemplar utility (Fiwalk for now).

Element Information

Model

ANY element from ANY namespace OTHER than 'http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' , dfxml:parent_object{0,1} , dfxml:filename* , dfxml:error{0,1} , dfxml:partition{0,1} , dfxml:id{0,1} , dfxml:name_type{0,1} , dfxml:filesize{0,1} , dfxml:unalloc{0,1} , dfxml:alloc{0,1} , dfxml:used{0,1} , dfxml:unused{0,1} , dfxml:orphan{0,1} , dfxml:compressed{0,1} , dfxml:inode{0,1} , dfxml:meta_type{0,1} , dfxml:mode{0,1} , dfxml:nlink{0,1} , dfxml:uid{0,1} , dfxml:gid{0,1} , dfxml:mtime{0,1} , dfxml:ctime{0,1} , dfxml:atime{0,1} , dfxml:crtime{0,1} , dfxml:seq{0,1} , dfxml:dtime{0,1} , dfxml:bkup_time{0,1} , dfxml:link_target{0,1} , dfxml:libmagic{0,1} , ANY element from ANY namespace OTHER than 'http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' , dfxml:byte_runs{0,1} , dfxml:hashdigest* , ANY element from ANY namespace OTHER than 'http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
Children: dfxml:alloc, dfxml:atime, dfxml:bkup_time, dfxml:byte_runs, dfxml:compressed, dfxml:crtime, dfxml:ctime, dfxml:dtime, dfxml:error, dfxml:filename, dfxml:filesize, dfxml:gid, dfxml:hashdigest, dfxml:id, dfxml:inode, dfxml:libmagic, dfxml:link_target, dfxml:meta_type, dfxml:mode, dfxml:mtime, dfxml:name_type, dfxml:nlink, dfxml:orphan, dfxml:parent_object, dfxml:partition, dfxml:seq, dfxml:uid, dfxml:unalloc, dfxml:unused, dfxml:used

Attributes

Used By

Elements dfxml:dfxml, dfxml:volume

Source 

<xs:element name="fileobject" type="dfxml:fileobject_type">
  <xs:annotation>
    <xs:documentation>A file and its metadata. Byte-location information should be recorded when possible. Note that due to restrictions of element repetitions in XML Schema 1.0's "all" and "sequence" specificiers, the fileobject definition requires children appear in the order as generated by an exemplar utility (Fiwalk for now).</xs:documentation>
  </xs:annotation>
</xs:element>

Sample

< volume xmlns = "http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" offset = "1048576" >

< partition_offset>

1048576

</ partition_offset>

< sector_size>

512

</ sector_size>

< block_size>

4096

</ block_size>

< ftype_str>

FAT16

</ ftype_str>

< fileobject>

< filename>

CHANGE___move_from_P1M_to_P3G

</ filename>

< partition>

1

</ partition>

< filesize>

4097

</ filesize>

< inode>

3

</ inode>

< mtime>

2007-08-09T12:34:56Z

</ mtime>

< atime>

2007-08-09T12:34:56Z

</ atime>

< crtime>

2007-08-09T12:34:56Z

</ crtime>

< hashdigest type = "sha1" >

0000000000000000000000000000000000000000