dfxml:inode 

The inode number (st_ino from the stat(2) system call). File systems that do
not have an "Inode" may use an alternative, distinct identifier. In The SleuthKit, FAT
"Inode" numbers are calculated from the directory entry's block address; NTFS's "Inode"
numbers are the MFT entry address.

Element Information

Model

Attributes

Used By

Element dfxml:parent_object
Complex Type dfxml:fileobject_type

Source 

<xs:element name="inode" type="dfxml:nonNegativeInteger">
  <xs:annotation>
    <xs:documentation>The inode number (st_ino from the stat(2) system call). File systems that do not have an "Inode" may use an alternative, distinct identifier. In The SleuthKit, FAT "Inode" numbers are calculated from the directory entry's block address; NTFS's "Inode" numbers are the MFT entry address.</xs:documentation>
  </xs:annotation>
</xs:element>

Sample

< fileobject xmlns = "http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" >

< filename>

CHANGE___move_from_P1M_to_P3G

</ filename>

< partition>

1

</ partition>

< filesize>

4097

</ filesize>

< inode>

3

</ inode>

< mtime>

2007-08-09T12:34:56Z

</ mtime>

< atime>

2007-08-09T12:34:56Z

</ atime>

< crtime>

2007-08-09T12:34:56Z

</ crtime>

< hashdigest type = "sha1" >

0000000000000000000000000000000000000000

</ hashdigest>

</ fileobject>