dfxml:volume 

A mass storage system volume, which is defined as a collection of byte
blocks that are all the same size.

Element Information

Model

ANY element from ANY namespace OTHER than 'http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' , dfxml:byte_runs* , dfxml:partition_offset{0,1} , dfxml:sector_size{0,1} , dfxml:block_size{0,1} , dfxml:ftype{0,1} , dfxml:ftype_str{0,1} , dfxml:block_count{0,1} , dfxml:first_block{0,1} , dfxml:last_block{0,1} , dfxml:allocated_only{0,1} , ANY element from ANY namespace OTHER than 'http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' , dfxml:fileobject* , dfxml:error{0,1} , ANY element from ANY namespace OTHER than 'http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
Children: dfxml:allocated_only, dfxml:block_count, dfxml:block_size, dfxml:byte_runs, dfxml:error, dfxml:fileobject, dfxml:first_block, dfxml:ftype, dfxml:ftype_str, dfxml:last_block, dfxml:partition_offset, dfxml:sector_size

Attributes

QName Type Fixed Default Use Inheritable Annotation
offset xs:nonNegativeInteger optional
Wildcard: ANY attribute from ANY namespace OTHER than 'http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'

Used By

Element dfxml:dfxml

Source 

<xs:element name="volume">
  <xs:annotation>
    <xs:documentation>A mass storage system volume, which is defined as a collection of byte blocks that are all the same size.</xs:documentation>
  </xs:annotation>
  <xs:complexType>
    <xs:sequence>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
      <xs:element ref="dfxml:byte_runs" minOccurs="0" maxOccurs="unbounded"/>
      <xs:element ref="dfxml:partition_offset" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:sector_size" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:block_size" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:ftype" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:ftype_str" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:block_count" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:first_block" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:last_block" minOccurs="0" maxOccurs="1"/>
      <xs:element ref="dfxml:allocated_only" minOccurs="0" maxOccurs="1"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
      <xs:element ref="dfxml:fileobject" minOccurs="0" maxOccurs="unbounded"/>
      <xs:element ref="dfxml:error" minOccurs="0" maxOccurs="1"/>
      <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="offset" type="xs:nonNegativeInteger"/>
    <xs:anyAttribute namespace="##other" processContents="lax"/>
  </xs:complexType>
</xs:element>

Sample

< volume xmlns = "http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" offset = "1048576" >

< partition_offset>

1048576

</ partition_offset>

< sector_size>

512

</ sector_size>

< block_size>

4096

</ block_size>

< ftype_str>

FAT16

</ ftype_str>

< fileobject>

< filename>

CHANGE___move_from_P1M_to_P3G

</ filename>

< partition>

1

</ partition>

< filesize>

4097

</ filesize>