Ejemplos DFXML

Estos ejemplos se crearon con IsoBuster 4.1, usando la funcionalidad anidada 'Información de árbol de carpeta y archivo', la cual exporta una lista / informe, usando el esquema predefinido indicado aquí

Desde un archivo de sistema UDF en un CD sencillo

Este ejemplo en particular ha sido sacado desde un CD muy sencillo, iniciándose desde un archivo de sistema UDF.

<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
      xmlns:dc='http://purl.org/dc/elements/1.1/'
      xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>

   <metadata>
      <dc:type>CD</dc:type>
   </metadata>

   <creator>
      <program>IsoBuster</program>
      <version>4.1.0.00</version>
      <execution_environment>
        <start_time>14/12/2017 04:38:32</start_time>
        <os_version>Windows 10 (2.10.0.15063)</os_version>
        <username>Peter</username>
      </execution_environment>
   </creator>

   <source>
       <device_model>HL-DT-ST  DVDRAM GUE1N</device_model>
       <image_filename></image_filename>
       <image_size></image_size>
       <sectorsize>2048</sectorsize>
       <devicesectors coding='base10'>6016</devicesectors>
   </source>

   <volume>
      <ftype_str>UDF</ftype_str>
      <partition_offset>0</partition_offset>

      <fileobject>
         <filename>\AUTORUN.INF</filename>
         <name_type>r</name_type>
         <filesize>131</filesize>
         <alloc>1</alloc>
         <inode>267</inode>
         <mtime>01/08/2003 15:32:30</mtime>
         <hfs:HFStype_creator>INF File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='555008' len='131' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Install.exe</filename>
         <name_type>r</name_type>
         <filesize>11624920</filesize>
         <alloc>1</alloc>
         <inode>268</inode>
         <mtime>13/12/2017 00:00:51</mtime>
         <hfs:HFStype_creator>EXE File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='557056' len='11624920' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\IsoBuster.ico</filename>
         <name_type>r</name_type>
         <filesize>105303</filesize>
         <alloc>1</alloc>
         <inode>269</inode>
         <mtime>16/12/2008 17:19:52</mtime>
         <hfs:HFStype_creator>ICO File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='12183552' len='105303' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Online.html</filename>
         <name_type>r</name_type>
         <filesize>1881</filesize>
         <alloc>1</alloc>
         <inode>270</inode>
         <mtime>22/06/2016 14:31:40</mtime>
         <hfs:HFStype_creator>HTML File/ImgBurn</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='12290048' len='1881' />
         </byte_runs>
      </fileobject>
   </volume>

   <runstats>
      <stop_time>14/12/2017 04:38:32</stop_time>
      <clock_seconds>0</clock_seconds>
   </runstats>

</dfxml>

Desde un archivo de imagen VHDX de formato NTFS

Este ejemplo en particular ha sido sacado desde un archivo de imagen de una memoria externa USB con formato NTFS, y el mismo presenta archivos fragmentados (con múltiples extents) así como Streams de Datos Alternos (ADS o simplemente 'Streams') anexionados a los archivos y carpetas.

<?xml version="1.0" encoding='UTF-8' ?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
      xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
      xmlns:dc='http://purl.org/dc/elements/1.1/'
      xmlns:hfs='http://www.forensicswiki.org/wiki/HFS' version='1.0'>

   <metadata>
      <dc:type>Image File</dc:type>
   </metadata>

   <creator>
      <program>IsoBuster</program>
      <version>4.1.0.00</version>
      <execution_environment>
        <start_time>14/12/2017 04:40:10</start_time>
        <os_version>Windows 10 (2.10.0.15063)</os_version>
        <username>Peter</username>
      </execution_environment>
   </creator>

   <source>
       <device_model>Thumb drive.vhdx</device_model>
       <image_filename>C:\Users\Peter\Desktop\Thumb drive.vhdx</image_filename>
       <image_size>440401920</image_size>
       <sectorsize>512</sectorsize>
       <devicesectors coding='base10'>4194304</devicesectors>
   </source>

   <volume>
      <ftype_str>NTFS</ftype_str>
      <partition_offset>33619968</partition_offset>

      <fileobject>
         <filename>\$Extend</filename>
         <name_type>d</name_type>
         <filesize>536</filesize>
         <alloc>1</alloc>
         <inode>11</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='737573888' len='536' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Deleted</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>29</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737592320' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$ObjId</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>25</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Quota</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>24</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$Reparse</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>26</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata</filename>
         <name_type>d</name_type>
         <filesize>320</filesize>
         <alloc>1</alloc>
         <inode>27</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737590272' len='320' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$Repair</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>28</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Extend\$RmMetadata\$Repair:$Config</filename>
         <name_type>-</name_type>
         <filesize>8</filesize>
         <alloc>1</alloc>
         <inode>28</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737591296' len='8' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$Txf</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>31</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737594368' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog</filename>
         <name_type>d</name_type>
         <filesize>552</filesize>
         <alloc>1</alloc>
         <inode>30</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='737593344' len='552' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$Tops</filename>
         <name_type>r</name_type>
         <filesize>100</filesize>
         <alloc>1</alloc>
         <inode>32</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737595392' len='100' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Extend\$RmMetadata\$TxfLog\$Tops:$T</filename>
         <name_type>-</name_type>
         <filesize>1048576</filesize>
         <alloc>1</alloc>
         <inode>32</inode>
         <mtime>14/12/2017 04:20:48</mtime>
         <byte_runs>
            <byte_run img_offset='731504640' len='1048576' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog.blf</filename>
         <name_type>r</name_type>
         <filesize>65536</filesize>
         <alloc>1</alloc>
         <inode>33</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>BLF File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='732553216' len='65536' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog1</filename>
         <name_type>r</name_type>
         <filesize>2097152</filesize>
         <alloc>1</alloc>
         <inode>34</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='732618752' len='2097152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Extend\$RmMetadata\$TxfLog\$TxfLog2</filename>
         <name_type>r</name_type>
         <filesize>2097152</filesize>
         <alloc>1</alloc>
         <inode>35</inode>
         <mtime>14/12/2017 04:34:17</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='734715904' len='2097152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN</filename>
         <name_type>d</name_type>
         <filesize>208</filesize>
         <alloc>1</alloc>
         <inode>39</inode>
         <mtime>14/12/2017 04:21:45</mtime>
         <byte_runs>
            <byte_run img_offset='737602560' len='208' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714</filename>
         <name_type>d</name_type>
         <filesize>552</filesize>
         <alloc>1</alloc>
         <inode>40</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <byte_runs>
            <byte_run img_offset='737603584' len='552' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IIKZQZA</filename>
         <name_type>r</name_type>
         <filesize>74</filesize>
         <alloc>1</alloc>
         <inode>56</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737619968' len='74' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$IW8ACSL</filename>
         <name_type>r</name_type>
         <filesize>72</filesize>
         <alloc>1</alloc>
         <inode>55</inode>
         <mtime>14/12/2017 04:32:18</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737618944' len='72' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RIKZQZA</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>45</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737608704' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\$RW8ACSL</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>52</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737615872' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$RECYCLE.BIN\S-1-5-21-1419736714\desktop.ini</filename>
         <name_type>r</name_type>
         <filesize>129</filesize>
         <alloc>1</alloc>
         <inode>41</inode>
         <mtime>14/12/2017 04:21:45</mtime>
         <hfs:HFStype_creator>INI File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737604608' len='129' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder</filename>
         <name_type>d</name_type>
         <filesize>456</filesize>
         <alloc>1</alloc>
         <inode>43</inode>
         <mtime>14/12/2017 04:31:48</mtime>
         <byte_runs>
            <byte_run img_offset='737606656' len='456' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>53</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='345038848' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345104384' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345169920' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345235456' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345300992' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345366528' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345432064' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345497600' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345563136' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345628672' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='345694208' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345759744' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345825280' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='345890816' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='345956352' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='346021888' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346087424' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346152960' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346218496' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346284032' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346349568' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346415104' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346480640' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346546176' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346611712' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='346677248' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346742784' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346808320' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346873856' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='346939392' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='347004928' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='347070464' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='347136000' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='347201536' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='347267072' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='347332608' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347398144' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347463680' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347529216' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347594752' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347660288' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347725824' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347791360' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='347856896' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='347922432' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='347987968' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='348053504' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='348119040' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='348184576' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348250112' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348315648' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348381184' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='348446720' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348512256' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348577792' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348643328' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348708864' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348774400' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348839936' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='348905472' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='348971008' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='349036544' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='349102080' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='349167616' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='349233152' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='349298688' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349364224' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='349429760' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349495296' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349560832' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='349626368' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='349691904' len='4096' />
            <byte_run img_offset='0' len='61440' />
            <byte_run img_offset='349757440' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='349822976' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='349888512' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='349954048' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='350019584' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='350085120' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='350150656' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350216192' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='350281728' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='350347264' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='350412800' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350478336' len='118784' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='350609408' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='350674944' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='350740480' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='350806016' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='350871552' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='350937088' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='351002624' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351068160' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351133696' len='16384' />
            <byte_run img_offset='0' len='49152' />
            <byte_run img_offset='351199232' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351264768' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351330304' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='351395840' len='57344' />
            <byte_run img_offset='0' len='8192' />
            <byte_run img_offset='351461376' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='351526912' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='351592448' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351657984' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='351723520' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='351789056' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='351854592' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351920128' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='351985664' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352051200' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='352116736' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352182272' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352247808' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='352313344' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352378880' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='352444416' len='16384' />
            <byte_run img_offset='0' len='49152' />
            <byte_run img_offset='352509952' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352575488' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='352641024' len='45056' />
            <byte_run img_offset='0' len='20480' />
            <byte_run img_offset='352706560' len='184320' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='352903168' len='49152' />
            <byte_run img_offset='0' len='16384' />
            <byte_run img_offset='33771520' len='16384' />
            <byte_run img_offset='0' len='49152' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\Links.zip</filename>
         <name_type>r</name_type>
         <filesize>3448</filesize>
         <alloc>1</alloc>
         <inode>49</inode>
         <mtime>15/10/2014 13:57:07</mtime>
         <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42442752' len='4096' />
            <byte_run img_offset='0' len='61440' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\logo.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42250240' len='28672' />
            <byte_run img_offset='0' len='36864' />
            <byte_run img_offset='42315776' len='40960' />
            <byte_run img_offset='0' len='24576' />
            <byte_run img_offset='42381312' len='61440' />
            <byte_run img_offset='0' len='4096' />
            <byte_run img_offset='42446848' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='737308672' len='16384' />
            <byte_run img_offset='0' len='49152' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Compressed Folder\logo.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737610752' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Compressed Folder\logo.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>47</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='42577920' len='24576' />
            <byte_run img_offset='0' len='40960' />
            <byte_run img_offset='42643456' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='42708992' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='42774528' len='4096' />
            <byte_run img_offset='0' len='61440' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Compressed Folder\Video.mp4</filename>
         <name_type>r</name_type>
         <filesize>151132575</filesize>
         <alloc>1</alloc>
         <inode>48</inode>
         <mtime>16/04/2014 10:33:57</mtime>
         <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='42778624' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42844160' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42909696' len='12288' />
            <byte_run img_offset='0' len='53248' />
            <byte_run img_offset='42975232' len='20480' />
            <byte_run img_offset='0' len='45056' />
            <byte_run img_offset='43040768' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='43106304' len='53248' />
            <byte_run img_offset='0' len='12288' />
            <byte_run img_offset='43171840' len='32768' />
            <byte_run img_offset='0' len='32768' />
            <byte_run img_offset='43237376' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43302912' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43368448' len='36864' />
            <byte_run img_offset='0' len='28672' />
            <byte_run img_offset='43433984' len='150470656' />
            <byte_run img_offset='42356736' len='8192' />
            <byte_run img_offset='0' len='57344' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder</filename>
         <name_type>d</name_type>
         <filesize>456</filesize>
         <alloc>1</alloc>
         <inode>44</inode>
         <mtime>14/12/2017 04:31:52</mtime>
         <byte_runs>
            <byte_run img_offset='737607680' len='456' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>54</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='353034240' len='7948184' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\Links.zip</filename>
         <name_type>r</name_type>
         <filesize>3448</filesize>
         <alloc>1</alloc>
         <inode>50</inode>
         <mtime>15/10/2014 13:57:07</mtime>
         <hfs:HFStype_creator>ZIP File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='43094016' len='3448' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\logo.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='41754624' len='294221' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder\logo.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737609728' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder\logo.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>46</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='42049536' len='197056' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder\Video.mp4</filename>
         <name_type>r</name_type>
         <filesize>151132575</filesize>
         <alloc>1</alloc>
         <inode>51</inode>
         <mtime>16/04/2014 10:33:57</mtime>
         <hfs:HFStype_creator>MP4 File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='193904640' len='151132575' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder with Stream</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>57</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737620992' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Stream\Folder with Stream:Text_In_Stream.txt</filename>
         <name_type>-</name_type>
         <filesize>25</filesize>
         <alloc>1</alloc>
         <inode>57</inode>
         <mtime>20/11/2017 22:46:56</mtime>
         <byte_runs>
            <byte_run img_offset='737620992' len='25' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\Folder with Streams</filename>
         <name_type>d</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622528' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream.txt</filename>
         <name_type>-</name_type>
         <filesize>25</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622016' len='25' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream2.txt</filename>
         <name_type>-</name_type>
         <filesize>29</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='737622016' len='29' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream3.txt</filename>
         <name_type>-</name_type>
         <filesize>37</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='43098112' len='37' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\Folder with Streams\Folder with Streams:Text_In_Stream4.txt</filename>
         <name_type>-</name_type>
         <filesize>41</filesize>
         <alloc>1</alloc>
         <inode>58</inode>
         <mtime>20/11/2017 22:49:35</mtime>
         <byte_runs>
            <byte_run img_offset='43102208' len='41' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\System Volume Information</filename>
         <name_type>d</name_type>
         <filesize>144</filesize>
         <alloc>1</alloc>
         <inode>36</inode>
         <mtime>14/12/2017 04:21:16</mtime>
         <byte_runs>
            <byte_run img_offset='737599488' len='144' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\System Volume Information\WPSettings.dat</filename>
         <name_type>r</name_type>
         <filesize>12</filesize>
         <alloc>1</alloc>
         <inode>37</inode>
         <mtime>14/12/2017 04:21:16</mtime>
         <hfs:HFStype_creator>DAT File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737600512' len='12' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$AttrDef</filename>
         <name_type>r</name_type>
         <filesize>2560</filesize>
         <alloc>1</alloc>
         <inode>4</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='731500544' len='2560' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$BadClus</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>8</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737570816' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$BadClus:$Bad</filename>
         <name_type>-</name_type>
         <filesize>2111827968</filesize>
         <alloc>1</alloc>
         <inode>8</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='0' len='2111827968' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Bitmap</filename>
         <name_type>r</name_type>
         <filesize>64448</filesize>
         <alloc>1</alloc>
         <inode>6</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737488896' len='64448' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Boot</filename>
         <name_type>r</name_type>
         <filesize>8192</filesize>
         <alloc>1</alloc>
         <inode>7</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33619968' len='8192' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$LogFile</filename>
         <name_type>r</name_type>
         <filesize>6324224</filesize>
         <alloc>1</alloc>
         <inode>2</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='724840448' len='6324224' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$MFT</filename>
         <name_type>r</name_type>
         <filesize>262144</filesize>
         <alloc>1</alloc>
         <inode>0</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737562624' len='262144' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$MFTMirr</filename>
         <name_type>r</name_type>
         <filesize>4096</filesize>
         <alloc>1</alloc>
         <inode>1</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33628160' len='4096' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Secure</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>9</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='0' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$Secure:$SDS</filename>
         <name_type>-</name_type>
         <filesize>264668</filesize>
         <alloc>1</alloc>
         <inode>9</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='731234304' len='264668' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$UpCase</filename>
         <name_type>r</name_type>
         <filesize>131072</filesize>
         <alloc>1</alloc>
         <inode>10</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33632256' len='131072' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\$UpCase:$Info</filename>
         <name_type>-</name_type>
         <filesize>32</filesize>
         <alloc>1</alloc>
         <inode>10</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <byte_runs>
            <byte_run img_offset='737572864' len='32' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\$Volume</filename>
         <name_type>r</name_type>
         <filesize>0</filesize>
         <alloc>1</alloc>
         <inode>3</inode>
         <mtime>14/12/2017 04:20:47</mtime>
         <hfs:HFStype_creator>File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='737565696' len='0' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\IsoBuster.exe</filename>
         <name_type>r</name_type>
         <filesize>7948184</filesize>
         <alloc>1</alloc>
         <inode>38</inode>
         <mtime>12/12/2017 23:57:56</mtime>
         <hfs:HFStype_creator>EXE File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='33804288' len='7948184' />
         </byte_runs>
      </fileobject>

      <fileobject>
         <filename>\logo1.eps</filename>
         <name_type>r</name_type>
         <filesize>294221</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <hfs:HFStype_creator>EPS File/</hfs:HFStype_creator>
         <byte_runs>
            <byte_run img_offset='736813056' len='294221' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\logo1.eps:AFP_AfpInfo</filename>
         <name_type>-</name_type>
         <filesize>60</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737605632' len='60' />
         </byte_runs>
      </fileobject>

      <fileobject><!--Stream or Resource Fork-->
         <filename>\logo1.eps:AFP_Resource</filename>
         <name_type>-</name_type>
         <filesize>197056</filesize>
         <alloc>1</alloc>
         <inode>42</inode>
         <mtime>08/08/2003 21:22:42</mtime>
         <byte_runs>
            <byte_run img_offset='737107968' len='197056' />
         </byte_runs>
      </fileobject>
   </volume>

   <runstats>
      <stop_time>14/12/2017 04:40:11</stop_time>
      <clock_seconds>0</clock_seconds>
   </runstats>

</dfxml>
<!-- For more information: https://www.isobuster.com/reports -->

IsoBuster

Ejemplos DFXML

Desde un archivo de sistema UDF en un CD sencillo

Desde un archivo de imagen VHDX de formato NTFS

También interesante: