<?xml version='1.0' encoding='UTF-8'?>
<dfxml
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
  xmlns:dc='http://purl.org/dc/elements/1.1/'
  xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
  version='1.1.1'>
  <metadata>
    <dc:type>Sample</dc:type>
  </metadata>
  <creator>
    <program>vi</program>
    <version>8.0</version>
    <execution_environment>
      <command_line>vi post.xml</command_line>
    </execution_environment>
  </creator>
  <source/>
  <fileobject>
    <filename>i_am_new.txt</filename>
    <name_type>r</name_type>
    <filesize>40</filesize>
    <inode>123459</inode>
    <mtime>2013-05-16T21:01:00Z</mtime>
    <ctime>2013-05-16T21:01:00Z</ctime>
    <atime>2013-05-16T21:01:00Z</atime>
    <byte_runs>
      <byte_run file_offset='0' img_offset='45123' len='40'/>
    </byte_runs>
    <hashdigest type='md5'>158de35eacc7ac390693d90d31043ad6</hashdigest>
    <hashdigest type='sha1'>b6fc3d9d7f4830070123522a5630f9e70b4931f6</hashdigest>
  </fileobject>
  <fileobject>
    <filename>i_will_be_modified.txt</filename>
    <name_type>r</name_type>
    <filesize>23</filesize>
    <inode>123457</inode>
    <mtime>2013-05-16T20:59:00Z</mtime>
    <ctime>2013-05-16T20:59:00Z</ctime>
    <atime>2013-05-16T20:59:00Z</atime>
    <byte_runs>
      <byte_run file_offset='0' img_offset='234512' len='23'/>
    </byte_runs>
    <hashdigest type='md5'>d90d31043ad6158de35eacc7ac390693</hashdigest>
    <hashdigest type='sha1'>070123522a5630f9e70b4931f6b6fc3d9d7f4830</hashdigest>
  </fileobject>
  <fileobject>
    <filename>i_will_be_accessed.txt</filename>
    <name_type>r</name_type>
    <filesize>12</filesize>
    <inode>123458</inode>
    <mtime>2013-01-01T00:00:00Z</mtime>
    <ctime>2013-01-01T00:00:00Z</ctime>
    <atime>2013-05-16T21:00:00Z</atime>
    <byte_runs>
      <byte_run file_offset='0' img_offset='234512' len='12'/>
    </byte_runs>
    <hashdigest type='md5'>e35eacc7ac390693d90d31043ad6158d</hashdigest>
    <hashdigest type='sha1'>31f6b6fc3d9d7f4830070123522a5630f9e70b49</hashdigest>
  </fileobject>
</dfxml>
