<?xml version='1.0' encoding='UTF-8'?>
<dfxml
  xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
  xmlns:dc='http://purl.org/dc/elements/1.1/'
  version='1.1.1'>
  <metadata>
    <dc:type>Sample</dc:type>
  </metadata>
  <creator>
    <program>vi</program>
    <version>8.0</version>
    <build_environment>
      <compiler>GCC 4.6</compiler>
    </build_environment>
    <execution_environment>
      <command_line>vi difference_test_3.xml</command_line>
    </execution_environment>
  </creator>
  <source>
    <image_filename>/dev/null</image_filename>
  </source>
  <!--CHANGE: Volume at 1MiB disappears.-->
  <volume offset="1073741824"><!--1GiB-->
    <partition_offset>1073741824</partition_offset>
    <sector_size>512</sector_size>
    <block_size>4096</block_size>
    <ftype_str>FAT32</ftype_str>
    <fileobject>
      <filename>NO_CHANGE</filename>
      <partition>1</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>3</inode>
      <mtime>2007-08-09T12:34:56Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>3000000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>CHANGE___timestamp_changes_format_only</filename>
      <partition>1</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>6</inode>
      <mtime>2007-08-09T05:34:56-07:00</mtime><!--SEMI-RELEVANT CHANGE: Timestamp format, but not semantic value.-->
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>6000000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>CHANGE___erased___replaced_by_sibling</filename><!--CHANGE: Inode remains the same, checksum does not.-->
      <partition>1</partition>
      <filesize>4098</filesize><!--CHANGE: Size increases by 1 byte.-->
      <inode>8</inode>
      <mtime>2007-08-09T12:34:56Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>B100000000000000000000000000000000000000</hashdigest><!--CHANGE: Content changes.-->
    </fileobject>
    <fileobject>
      <filename>CHANGE___erased___replaced_by_other_partition_file</filename>
      <partition>1</partition>
      <filesize>4097</filesize>
      <inode>10</inode>
      <mtime>2007-08-09T12:35:00Z</mtime><!--CHANGE: mtime upated.-->
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>D000000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>_CHANGE___renamed</filename>
      <partition>1</partition>
      <filesize>4097</filesize>
      <inode>9</inode>
      <mtime>2007-08-09T12:34:56Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>E000000000000000000000000000000000000000</hashdigest>
    </fileobject>
  </volume>
  <volume offset="2147483648"><!--2GiB-->
    <partition_offset>2147483648</partition_offset>
    <sector_size>512</sector_size>
    <block_size>4096</block_size>
    <ftype_str>NTFS</ftype_str><!--CHANGE: File system changes from FAT32 to NTFS-->
    <fileobject><!--CHANGE: Moved from partition at 1GiB.-->
      <filename>CHANGE___move_from_P1G_to_P2G</filename>
      <partition>2</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>5</inode>
      <mtime>2007-08-09T12:34:56Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>5000000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>CHANGE___content_and_mtime</filename>
      <partition>2</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>3</inode>
      <mtime>2007-08-09T12:34:58Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>7100000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>CHANGE___unallocated</filename>
      <partition>2</partition>
      <filesize>4097</filesize>
      <alloc>0</alloc>
      <inode>4</inode>
      <mtime>2007-08-09T12:34:56Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>8000000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>CHANGE___new_file</filename>
      <partition>2</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>6</inode>
      <mtime>2007-08-09T12:34:59Z</mtime>
      <atime>2007-08-09T12:34:59Z</atime>
      <crtime>2007-08-09T12:34:59Z</crtime>
      <hashdigest type='sha1'>9100000000000000000000000000000000000000</hashdigest>
    </fileobject>
  </volume>
  <!--CHANGE: Partition added-->
  <volume offset="3221225472"><!--3GiB-->
    <partition_offset>4294967296</partition_offset>
    <sector_size>512</sector_size>
    <block_size>4096</block_size>
    <ftype_str>FAT32</ftype_str>
    <fileobject>
      <filename>CHANGE___move_from_P1M_to_P3G</filename>
      <partition>3</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>3</inode>
      <mtime>2007-08-09T12:34:56Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>0000000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>CHANGE___move_from_P1M_to_P3G___change_content___change_mtime</filename>
      <partition>3</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>4</inode><!--IRRELEVANT CHANGE: inode number changed from @1MiB's inode number-->
      <mtime>2007-08-09T12:34:57Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>2100000000000000000000000000000000000000</hashdigest>
    </fileobject>
    <fileobject>
      <filename>_CHANGE___move_from_P1M_to_P3G___change_name</filename>
      <partition>3</partition>
      <filesize>4097</filesize>
      <alloc>1</alloc>
      <inode>5</inode><!--IRRELEVANT CHANGE: inode number changed from @1MiB's inode number-->
      <mtime>2007-08-09T12:34:56Z</mtime>
      <atime>2007-08-09T12:34:56Z</atime>
      <crtime>2007-08-09T12:34:56Z</crtime>
      <hashdigest type='sha1'>1000000000000000000000000000000000000000</hashdigest>
    </fileobject>
  </volume>
</dfxml>
