### Complete File Object Representation with Metadata

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This XML example shows a detailed `<fileobject>` element, representing a file with comprehensive metadata. It includes file identification, type, size, allocation status, POSIX attributes, timestamps in ISO 8601 format, cryptographic hashes (MD5, SHA1, SHA256), physical byte run information, and file type detection using libmagic.

```xml
<fileobject>
  <!-- File identification -->
  <id>42</id>
  <filename>/home/user/document.txt</filename>
  <partition>1</partition>

  <!-- File type and allocation status -->
  <name_type>r</name_type> <!-- r = regular file -->
  <filesize>8192</filesize>
  <alloc_inode>1</alloc_inode> <!-- 1 = allocated -->
  <alloc_name>1</alloc_name>

  <!-- POSIX metadata -->
  <inode>12345</inode>
  <mode>33188</mode> <!-- 0644 in octal -->
  <nlink>1</nlink>
  <uid>1000</uid>
  <gid>1000</gid>

  <!-- Timestamps (ISO 8601 format) -->
  <crtime>2024-12-01T08:30:15Z</crtime> <!-- creation time -->
  <mtime>2024-12-15T14:22:30Z</mtime>   <!-- modification time -->
  <ctime>2024-12-15T14:22:30Z</ctime>   <!-- inode change time -->
  <atime>2025-01-10T09:15:42Z</atime>   <!-- access time -->

  <!-- Cryptographic hashes -->
  <hashdigest type="md5">5d41402abc4b2a76b9719d911017c592</hashdigest>
  <hashdigest type="sha1">aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d</hashdigest>
  <hashdigest type="sha256">2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae</hashdigest>

  <!-- Physical byte locations on disk -->
  <byte_runs>
    <byte_run file_offset="0" fs_offset="524288" img_offset="1572864" len="4096"/>
    <byte_run file_offset="4096" fs_offset="528384" img_offset="1576960" len="4096"/>
  </byte_runs>

  <!-- File type detection -->
  <libmagic>ASCII text, with no line terminators</libmagic>
</fileobject>
```

--------------------------------

### DFXML: File Name Type Classification

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet demonstrates the use of the `name_type` element in DFXML to classify files according to POSIX standards. It shows examples for regular files, directories, symbolic links, devices, pipes, sockets, and SleuthKit-specific virtual entries.

```xml
<!-- Regular file -->
<fileobject>
  <filename>/etc/passwd</filename>
  <name_type>r</name_type>
  <filesize>2048</filesize>
</fileobject>

<!-- Directory -->
<fileobject>
  <filename>/home</filename>
  <name_type>d</name_type>
</fileobject>

<!-- Symbolic link -->
<fileobject>
  <filename>/usr/bin/python</filename>
  <name_type>l</name_type>
  <link_target>/usr/bin/python3.9</link_target>
</fileobject>

<!-- Character device -->
<fileobject>
  <filename>/dev/null</filename>
  <name_type>c</name_type>
</fileobject>

<!-- Block device -->
<fileobject>
  <filename>/dev/sda1</filename>
  <name_type>b</name_type>
</fileobject>

<!-- Named pipe -->
<fileobject>
  <filename>/var/run/pipe</filename>
  <name_type>p</name_type>
</fileobject>

<!-- Socket -->
<fileobject>
  <filename>/var/run/socket</filename>
  <name_type>s</name_type>
</fileobject>

<!-- Virtual directory (SleuthKit specific) -->
<fileobject>
  <filename>/$OrphanFiles</filename>
  <name_type>V</name_type>
</fileobject>

<!-- Virtual file (SleuthKit specific) -->
<fileobject>
  <filename>/$FAT1</filename>
  <name_type>v</name_type>
</fileobject>
```

--------------------------------

### Extract DFXML Information with XPath (Bash)

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet showcases using xmllint with XPath expressions to extract specific data from a DFXML file. Examples include finding filenames of large files, counting file objects, and locating files by their hash.

```bash
# Extract specific information with XPath
xmllint --xpath "//fileobject[filesize>1000000]/filename/text()" evidence.dfxml

# Count total files
xmllint --xpath "count(//fileobject)" evidence.dfxml

# Find files by hash
xmllint --xpath "//fileobject[hashdigest='specific_sha256_value']/filename/text()" evidence.dfxml
```

--------------------------------

### Run DFXML Schema Validation Test Suite (Bash)

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet demonstrates how to run the complete test suite for DFXML schema validation using make commands. It includes steps for cleaning artifacts and running tests from different directories.

```bash
cd tests
make check

# Clean test artifacts
make clean

# Run tests from project root
cd ..
make check
```

--------------------------------

### DFXML Root Element Structure

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This XML snippet illustrates the required structure of a DFXML document. It includes the root `<dfxml>` element with the `version` attribute and a mandatory `<metadata>` element. Optional elements like `<creator>` and `<source>` are also shown, demonstrating how to include tool provenance and source information.

```xml
<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML'
      xmlns:dc="http://purl.org/dc/elements/1.1/"
      version="2.0.0-beta.0">

  <!-- Required metadata element -->
  <metadata>
    <dc:type>Dataset</dc:type>
  </metadata>

  <!-- Optional creator element with tool provenance -->
  <creator>
    <program>fiwalk</program>
    <version>0.6.3</version>
    <execution_environment>
      <os_sysname>Linux</os_sysname>
      <os_release>5.4.0-42-generic</os_release>
      <host>forensics-lab-01</host>
      <command_line>fiwalk -X evidence.dd</command_line>
      <start_time>2025-01-15T10:30:00Z</start_time>
    </execution_environment>
  </creator>

  <!-- Source information -->
  <source>
    <image_filename>/cases/2025-001/evidence.dd</image_filename>
  </source>

  <!-- Forensic objects follow -->
</dfxml>
```

--------------------------------

### Generate DFXML with fiwalk and Validate (Bash)

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet illustrates generating DFXML output from a disk image using The SleuthKit's fiwalk tool. It shows basic generation, generation with cryptographic hashes, and subsequent validation of the output.

```bash
# Generate DFXML from disk image using fiwalk
fiwalk -X evidence.dd > evidence.dfxml

# Generate with cryptographic hashes
fiwalk -X -z evidence.dd > evidence_with_hashes.dfxml

# Validate the generated DFXML
xmllint --noout --schema dfxml.xsd evidence.dfxml
```

--------------------------------

### Add and Validate Custom DFXML Document (Bash)

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet shows how to create a custom DFXML document and then validate it against the dfxml.xsd schema using xmllint. It defines a simple file object within the DFXML structure.

```bash
cat > tests/custom.dfxml << 'EOF'
<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' version="2.0.0-beta.0">
  <metadata />
  <fileobject>
    <filename>test.txt</filename>
    <filesize>100</filesize>
  </fileobject>
</dfxml>
EOF

# Validate custom document
xmllint --noout --schema dfxml.xsd tests/custom.dfxml
```

--------------------------------

### Validate DFXML Documents with xmllint

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet demonstrates how to validate DFXML XML documents against the dfxml.xsd schema using the xmllint command-line tool. It requires additional reference files (dc.xsd, xml.xsd) for validation. Successful validation produces no output; failures print errors to stderr.

```bash
# Validate a DFXML document against the schema
xmllint --noout --schema dfxml.xsd example.dfxml

# If validation succeeds, no output is produced
# If validation fails, errors are printed to stderr

# Example with a minimal valid DFXML document
cat > minimal.dfxml << 'EOF'
<?xml version='1.0' encoding='UTF-8'?>
<dfxml xmlns='http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML' version="2.0.0-beta.0">
  <metadata />
</dfxml>
EOF

xmllint --noout --schema dfxml.xsd minimal.dfxml
# Output: minimal.dfxml validates
```

--------------------------------

### Process DFXML with Python dfxml Library (Python)

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This Python snippet demonstrates parsing a DFXML file using the dfxml library. It iterates through file objects, printing details about allocated/deleted files and their cryptographic hashes if available.

```python
import dfxml
import dfxml.objects as Objects

# Parse DFXML document
for event, obj in Objects.iterparse("evidence.dfxml"):
    if isinstance(obj, Objects.FileObject):
        if obj.alloc:
            print(f"Allocated file: {obj.filename} ({obj.filesize} bytes)")
        else:
            print(f"Deleted file: {obj.filename}")

        if obj.sha256:
            print(f"  SHA256: {obj.sha256}")
```

--------------------------------

### DFXML: Disk Image and Volume Hierarchy

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet illustrates the hierarchical structure of a disk image in DFXML, showing how `diskimageobject` contains `partitionsystemobject`, `partitionobject`, and `volume` elements. It details partition geometry, volume properties, and nested file objects.

```xml
<diskimageobject>
  <!-- Disk geometry -->
  <sector_size>512</sector_size>

  <partitionsystemobject>
    <pstype_str>DOS Partition Table</pstype_str>

    <partitionobject>
      <partition_index>1</partition_index>
      <ptype>131</ptype>
      <ptype_str>Linux</ptype_str>

      <!-- Physical location of partition -->
      <byte_runs>
        <byte_run img_offset="1048576" len="10737418240"/>
      </byte_runs>

      <!-- Volume within partition -->
      <volume>
        <partition_offset>1048576</partition_offset>
        <sector_size>512</sector_size>
        <block_size>4096</block_size>
        <block_count>2621440</block_count>
        <ftype_str>Ext4</ftype_str>
        <first_block>0</first_block>
        <last_block>10737418239</last_block>
        <allocated_only>0</allocated_only> <!-- includes deleted files -->

        <!-- File objects within volume -->
        <fileobject>
          <filename>/lost+found</filename>
          <name_type>d</name_type> <!-- d = directory -->
          <inode>11</inode>
          <alloc_inode>1</alloc_inode>
          <alloc_name>1</alloc_name>
        </fileobject>
      </volume>
    </partitionobject>
  </partitionsystemobject>
</diskimageobject>
```

--------------------------------

### DFXML: Representing Deleted Files

Source: https://context7.com/dfxml-working-group/dfxml_schema/llms.txt

This snippet shows how DFXML represents deleted or unallocated files using `alloc_inode` and `alloc_name` elements to indicate allocation status at both inode and directory entry levels. It includes file metadata, timestamps, and hash digests.

```xml
<fileobject>
  <id>125</id>
  <filename>/home/user/deleted_file.pdf</filename>
  <partition>1</partition>

  <!-- Allocation status for deleted file -->
  <name_type>r</name_type>
  <filesize>45678</filesize>
  <alloc_inode>0</alloc_inode> <!-- 0 = unallocated/deleted inode -->
  <alloc_name>0</alloc_name>   <!-- 0 = deleted directory entry -->
  <orphan>0</orphan>

  <!-- Timestamps preserved from deletion -->
  <inode>67890</inode>
  <crtime>2024-11-20T16:45:00Z</crtime>
  <mtime>2024-11-25T11:30:22Z</mtime>
  <dtime>2024-12-01T09:15:00Z</dtime> <!-- deletion time (Ext2/3/4) -->

  <!-- Hash of recovered content -->
  <hashdigest type="sha256">e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855</hashdigest>

  <!-- Physical location may still be intact -->
  <byte_runs>
    <byte_run file_offset="0" img_offset="2097152" len="45678"/>
  </byte_runs>
</fileobject>
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.