Digital forensics xml schema

Digital Forensics XML (DFXML) provides a structured, standardized way to record and exchange data found during machine-level storage examinations.

At the heart of this framework is the <fileobject> schema, a core component used to comprehensively document structural evidence about individual files across a system. Rather than just tracking file contents, this schema captures deeply granular filesystem artifacts, including structural flags, unique identification metrics, physical sector locations, cryptographic hashes, and timeline timestamps. Understanding how these system attributes intertwine allows digital investigators to meticulously reconstruct user activity and map out timeline lifecycles of both active and deleted evidence.

Schemas

The Digital Forensics XML schemas are somewhat in flux, in that new elements will be added as necessary. However, the basic structure is unlikely to change.

fileobject schema
filehashset schema

Encoding

Encoding is assumed to be base10, except for hash codes, which are assumed to be base16.

File object (fileobject)

The file object (fileobject) is used to describe information about a file.

The file object can contain information about:

The file's name
The file's hash code(s)
The file's location on the disk.
Embedded metadata
Block hashes, a Bloom Filter, or a Similarity Digest for the file.

Other objects can be embedded in a fileobject object:

The byte_runs object specifies where the file is located on the disk.
A sector_hash object is a list of sector hash codes.
The sector_hash object could contain a nsrl_bloom object, which would be a bloom filter that contains all of the sector hashes.

XML Tag	Meaning
`<fileobject>`	Every file is inside a `<fileobject>`
`<orphan>YES</orphan>`	YES means that the file is an "orphan," without a name.
`<filesize>3210</filesize>`	The size of the file content in bytes.
`<unalloc>1</unalloc>`	A "1" means that the file was not allocated in the file system. This may mean that the file was deleted.
`<used>1</used>`	See below.
`<mtime>1114172320</mtime>`	The file's modification time, as a POSIX (time_t) timestamp (number of seconds since January 1, 1970 UTC).
`<ctime>1195819392</ctime>`	The file's inode's creation time, as a POSIX (time_t) timestamp.
`<atime>1195794000</atime>`	The file's access time, as a unix timestamp.
`<byte_runs>121130496:3210</byte_runs>`	The file's fragments. Each fragment is represented as the byte offset from the beginning of the disk image (the first byte is byte #0) and a number of bytes.
`<fragments>1</fragments>`	The number of fragments in the file.
`<hashdigest type='md5'>c27c0730b858bc60c8894300a98bba55</hashdigest>`	The file's MD5, as a hexadecimal hash.
`<hashdigest type='sha1'>0277680d624e609f23aec9e4265c2d7d24bd3824</hashdigest>`	The file's SHA1, as a hexadecimal hash.
`<partition>1</partition>`	The partition number in which the file was found.

Used and alloc

The <used> tag explicitly addresses whether a filesystem metadata structure contains populated attributes.

The <alloc> tag defines active, current logical system ownership, whereas <used> acts as a physical history marker confirming that data was actually written inside that metadata slot at some point.

Mapping these terms together provides investigators with a matrix to separate untouched space from active and deleted files:

State	used	alloc	Meaning
Pristine Space	0	0	Brand new, unallocated space that has never held any file details.
Active File	1	1	A normal, live file system object with active data.
Deleted / Recoverable	1	0	A deleted file. Current allocation is unallocated (`0`), but historic data remains populated (`1`) and is prime for recovery.
Corrupted Slot	0	1	System anomaly. Allocated to a file, but the structure contains no valid metadata attributes.

Note that the table above is not authorative, please check with the DFXML working group if necessary.

Caution

While DFXML is a highly adaptable framework for recording data state changes, forensic analysts and tool developers must account for known nuances and shortcomings in the format:

Examples

Piecewise Hashing

Digital Forensics XML can be used to represent the results of piecewise hashing of individual files. The md5deep suite now generates piecewise hashing results in DFXML when the -d option is provided. For example:

<?xml version='1.0' encoding='UTF-8'?>
<md5deep>
  <fileobject>
    <filename>sample/bar.txt</filename>
    <filesize>46</filesize>
    <mtime format='time_t'>1296497502.0</mtime>
    <byte_runs>
      <byte_run file_offset='0' len='46'>
        <hashdigest type='MD5'>0e886f6b08986269af98aedde53df23f</hashdigest>
        <hashdigest type='SHA256'>21c35b5698f1e54d11ca8a41321d40d75797425013dfa1b640ab34d7efa7f1ac</hashdigest>
      </byte_run>
    </byte_runs>
    <hashdigest type='MD5'>0e886f6b08986269af98aedde53df23f</hashdigest>
    <hashdigest type='SHA256'>21c35b5698f1e54d11ca8a41321d40d75797425013dfa1b640ab34d7efa7f1ac</hashdigest>
  </fileobject>
  <fileobject>
    <filename>sample/foo.txt</filename>
    <filesize>193</filesize>
    <mtime format='time_t'>1296497462.0</mtime>
    <byte_runs>
      <byte_run file_offset='0' len='193'>
        <hashdigest type='MD5'>06f63e03ed5e1770a2ff753a76d04906</hashdigest>
        <hashdigest type='SHA256'>82a217a76ebe5e6c0f768576a3e8fd9ba6de504c42360c23e08ddfa22e711ba0</hashdigest>
      </byte_run>
    </byte_runs>
    <hashdigest type='MD5'>06f63e03ed5e1770a2ff753a76d04906</hashdigest>
    <hashdigest type='SHA256'>82a217a76ebe5e6c0f768576a3e8fd9ba6de504c42360c23e08ddfa22e711ba0</hashdigest>
  </fileobject>
  <fileobject>
    <filename>sample/somedir/baz.txt</filename>
    <filesize>19</filesize>
    <mtime format='time_t'>1296497486.0</mtime>
    <byte_runs>
      <byte_run file_offset='0' len='19'>
        <hashdigest type='MD5'>362aa248563e453588755f280387a3d4</hashdigest>
        <hashdigest type='SHA256'>7a7c62947561b0b00c213d37d04edbe0c8de46282098b7216a23b25fa336f150</hashdigest>
      </byte_run>
    </byte_runs>
    <hashdigest type='MD5'>362aa248563e453588755f280387a3d4</hashdigest>
    <hashdigest type='SHA256'>7a7c62947561b0b00c213d37d04edbe0c8de46282098b7216a23b25fa336f150</hashdigest>
  </fileobject>
</md5deep>

Source Tag

The source tag is used to describe the source of forensic data. It currently is used for disk images, for example:

<source type='Disk Image'>
  <imagefile>/corp/images/nus/1040.aff</imagefile>
  <sectorsize>512</sectorsize>
  <device_model>SEAGATE ST32550W SUN2.1G 0418</device_model>
  <device_sn>01806486</device_sn>
  <acquisition_commandline>aimage scsi1 /project2/b28.aff</acquisition_commandline>
  <acquisition_device>/dev/sda1</acquisition_device>
  <device_capabilities>pass2: &gt;SEAGATE ST32550W SUN2.1G 0418&lt; Fixed Direct Access SCSI-2 device
pass2: Serial Number 01806486
pass2: 20.000MB/s transfers (10.000MHz, offset 15, 16bit), Tagged Queueing Enabled
  </device_capabilities>
  <sectorsize coding='base10'>512</sectorsize>
  <devicesectors coding='base10'>4194995</devicesectors>
  <acquisition_macaddr>00:0f:b5:42:6a:fe</acquisition_macaddr>
  <acquisition_date>2006-07-25T10:56:42</acquisition_date>
</source>

Volume Grouping

After the source tag you may find some fileobject tags. They may be grouped within a volume tag, for example:

<volume offset='32256'>
  <byte_runs>
    <byte_run offset='0' img_offset='114688' len='32768'>
    <byte_run offset='0' img_offset='1523712' len='32768'>
    <byte_run offset='0' img_offset='6356992' len='39659'>
  </byte_runs>
  <ftype>1</ftype>
  <ftype_str>ntfs</ftype_str>
  <block_size>4096</block_size>
  <block_count>4980142</block_count>
  <first_block>0</first_block>
  <last_block>4980141</last_block>
  <fileobject>
  ...
  </fileobject>
</volume>

File Object

<fileobject>
  <filename>RAW/report02-3.pdf</filename>
  <id>19</id>
  <filesize>1421998</filesize>
  <partition>1</partition>
  <alloc>1</alloc>
  <used>1</used>
  <inode>39</inode>
  <type>1</type>
  <mode>511</mode>
  <nlink>2</nlink>
  <uid>0</uid>
  <gid>0</gid>
  <mtime>1230764913</mtime>
  <ctime>1230764913</ctime>
  <atime>1230764978</atime>
  <crtime>1230764978</crtime>
  <seq>1</seq>
  <byte_runs>
    <run file_offset='0' fs_offset='241542144' img_offset='241542144' len='1421998'/>
  </byte_runs>
  <hashdigest type='MD5'>dede94f84fb2d00dc93ed00fda272a18</hashdigest>
  <hashdigest type='SHA1'>3c078d039398c44611b6365e8afdeadeb61967d4</hashdigest>
</fileobject>

Prefetch file

A Prefetch file is used by Windows NT to improve the startup process of an application. Each prefetch file provides information about each ran application.

<?xml version='1.0' encoding='ISO-8859-1'?>
<prefetch>
   <header>
     <os>Windows 7</os>
     <header_size>240</header_size>
     <filename>ACRORD32INFO.EXE</filename>
     <runs>3</runs>
     <atime>2011-02-07T12:24:52</atime>
   </header>
   <volume>
     <path>/DEVICE/HARDDISKVOLUME1</path>
     <serial_number>b46f6927</serial_number>
   </volume>
   <creation>2010-08-18T06:13:10</creation>
   <filenames>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/NTDLL.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/KERNEL32.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/APISETSCHEMA.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/KERNELBASE.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/LOCALE.NLS</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/ADVAPI32.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/MSVCRT.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/SECHOST.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/RPCRT4.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/WINSXS/X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4927_NONE_D08A205E442DB5B5/MSVCR80.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/PROGRAM FILES/ADOBE/READER 9.0/READER/ACRORD32INFO.EXE</file>
     <file>/DEVICE/HARDDISKVOLUME1/PROGRAM FILES/ADOBE/READER 9.0/READER/ACRORD32.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/WININET.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/SHLWAPI.DLL</file>
     <file>/DEVICE/HARDDISKVOLUME1/WINDOWS/SYSTEM32/GDI32.DLL</file>
   </filenames>
   <dirnames>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MSN TOOLBAR</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MSN TOOLBAR\PLATFORM</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\MSN TOOLBAR\PLATFORM\6.3.2348.0</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\COMPANION</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\COMPANION\EN</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\INSTALLER</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAM FILES\WINDOWS LIVE\SHARED</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEANOTE</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEARCH BOX EXTENSION</dir>
     <dir>\DEVICE\HARDDISKVOLUME1\PROGRAMDATA\MICROSOFT\SEARCH ENHANCEMENT PACK\SEARCH HELPER</dir>

External Links

Project site
Digital Forensics XML and the DFXML Toolset, by Simson Garfinkel, September 3, 2011