/
fdd000611.xml
374 lines (373 loc) · 23.5 KB
/
fdd000611.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
<?xml version="1.0" encoding="UTF-8"?>
<fdd:FDD id="fdd000611" titleName="Digital Forensics XML" shortName="DFXML" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:fdd="http://www.loc.gov/preservation/digital/formats/schemas/fdd/v1" xsi:schemaLocation="http://www.loc.gov/preservation/digital/formats/schemas/fdd/v1 http://www.loc.gov/preservation/digital/formats/schemas/fdd/v1/fdd-v1-2.xsd">
<fdd:properties>
<fdd:gdfrGenreSelection>
<fdd:gdfrGenre>any</fdd:gdfrGenre>
</fdd:gdfrGenreSelection>
<fdd:formatCategories>
<fdd:category>file-format</fdd:category>
</fdd:formatCategories>
<fdd:gdfrComposition>unitary</fdd:gdfrComposition>
<fdd:gdfrForm>binary</fdd:gdfrForm>
<fdd:gdfrConstraint>structured</fdd:gdfrConstraint>
<fdd:gdfrBasis>symbolic</fdd:gdfrBasis>
<fdd:updates>
<fdd:date>2023-12-08</fdd:date>
</fdd:updates>
<fdd:draftStatus>Preliminary</fdd:draftStatus>
</fdd:properties>
<fdd:identificationAndDescription>
<fdd:fullName>Digital Forensics XML</fdd:fullName>
<fdd:keywords>
<fdd:keyword>metadata formats</fdd:keyword>
</fdd:keywords>
<fdd:description>
<p>Digital Forensics XML (DFXML) is an <a href="https://www.loc.gov/preservation/digital/formats/fdd/fdd000075.shtml">Extensible Markup Language (XML)</a> language designed to represent a wide range of forensic information and processing results. Since its inception in 2007, DFXML has served the purpose of archiving forensic processing steps, reducing the need for re-processing digital evidence. It acts as an interchange format, facilitating the sharing of structured information between independent tools and organizations. The format <a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">was created to establish</a> a shared way for forensic software tools to exchange information.</p>
<p>DFXML captures metadata and provenance information about the operation of software tools. Initially designed to represent the output of digital forensics tools, particularly SleuthKit tools, DFXML has expanded to operate with bulk extractor digital forensics tools (<a href="https://github.com/dfxml-working-group/dfxml_python">DFXML Python</a> and <a href="https://github.com/dfxml-working-group/dfxml_cpp">DFXML C++</a>).
</p>
<p>DFXML is versatile and capable of <a href="https://core.ac.uk/download/pdf/36736486.pdf">representing various forensic information</a> such as disk images; files; file system metadata; moves, adds, and changes (MAC) times; file hashes; sector hashes; transmission control protocol (TCP) flows; and hash sets. It provides provenance details, including the origin of data, classification, use restrictions, and the tools employed in the forensic process. Moreover, <a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">DFXML can document provenance</a>, including details about the computer on which the application program was compiled, linked libraries, and the runtime environment, proving useful in research and courtroom testimony.</p>
<p>DFXML plays a pivotal role in enhancing composability by providing a language for <a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">describing common forensic processes</a> (e.g., cryptographic hashing), forensic work products (e.g., the location of files on a hard drive), and metadata (e.g., file names and timestamps). It serves as the basis for a Python module (dfxml.py), simplifying the creation of sophisticated forensic processing programs.</p>
</fdd:description>
<fdd:shortDescription>Digital Forensics XML (DFXML), an Extensible Markup Language (XML), serves as a comprehensive format for representing forensic information and processing results since its 2007 inception. Designed for interchangeability between forensic tools, it captures metadata and provenance, originally tailored for SleuthKit and later extended to bulk_extractor tools. DFXML's versatility encompasses various forensic data types, offering provenance details and enhancing composability by providing a language for common forensic processes. Additionally, it forms the foundation for a Python module (dfxml.py) streamlining the creation of advanced forensic processing programs.</fdd:shortDescription>
<fdd:productionPhase>Middle-state and archival.</fdd:productionPhase>
<fdd:relationships>
<fdd:relationship>
<fdd:typeOfRelationship>Subtype of</fdd:typeOfRelationship>
<fdd:relatedTo>
<fdd:id>fdd000075</fdd:id>
<fdd:shortName>XML</fdd:shortName>
<fdd:titleName>Extensible Markup Language</fdd:titleName>
</fdd:relatedTo>
</fdd:relationship>
</fdd:relationships>
</fdd:identificationAndDescription>
<fdd:localUse>
<fdd:experience>None</fdd:experience>
<fdd:preference>The Library of Congress has not yet expressed any format preference for digital forensic data.</fdd:preference>
</fdd:localUse>
<fdd:sustainabilityFactors>
<fdd:disclosure>Fully disclosed. The <a href="https://github.com/simsong/dfxml">original DFXML source code repository</a> is now considered legacy and directs users to the <a href="https://github.com/dfxml-working-group/dfxml_schema">official schema repository, version 1.2.0</a>. The <a href="https://github.com/simsong/dfxml/issues">legacy repository</a> is retained for historical reasons, housing legacy GitHub Issues and maintaining historical version control that wasn't transferred to the new repository. Additionally, DFXML has official <a href="https://github.com/dfxml-working-group/dfxml_python">Python</a> and <a href="https://github.com/dfxml-working-group/dfxml_cpp">C++</a> codebases.</fdd:disclosure>
<fdd:documentation>
<ul>
<li>
<a href="https://github.com/simsong/dfxml">Legacy DFXML Source Code Repository</a>
</li>
<li>
<a href="https://github.com/simsong/dfxml/issues">Legacy Issues Repository</a>
</li>
<li>
<a href="https://github.com/dfxml-working-group/dfxml_schema">Official Schema Repository, version 1.2.0</a>
</li>
<li>
<a href="https://github.com/dfxml-working-group/dfxml_python">DFXML Python Codebase</a>
</li>
<li>
<a href="https://github.com/dfxml-working-group/dfxml_cpp">DFXML C++ Codebase</a>
</li>
<li>
<a href="https://forensics.wiki/fileobject/">Digital Forensics Wiki</a> with DFXML file object parts breakdown.
</li>
</ul>
</fdd:documentation>
<fdd:adoption>
<p>The assumed maintainer of the specification is the National Institute of Standards and Technology. <a href="../contact_format.shtml">Comments welcome</a>.
</p>
<p>Widely adopted. A non-exhaustive list includes:</p>
<ul>
<li>File Extractors: DFXML is integral to file extractors, documenting file locations in tools such as <a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">fiwalk</a> (part of SleuthKit), <a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">EnCase EnScript</a> for NTFS, and <a href="https://github.com/rene0/xbox360">XBox 360 storage parsers</a>.
</li>
<li>File Carvers: DFXML is used in <a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">file carvers</a> like frag_find, PhotoRec, and StegCarver from the Department of Defense Cyber Crime Center DC3Tool.
</li>
<li>Hash Calculators: <a href="https://md5deep.sourceforge.net/">Various hash calculators</a>, including md5deep, sha1deep, and hashdeep, utilize DFXML.
</li>
<li>Other Forensic Tools: DFXML is incorporated into <a href="https://core.ac.uk/download/pdf/36736486.pdf">forensic processing tools</a> like regxml_extractor, tcpflow, and bulk_extractor.
</li>
<li>NIST Usage of DFXML: <a href="https://core.ac.uk/download/pdf/36736486.pdf">NIST uses DFXML</a> to distribute information and internally for research projects.
</li>
<li>Digital Preservation: Digital preservation software <a href="https://www.archivematica.org/en/docs/archivematica-1.14/user-manual/transfer/forensic/">Archivematica</a> and data recovery tool <a href="https://www.isobuster.com/dfxml-example.php">IsoBuster</a> use DFXML.
</li>
<li>BitCurator, fiwalk & SleuthKit Integration: DFXML is <a href="https://bitcurator.github.io/documentation/BitCurator%20Walkthrough/BitCurator%20Walkthrough/#forensics-and-reporting">chosen for BitCurator</a> projects due to its use in BitCurator, where it generates technical metadata. BitCurator employs fiwalk, developed by Garfinkel, which produces DFXML. Fiwalk, initially independent, was <a href="https://simson.net/clips/academic/2009.SADFE.xml_forensics.pdf">integrated into</a> SleuthKit around 2012.
</li>
<li>PhotoRec and md5deep: DFXML <a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">is used in</a> the "PhotoRec carver" and md5deep, allowing their matching XML output to be used together and compared.
</li>
<li>
<a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">idifference.py</a>: A Python program comparing two DFXML files and reporting differences on fileobjects.
</li>
<li>
<a href="https://simson.net/clips/academic/2012.DI.dfxml.pdf">imicrosoft_redact.py</a>: A tool in the DFXML distribution that modifies executables in a disk image, making it non-workable for virtual machines. It records cryptographic hashes before and after modification.
</li>
</ul>
</fdd:adoption>
<fdd:licensingAndPatents>According to the <a href="https://github.com/dfxml-working-group/dfxml_schema/blob/main/dfxml.xsd">specification</a>, DFXML was “developed by the National Institute of Standards
and Technology by employees of the Federal Government in the course of their official duties”. DFXML is <a href="https://core.ac.uk/download/pdf/36736486.pdf">hosted by</a> the National Institute of Standards and Technology (NIST) at the National Software Reference Library (NSRL). </fdd:licensingAndPatents>
<fdd:transparency>DFXML is open and text-based, and thus can be read using basic text editors. However, deployment of DFXML requires the use of complex tools.
</fdd:transparency>
<fdd:selfDocumentation>
<p>DFXML is identified through the XML namespace: <dfxml>. For example:
</p>
<p>
<dfxml xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dfxmlext="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML#extensions" version="1.2.0">
</p>
</fdd:selfDocumentation>
<fdd:externalDependencies>For use with XML Schema Definition (XSD), the <a href="https://github.com/dfxml-working-group/dfxml_schema">specification</a> states:
If you intend to use this file as a DFXML document validator, note that you will also need to download two accompanying .xsd files under the "ref" directory. The easiest way to do this is by downloading the repository as a Git clone, or by downloading the zip archive from the GitHub page.
</fdd:externalDependencies>
<fdd:techProtection>None.</fdd:techProtection>
</fdd:sustainabilityFactors>
<fdd:fileTypeSignifiers>
<fdd:signifiersGroup>
<fdd:filenameExtension>
<fdd:sigValues>
<fdd:sigValue>dfxml</fdd:sigValue>
<fdd:sigValue>xml</fdd:sigValue>
</fdd:sigValues>
<fdd:note>DFXML can be embedded into other XML-based formats or as a standalone document. Documents may informally have the file extension of .XML or .DFXML, such as this <a href="https://github.com/ajnelson-nist/gddrescue_mapfile_to_dfxml/blob/a489a864fc5bdc761eafb92f302b90d5aaa7a4ce/tests/damage_sample_1/sample_file_system.dfxml">sample file system report</a>.
</fdd:note>
</fdd:filenameExtension>
<fdd:internetMediaType>
<fdd:sigValueNA>See related format.</fdd:sigValueNA>
<fdd:note>See <fddLink id="fdd000075">XML</fddLink>.
</fdd:note>
</fdd:internetMediaType>
<fdd:magicNumbers>
<fdd:sigValueNA>See related format.</fdd:sigValueNA>
<fdd:note>See <fddLink id="fdd000075">XML</fddLink>.
</fdd:note>
</fdd:magicNumbers>
<fdd:other>
<fdd:tag>Indicator for profile, level, version, etc.</fdd:tag>
<fdd:values>
<fdd:sigValueNA>See note.</fdd:sigValueNA>
<fdd:note>Version for the schema that generated the XML is required. See line 68 of the <a href="https://github.com/dfxml-working-group/dfxml_schema/blob/main/dfxml.xsd#L68C27-L68C34">schema</a>.
</fdd:note>
</fdd:values>
</fdd:other>
<fdd:other>
<fdd:tag>XML DOCTYPE declaration</fdd:tag>
<fdd:values>
<fdd:sigValueNA>See note.</fdd:sigValueNA>
<fdd:note>
<p>"dfxml" is the XML namespace.</p>
<p>At <a href="https://github.com/dfxml-working-group/dfxml_schema">minimum</a> the required declaration is:</p>
<p><dfxml xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dfxmlext="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML#extensions" version="1.2.0"></p>
<p>
<a href="https://github.com/dfxml-working-group/dfxml_schema/blob/main/dfxml.xsd#L68C27-L68C34">Version is required</a>, notably this part:</p>
<p>xmlns:dfxml="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML"</p>
<p>Full schema from the XSD/standard:</p>
<p><xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dfxml="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" targetNamespace="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" elementFormDefault="qualified">
</p>
<p>
<a href="https://github.com/ajnelson-nist/gddrescue_mapfile_to_dfxml/blob/a489a864fc5bdc761eafb92f302b90d5aaa7a4ce/tests/damage_sample_1/sample_file_system.dfxml">Example</a>:
</p>
<p><dfxml xmlns="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dfxmlext="http://www.forensicswiki.org/wiki/Category:Digital_Forensics_XML#extensions" version="1.2.0"></p>
</fdd:note>
</fdd:values>
</fdd:other>
<fdd:other>
<fdd:tag>Pronom PUID</fdd:tag>
<fdd:values>
<fdd:sigValueNA>See note.</fdd:sigValueNA>
<fdd:note>PRONOM has no corresponding entry as of January 2023.</fdd:note>
</fdd:values>
</fdd:other>
<fdd:other>
<fdd:tag>Wikidata Title ID</fdd:tag>
<fdd:values>
<fdd:sigValues>
<fdd:sigValue>Q105855984</fdd:sigValue>
</fdd:sigValues>
<fdd:note>Digital Forensics XML file format. See <a href="https://www.wikidata.org/wiki/Q105855984">https://www.wikidata.org/wiki/Q105855984</a>.
</fdd:note>
</fdd:values>
</fdd:other>
<fdd:other>
<fdd:tag>Wikidata Title ID</fdd:tag>
<fdd:values>
<fdd:sigValues>
<fdd:sigValue>Q16956577</fdd:sigValue>
</fdd:sigValues>
<fdd:note>In addition to the Wikidata for the DFXML file format, there's also a Wikidata for the Digital Forensics XML
language. See <a href="https://www.wikidata.org/wiki/Q16956577">https://www.wikidata.org/wiki/Q16956577</a>
</fdd:note>
</fdd:values>
</fdd:other>
</fdd:signifiersGroup>
</fdd:fileTypeSignifiers>
<fdd:notes>
<fdd:general>
<p>
<b>DFXML Structure</b>
</p>
<p>The DFXML structure consists of metadata, creator information, runtime configuration, volume details, and file objects. The XML format serves to encapsulate Dublin Core metadata, runtime CPU usage information, and specifics about volumes and individual files. Example, from Garfinkel’s “DFXML and Other Standards”:</p>
<p><dfxml>
<metadata> Dublin Core Metadata </metadata>
<creator> The program that made this DFXML </creator>
<configuration> Runtime Configuration </configuration>
<volume> Information about Volumes </volume>
<fileobjects>
<fileobject> Information about a file </fileobject>
</fileobjects>
<rusage> Runtime CPU usage information </rusage>
</dfxml>
</p>
<p>
<b>Tools for DFXML Validation</b>
</p>
<p>The command line tool xmllint, commonly used for parsing XML files, is <a href="https://core.ac.uk/download/pdf/36736486.pdf">employed for validating</a> DFXML against its XML Schema. Notably, xmllint can validate both DFXML and another schema called RegXML. The latter, similar to DFXML, has official documentation and a schema available on GitHub. According to <a href="https://forensics.wiki/regxml/.">Forensics Wiki</a>, RegXML is an XML syntax analogous to DFXML. While it uses parts of DFXML in its schema, its official documentation and schema are independently available on <a href="https://github.com/ajnelson/regxml_extractor">GitHub</a>.
</p>
</fdd:general>
<fdd:history>
<p>Developed by Simson L. Garfinkel, DFXML has been employed in forensic data description <a href="https://core.ac.uk/download/pdf/36736486.pdf">since 2006</a>. The original DFXML paper by Garfinkel in 2009, “<a href="https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6512863/">Navigating Unmountable Media with the Digital Forensics XML File System</a>”, introduced Fiwalk as an extension to The SleuthKit. Fiwalk utilizes The SleuthKit's internal bindings for direct storage parsing and reports the results in XML format.</p>
</fdd:history>
</fdd:notes>
<fdd:formatSpecifications>
<fdd:urls>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/simsong/dfxml</link>
<tag>Legacy DFXML Source Code Repository</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/simsong/dfxml/issues</link>
<tag>Legacy Issues Repository</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/dfxml-working-group/dfxml_schema</link>
<tag>Official Schema Repository, version 1.2.0</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/dfxml-working-group/dfxml_python</link>
<tag>DFXML Python Codebase</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/dfxml-working-group/dfxml_cpp</link>
<tag>DFXML C++ Codebase</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://forensics.wiki/fileobject/</link>
<tag>Digital Forensics Wiki</tag>
<comment>with DFXML file object parts breakdown.</comment>
</fdd:urlReference>
</fdd:url>
</fdd:urls>
</fdd:formatSpecifications>
<fdd:usefulReferences>
<fdd:urls>
<fdd:url>
<fdd:urlGroup>
<fdd:intro>Simson Garfinkel publications:</fdd:intro>
<fdd:urlList>
<fdd:urlReference>
<link>https://doi.org/10.1109/sadfe.2009.12</link>
<tag>https://doi.org/10.1109/sadfe.2009.12</tag>
<comment>“Automating disk forensic processing with SleuthKit, XML and python.” 2009 Fourth International IEEE Workshop on Systematic Approaches to Digital Forensic Engineering, 2009</comment>
</fdd:urlReference>
<fdd:urlReference>
<link>https://doi.org/10.1016/j.diin.2011.11.002</link>
<tag>https://doi.org/10.1016/j.diin.2011.11.002</tag>
<comment>“Digital Forensics XML and the DFXML toolset.” Digital Investigation, vol. 8, no. 3–4, 2012, pp. 161–174</comment>
</fdd:urlReference>
<fdd:urlReference>
<link>https://hdl.handle.net/10945/44328</link>
<tag>https://hdl.handle.net/10945/44328</tag>
<comment>“DFXML and other standards.” Slide presentation presented at the Naval Postgraduate School, July 29, 2014.</comment>
</fdd:urlReference>
</fdd:urlList>
</fdd:urlGroup>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://doi.org/10.2218/ijdc.v12i2.581</link>
<tag>https://doi.org/10.2218/ijdc.v12i2.581</tag>
<comment>Nelson, Alexander, et al. “Navigating UNMOUNTABLE media with the Digital Forensics XML File System.” International Journal of Digital Curation, vol. 12, no. 2, 2017, pp. 309–326</comment>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://www.digitalpreservation.gov/meetings/documents/ndiipp13/Lee.pdf</link>
<tag>https://www.digitalpreservation.gov/meetings/documents/ndiipp13/Lee.pdf</tag>
<comment>Cal Lee, "Taking Bitstreams Seriously: Digital Forensics and the BitCurator Environment" Slide presentation. School of Information and Library Science University of North Carolina, Chapel Hill Digital Preservation 2013 July 23-25, 2013 Alexandria, Virginia</comment>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://docs.google.com/spreadsheets/u/0/d/1aiVUMP18H3eg5cUu-3y7fiKxdvVc4Jf7YIKRh5s5ZEQ/pub?output=html</link>
<tag>Farrell, Matthew. DFXML Tag Library v4.</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://forensics.wiki/regxml/</link>
<tag>Forensics Wiki DFXML entry.</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/ajnelson/regxml_extractor</link>
<tag>RegXML official documentation.</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://www.archivematica.org/en/docs/archivematica-1.14/user-manual/transfer/forensic/</link>
<tag>Archivematica adoption documentation</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://www.isobuster.com/dfxml-example.php</link>
<tag>IsoBuster adoption documentation</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/rene0/xbox360</link>
<tag>XBox 360 adoption documentation</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://bitcurator.github.io/documentation/BitCurator%20Walkthrough/BitCurator%20Walkthrough/#forensics-and-reporting</link>
<tag>BitCurator Walkthrough: Forensics and Reporting</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlGroup>
<fdd:intro>Wikidata references</fdd:intro>
<fdd:urlList>
<fdd:urlReference>
<link>https://www.wikidata.org/wiki/Q105855984</link>
<tag>Digital Forensics XML file format</tag>
</fdd:urlReference>
<fdd:urlReference>
<link>https://www.wikidata.org/wiki/Q16956577</link>
<tag>Digital Forensics XML language</tag>
</fdd:urlReference>
</fdd:urlList>
</fdd:urlGroup>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://www.loc.gov/preservation/digital/formats/fdd/fdd000406.shtml</link>
<tag>See also: Expert Witness Disk Image Format (EWF) Family</tag>
</fdd:urlReference>
</fdd:url>
<fdd:url>
<fdd:urlReference>
<link>https://github.com/ajnelson-nist/gddrescue_mapfile_to_dfxml/blob/a489a864fc5bdc761eafb92f302b90d5aaa7a4ce/tests/damage_sample_1/sample_file_system.dfxml</link>
<tag>ajnelson-nist/gddrescue_mapfile_to_dfxml. DXFML samle files.</tag>
</fdd:urlReference>
</fdd:url>
</fdd:urls>
</fdd:usefulReferences>
</fdd:FDD>