Autopsy Hex Report ---------------------------------------------------------------------- GENERAL INFORMATION File: C://key MD5 of recovered file: d41d8cd98f00b204e9800998ecf8427e - SHA-1 of recovered file: da39a3ee5e6b4b0d3255bfef95601890afd80709 - Image: '/var/lib/autopsy/defcon/forensics/images/f100_6db079ca91c4860f.bin' Offset: 31 to 31588 File System Type: ntfs Date Generated: Thu May 27 00:48:59 2010 Investigator: unknown ---------------------------------------------------------------------- META DATA INFORMATION MFT Entry Header Values: Entry: 38 Sequence: 2 $LogFile Sequence Number: 1072197 Not Allocated File Links: 1 $STANDARD_INFORMATION Attribute Values: Flags: Archive Owner ID: 0 Created: Wed May 19 00:45:50 2010 File Modified: Wed May 19 02:31:59 2010 MFT Modified: Wed May 19 02:31:59 2010 Accessed: Wed May 19 00:45:50 2010 $FILE_NAME Attribute Values: Flags: Archive Name: key Parent MFT Entry: 5 Sequence: 5 Allocated Size: 0 Actual Size: 0 Created: Wed May 19 02:31:59 2010 File Modified: Wed May 19 02:31:59 2010 MFT Modified: Wed May 19 02:31:59 2010 Accessed: Wed May 19 02:31:59 2010 Attributes: Type: $STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72 Type: $FILE_NAME (48-2) Name: N/A Resident size: 72 Type: $DATA (128-1) Name: $Data Resident size: 0 Type: $DATA (128-3) Name: Zone.Identifier Resident size: 26 File Type: writable, no read permission ---------------------------------------------------------------------- CONTENT ---------------------------------------------------------------------- VERSION INFORMATION Autopsy Version: 2.08 The Sleuth Kit Version: 2.52