diff --git a/4_MFT Attributes/0x60_$VOLUME_NAME/$VOLUME_NAME.png b/4_MFT Attributes/0x60_$VOLUME_NAME/$VOLUME_NAME.png new file mode 100644 index 0000000..7fd5741 Binary files /dev/null and b/4_MFT Attributes/0x60_$VOLUME_NAME/$VOLUME_NAME.png differ diff --git a/4_MFT Attributes/0x60_$VOLUME_NAME/$VOLUME_NAME.svg b/4_MFT Attributes/0x60_$VOLUME_NAME/$VOLUME_NAME.svg new file mode 100644 index 0000000..0535db9 --- /dev/null +++ b/4_MFT Attributes/0x60_$VOLUME_NAME/$VOLUME_NAME.svg @@ -0,0 +1,486 @@ + + + + + + + + + + image/svg+xml + + + + + + + + + $VOLUME_NAMEATTRIBUTE + 60 00 00 00 20 00 00 00 00 00 18 00 00 00 04 0008 00 00 00 18 00 00 00 76 00 6F 00 6C 00 30 00 + + + attribute typetotal sizenon resident flagname lengthname offsetflagsidattribute sizeattribute offsetindex flag + + CommonHeader + REsidentHeader + + VolumeName + + By: Jared AtkinsonTemplate by: Ange Albertini + + 0x60 - volume name0x200x00 - resident0x000x180x000x040x080x180x00 + + Fields + + Values + + + + + vol0 + + diff --git a/4_MFT Attributes/0x80_$DATA/$DATA.png b/4_MFT Attributes/0x80_$DATA/$DATA.png index 4a8e78c..07fd825 100644 Binary files a/4_MFT Attributes/0x80_$DATA/$DATA.png and b/4_MFT Attributes/0x80_$DATA/$DATA.png differ diff --git a/4_MFT Attributes/0x80_$DATA/$DATA.svg b/4_MFT Attributes/0x80_$DATA/$DATA.svg index 9c98adf..84fa3ba 100644 --- a/4_MFT Attributes/0x80_$DATA/$DATA.svg +++ b/4_MFT Attributes/0x80_$DATA/$DATA.svg @@ -17,7 +17,7 @@ version="1.1" inkscape:version="0.91 r13725" sodipodi:docname="$DATA.svg" - inkscape:export-filename="C:\Users\Uproot\Documents\GitHub\Forensic-Posters\4_MFT Attributes\0x30_$FILE_NAME\$FILE_NAME.png" + inkscape:export-filename="C:\Users\Uproot\Documents\GitHub\Forensic-Posters\4_MFT Attributes\0x80_$DATA\$DATA.png" inkscape:export-xdpi="300" inkscape:export-ydpi="300"> image/svg+xml - + @@ -117,7 +117,9 @@ style="fill:#808000" id="tspan3685"> 38 00 00 00 00 00 00 00 18 000D 00 0A 00 00 00 00 00 + id="tspan3681">0D 00 0A 00 48 - filename0x80 - data0x780x380x000x180x020x010x5E0x1C0x010x00