@port139 Blog

基本的にはデジタル・フォレンジックの技術について取り扱っていますが、記載内容には高確率で誤りが含まれる可能性があります。

Volume_Dump(beta2rc2-interim)

いずれも Windows Server 2003 SP1 上の NTFS ボリューム、マウントポイントは無し。
スパンボリュームの結果

ボリューム名: \\?\Volume{0d6a0ed6-2aeb-4435-b87f-c474ec5d5b22}
説明: Span Volume
Mount Points:
Drive Type: Fixed
ボリューム シリアル番号: 28b8-efb6
Maximum Component Length: 255

Volume Characteristics:
File system preserves case
File system supports case sensitive file names
File system supports Unicode file names
File system preserves and supports persistent ACL's
File system supports file level compression
File system supports named streams
File system supports encryption
File system supports object identifiers
File system supports reparse points
File system supports sparse files
File system supports quotas
ファイル システム: NTFS
Mounted: Yes
Clustered: いいえ
Volume length:
Disk Number: 1
Starting Offset: 0x0000000000007e00
Extent Length: 0x000000003fe00000
Disk Number: 2
Starting Offset: 0x0000000000007e00
Extent Length: 0x0000000006500000

ストライプ ボリュームの結果

ボリューム名: \\?\Volume{149b6bc9-93a2-4f55-b213-199e88eb99b3}
説明: ストライプ
Mount Points:
Drive Type: Fixed
ボリューム シリアル番号: d890-84bc
Maximum Component Length: 255

Volume Characteristics:
File system preserves case
File system supports case sensitive file names
File system supports Unicode file names
File system preserves and supports persistent ACL's
File system supports file level compression
File system supports named streams
File system supports encryption
File system supports object identifiers
File system supports reparse points
File system supports sparse files
File system supports quotas
ファイル システム: NTFS
Mounted: Yes
Clustered: いいえ
Volume length:
Disk Number: 1
Starting Offset: 0x0000000000007e00
Extent Length: 0x0000000006500000
Disk Number: 2
Starting Offset: 0x0000000000007e00
Extent Length: 0x0000000006500000

RAID-5ボリュームのダンプ

ボリューム名: \\?\Volume{5841a655-f02b-4ec7-a060-29e665b64585}
説明: RAID5
Mount Points:
Drive Type: Fixed
ボリューム シリアル番号: a81d-5fc9
Maximum Component Length: 255

Volume Characteristics:
File system preserves case
File system supports case sensitive file names
File system supports Unicode file names
File system preserves and supports persistent ACL's
File system supports file level compression
File system supports named streams
File system supports encryption
File system supports object identifiers
File system supports reparse points
File system supports sparse files
File system supports quotas
ファイル システム: NTFS
Mounted: Yes
Clustered: いいえ
Volume length:
Disk Number: 4
Starting Offset: 0x0000000000007e00
Extent Length: 0x0000000006500000
Disk Number: 3
Starting Offset: 0x0000000000007e00
Extent Length: 0x0000000006500000
Disk Number: 5
Starting Offset: 0x0000000000007e00
Extent Length: 0x0000000006500000