Created By AccessData® FTK® Imager 4.7.1.2 

Case Information: 
Acquired using: ADI4.7.1.2
Case Number: 
Evidence Number: 
Unique Description: 
Examiner: 
Notes: 

--------------------------------------------------------------

Information for E:\HackInBo 2023\zanhotel_#1_sda2_root_hotspots.ad1:
[Custom Content Sources]
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|Users|utente|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|ProgramData|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|Program Files (x86)|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|Program Files|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|Intel|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|Documents and Settings|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$Recycle.Bin|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$Extend|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$AttrDef(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$BadClus|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$Bitmap|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$Boot(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$I30(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$LogFile(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$MFT(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$MFTMirr(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$Secure|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$TXF_DATA(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$UpCase|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|$Volume(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|bootmgr(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|BOOTNXT(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|DumpStack.log.tmp(Exact)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|Windows|Prefetch|*(Wildcard,Consider Case,Include Subdirectories)
 zanhotel_#1_sda2_root_decrypted.E01:NONAME [NTFS]|[root]|Windows|System32|config|*(Wildcard,Consider Case,Include Subdirectories)
[Computed Hashes]
 MD5 checksum:    1ca37c55fca0aa0f829de5a0da809a54
 SHA1 checksum:   1ef64f4c657064054b8c2996c58322b76dd164af

Image information:
 Acquisition started:   Thu Jun  8 16:27:50 2023
 Acquisition finished:  Thu Jun  8 16:44:13 2023
 Segment list:
  E:\HackInBo 2023\zanhotel_#1_sda2_root_hotspots.ad1