The ByteRunType is used for representing a single byte run from within a raw object.
| Field Name | Type | Description |
|---|---|---|
| Offset0..1 | IntegerObjectPropertyType |
The Offset field specifies the offset of the beginning of the byte run as measured from the beginning of the object. |
| Byte_Order0..1 | EndiannessType |
The Byte_Order field specifies the endianness of the unpacked (e.g., unencoded, unencrypted, etc.) data contained within the Byte_Run_Data field. |
| File_System_Offset0..1 | IntegerObjectPropertyType |
The File_System_Offset field is relevant only for byte runs of files in forensic analysis.It specifies the offset of the beginning of the byte run as measured from the beginning of the relevant file system. |
| Image_Offset0..1 | IntegerObjectPropertyType |
The Image_Offset field is provided for forensic analysis purposes and specifies the offset of the beginning of the byte run as measured from the beginning of the relevant forensic image. |
| Length0..1 | IntegerObjectPropertyType |
The Length field specifies the number of bytes in the byte run. |
| Hashes0..1 | HashListType |
The Hashes field contains computed hash values for this the data in this byte run. |
| Byte_Run_Data0..1 | anyType |
The Byte_Run_Data field contains a raw dump of the byte run data, typically enclosed within an XML CDATA section. |