<?xml version="1.0" encoding="utf-16" ?>
<xs:schema targetNamespace="urn:forensic_acquisition_utilities" elementFormDefault="qualified"
	xmlns="urn:forensic_acquisition_utilities http://www.gmgsystemsinc.com/fau/forensic_acquisition_utilities.xsd"
	xmlns:fau="urn:forensic_acquisition_utilities" xmlns:mstns="http://tempuri.org/XMLSchema.xsd"
	xmlns:xs="http://www.w3.org/2001/XMLSchema" version="1.0.0.17">
	<xs:annotation>
		<xs:documentation>
		Forensic Acquisition Utilities security catalog schema.
		</xs:documentation>
	</xs:annotation>
	<xs:attributeGroup name="BoostSerializationAttributes">
		<xs:attribute name="class_id" type="xs:unsignedInt" use="optional" />
		<xs:attribute name="tracking_level" type="xs:unsignedInt" use="optional" />
		<xs:attribute name="version" type="xs:unsignedInt" use="optional" />
	</xs:attributeGroup>
	<xs:complexType name="MonitoredunsignedLong">
		<xs:simpleContent>
			<xs:extension base="xs:unsignedLong">
				<xs:attribute name="Changed" type="xs:boolean" use="optional" />
			</xs:extension>
		</xs:simpleContent>
	</xs:complexType>
	<xs:complexType name="FileDateTime">
		<xs:simpleContent>
			<xs:extension base="xs:dateTime">
				<xs:attribute name="Changed" type="xs:boolean" use="optional" />
				<xs:attribute name="Win32_filetime" type="xs:unsignedLong" use="optional" />
			</xs:extension>
		</xs:simpleContent>
	</xs:complexType>
	<xs:complexType name="Win32_FileAttributes">
		<xs:simpleContent>
			<xs:extension base="xs:unsignedInt">
				<xs:attribute name="Changed" type="xs:boolean" use="optional" />
				<xs:attribute name="Compressed" type="xs:boolean" use="optional" />
				<xs:attribute name="Directory" type="xs:boolean" use="optional" />
				<xs:attribute name="Encrypted" type="xs:boolean" use="optional" />
			</xs:extension>
		</xs:simpleContent>
	</xs:complexType>
	<xs:complexType name="Cryptographic_hash_error">
		<xs:simpleContent>
			<xs:extension base="xs:string">
			    <xs:attribute name="Win32_error" type="xs:unsignedInt" use="optional" />
				<xs:attribute name="Physical" type="xs:boolean" use="optional" />
				<xs:attribute name="Changed" type="xs:boolean" use="optional" />
			</xs:extension>
		</xs:simpleContent>
	</xs:complexType>
	<xs:complexType name="SecurityACL">
		<xs:simpleContent>
			<xs:extension base="xs:string">
				<xs:attribute name="Changed" type="xs:boolean" use="optional" />
			</xs:extension>
		</xs:simpleContent>
	</xs:complexType>
	<xs:complexType name="ObjectIdentifier">
		<xs:simpleContent>
			<xs:extension base="xs:hexBinary">
				<xs:attribute name="Changed" type="xs:boolean" use="optional" />
			</xs:extension>
		</xs:simpleContent>
	</xs:complexType>
	<xs:complexType name="NTFSObjectIdentifier">
		<xs:sequence>
			<xs:element name="ObjectId" type="fau:ObjectIdentifier" />
			<xs:element name="BirthVolumeId" type="fau:ObjectIdentifier" />
			<xs:element name="BirthObjectId" type="fau:ObjectIdentifier" />
			<xs:element name="DomainId" type="fau:ObjectIdentifier" />
		</xs:sequence>
		<xs:attribute name="Changed" type="xs:boolean" use="optional" />
	</xs:complexType>
	<xs:complexType name="Security_Catalog_Type">
		<xs:sequence>
			<xs:element name="Security_entry" type="fau:Catalog_entry" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attributeGroup ref="fau:General_info" />
	</xs:complexType>
	<xs:complexType name="Catalog_entry">
		<xs:sequence>
			<xs:element name="Thumbprint" type="fau:Cryptographic_hash" minOccurs="0" maxOccurs="unbounded" />
			<xs:element name="Thumbprint_error" type="fau:Cryptographic_hash_error" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attributeGroup ref="fau:Catalog_entry_attributes" />
	</xs:complexType>
	<xs:simpleType name="MetadataSortOrder">
		<xs:restriction base="xs:NCName">
			<xs:enumeration value="ascending" />
			<xs:enumeration value="descending" />
		</xs:restriction>
	</xs:simpleType>
	<xs:simpleType name="MetadataSortKey">
		<xs:restriction base="xs:NCName">
			<xs:enumeration value="Path" />
			<xs:enumeration value="FileAttributes" />
			<xs:enumeration value="CreationTime" />
			<xs:enumeration value="LastAccessTime" />
			<xs:enumeration value="LastWriteTime" />
			<xs:enumeration value="LogicalFileSize" />
			<xs:enumeration value="AlternateFileName" />
			<xs:enumeration value="FileSecurity" />
			<xs:enumeration value="Thumbprint" />
			<xs:enumeration value="Thumbprint_error" />
		</xs:restriction>
	</xs:simpleType>
	<xs:attributeGroup name="General_info">
		<xs:attribute name="Version" type="xs:string" />
		<xs:attribute name="SchemaVersion" type="xs:string" />
		<xs:attribute name="List_Identifier" type="xs:hexBinary" use="optional" />
		<xs:attribute name="Effective_Date" type="xs:dateTime" use="required" />
		<xs:attribute name="Toolset" type="xs:string" use="optional" />
		<xs:attribute name="Tool" type="xs:string" use="optional" />
		<xs:attribute name="Command_line" type="xs:string" use="optional" />
		<xs:attribute name="Logged_on_user" type="xs:string" use="optional" />
		<xs:attribute name="Case_number" type="xs:string" use="optional" />
		<xs:attribute name="Evidence_number" type="xs:string" use="optional" />
		<xs:attribute name="Description" type="xs:string" use="optional" />
		<xs:attribute name="Root" type="xs:string" use="optional" />
		<xs:attribute name="Collection_id" type="xs:string" use="optional" />
		<xs:attribute name="File_system" type="xs:NCName" use="optional" />
		<xs:attribute name="VolumeSerialNumber" type="xs:unsignedLong" use="optional" />
		<xs:attribute name="SortBy" type="fau:MetadataSortKey" use="optional" />
		<xs:attribute name="SortOrder" type="fau:MetadataSortOrder" use="optional" />
	</xs:attributeGroup>
	<xs:attributeGroup name="Catalog_entry_attributes">
		<xs:attribute name="Path" type="xs:string" use="optional" />
		<xs:attribute name="ReferenceNumber" type="xs:unsignedLong" use="optional" />
		<xs:attribute name="Abstract" type="xs:boolean" use="optional" />
		<xs:attribute name="Physical" type="xs:boolean" use="optional" />
		<xs:attribute name="Changed" type="xs:boolean" use="optional" />		
	</xs:attributeGroup>
	<xs:attributeGroup name="dd_contents_entry_attributes">
		<xs:attribute name="SequenceIdentifier" type="xs:unsignedInt" use="required" />
		<xs:attribute name="StartingOffset" type="xs:unsignedLong" use="required" />
		<xs:attribute name="Compressed" type="xs:boolean" use="optional" />
		<xs:attribute name="CompressionAlgorithm" type="xs:string" use="optional" />
	</xs:attributeGroup>
	<xs:complexType name="dd_scatter_gather_contents_type">
		<xs:sequence>
			<xs:element name="count" type="xs:unsignedInt" minOccurs="1" maxOccurs="1" />		
			<xs:element name="item" type="fau:dd_scatter_gather_contents_entry" minOccurs="0" maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attributeGroup ref="fau:General_info" />
	</xs:complexType>
	<xs:complexType name="dd_scatter_gather_contents_entry">
		<xs:sequence>
			<xs:element name="FileName" type="xs:string"/>
		</xs:sequence>
		<xs:attributeGroup ref="fau:dd_contents_entry_attributes" />
	</xs:complexType>
	<xs:complexType name="SecurityPrinciple">
		<xs:sequence>
			<xs:element name="AccountName" type="xs:string" minOccurs="0" maxOccurs="1" />
			<xs:element name="SID" type="xs:string" />
		</xs:sequence>
		<xs:attribute name="Changed" type="xs:boolean" use="optional" />
	</xs:complexType>
	<xs:complexType name="File_security_information_type">
		<xs:sequence>
			<xs:element name="Owner" type="fau:SecurityPrinciple" minOccurs="0" maxOccurs="1"/>
			<xs:element name="PrimaryGroup" type="fau:SecurityPrinciple" minOccurs="0" maxOccurs="1"/>
			<xs:element name="DACL" type="fau:SecurityACL" minOccurs="0" maxOccurs="1"/>
			<xs:element name="SACL" type="fau:SecurityACL" minOccurs="0" maxOccurs="1"/>
		</xs:sequence>
		<xs:attribute name="Changed" type="xs:boolean" use="optional" />
	</xs:complexType>
	<xs:complexType name="Cryptographic_hash">
		<xs:sequence>
			<xs:element name="Hash_value" type="xs:hexBinary" minOccurs="0" maxOccurs="1" />
		</xs:sequence>
		<xs:attribute name="Algorithm" type="xs:string" />
		<xs:attribute name="Physical" type="xs:boolean" />
		<xs:attribute name="Compressed" type="xs:boolean" use="optional" />
		<xs:attribute name="Compression_algorithm" type="xs:string" use="optional" />
		<xs:attribute name="Changed" type="xs:boolean" use="optional" />
	</xs:complexType>
  <xs:simpleType name="FiletimeFieldType">
    <xs:restriction base="xs:unsignedInt">
      <xs:minInclusive value="0" />
      <xs:maxInclusive value="4" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="FiletimeFieldName">
    <xs:restriction base="xs:string">
      <xs:enumeration value="NoTime" />
      <xs:enumeration value="CreationTime" />
      <xs:enumeration value="LastAccessTime" />
      <xs:enumeration value="LastWriteTime" />
      <xs:enumeration value="EntryModifiedTime" />
    </xs:restriction>
  </xs:simpleType>
	<xs:complexType name="FileStandardInformation">
		<xs:sequence>
			<xs:element name="FileAttributes" type="fau:Win32_FileAttributes" minOccurs="0" maxOccurs="1"/>
			<xs:element name="CreationTime" type="fau:FileDateTime" minOccurs="0" maxOccurs="1"/>
			<xs:element name="LastAccessTime" type="fau:FileDateTime" minOccurs="0" maxOccurs="1"/>
			<xs:element name="LastWriteTime" type="fau:FileDateTime" minOccurs="0" maxOccurs="1"/>
			<xs:element name="LogicalFileSize" type="fau:MonitoredunsignedLong" minOccurs="0" maxOccurs="1"/>
			<xs:element name="AlternateFileName" type="xs:string" minOccurs="0" maxOccurs="1"/>
			<xs:element name="PhysicalFileSize" type="fau:MonitoredunsignedLong" minOccurs="0" maxOccurs="1"/>
      <xs:element name="EntryModifiedTime" type="fau:FileDateTime" minOccurs="0" maxOccurs="1" />
      <xs:element name="TimelineTime" type="fau:FileDateTime" minOccurs="0" maxOccurs="1" />
		</xs:sequence>
    <xs:attribute name="TimelineField" type="fau:FiletimeFieldType" use="optional" />
		<xs:attribute name="Changed" type="xs:boolean" use="optional" />
	</xs:complexType>
	<xs:complexType name="File_metadata_catalog_entry_type">
		<xs:sequence>
		    <xs:element name="StandardInformation" type="fau:FileStandardInformation" minOccurs="0" maxOccurs="1" />
			<xs:element name="OID" type="fau:NTFSObjectIdentifier" minOccurs="0" maxOccurs="1" />
			<xs:element name="FileSecurity" type="fau:File_security_information_type" minOccurs="0" maxOccurs="1" />
			<xs:element name="Security_entry" type="fau:Catalog_entry" minOccurs="0" maxOccurs="2" />
		</xs:sequence>
		<xs:attributeGroup ref="fau:Catalog_entry_attributes" />
	</xs:complexType>
	<xs:complexType name="File_metadata_catalog_type">
		<xs:sequence>
			<xs:element name="Metadata_entry" type="fau:File_metadata_catalog_entry_type" minOccurs="0"
				maxOccurs="unbounded" />
		</xs:sequence>
		<xs:attributeGroup ref="fau:General_info" />
	</xs:complexType>
  <xs:complexType name="process_module_entry">
    <xs:sequence>
    </xs:sequence>
    <xs:attribute name="Name" type="xs:string" use="required" />
    <xs:attribute name="Path" type="xs:string" use="required" />
    <xs:attribute name="BaseAddress" type="xs:unsignedLong" use="required" />
    <xs:attribute name="Size" type="xs:unsignedLong" use="optional" />
  </xs:complexType>
  <xs:complexType name="process_module_table" >
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:process_module_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="process_snap_entry">
    <xs:sequence>
      <xs:element name="NumberOfThreads" type="xs:unsignedInt" />
      <xs:element name="Modules" type="fau:process_module_table" />
    </xs:sequence>
    <xs:attribute name="Name" type="xs:string" use="required" />
    <xs:attribute name="Path" type="xs:string" use="optional" />
    <xs:attribute name="Pid" type="xs:unsignedInt" use="required" />
    <xs:attribute name="PPid" type="xs:unsignedInt" use="required" />
  </xs:complexType>
  <xs:complexType name="process_snapshot">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:process_snap_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:simpleType name="mib_connection_state">
    <xs:restriction base="xs:integer">
      <xs:minInclusive value="0" />
      <xs:maxInclusive value="12" />
    </xs:restriction>
  </xs:simpleType>
  <xs:simpleType name="mib_connection_state_name">
    <xs:annotation>
      <xs:documentation>
        String equivalents of the mib_connection_state states defined above.
      </xs:documentation>
    </xs:annotation>
    <xs:restriction base="xs:NCName">
      <xs:enumeration value="Unknown" />
      <xs:enumeration value="Close" />
      <xs:enumeration value="Listen" />
      <xs:enumeration value="SYNSent" />
      <xs:enumeration value="SYNReceived" />
      <xs:enumeration value="Established" />
      <xs:enumeration value="FinWait1" />
      <xs:enumeration value="FinWait2" />
      <xs:enumeration value="CloseWait" />
      <xs:enumeration value="Closing" />
      <xs:enumeration value="LastAck" />
      <xs:enumeration value="TimeWait"/>
    </xs:restriction>
  </xs:simpleType>  
  <xs:complexType name="ipv4_connection_table_entry">
    <xs:sequence>
      <xs:element name="LocalAddress" type="xs:unsignedInt" />
      <xs:element name="Protocol" type="xs:unsignedShort" />
      <xs:element name="LocalPort" type="xs:unsignedShort" />
      <xs:element name="RemoteAddress" type="xs:unsignedInt" />
      <xs:element name="RemotePort" type="xs:unsignedShort" />
      <xs:element name="LocalAddressString" type="xs:string" />
      <xs:element name="RemoteAddressString" type="xs:string" />
    </xs:sequence>
    <xs:attribute name="ConnectionState" type="fau:mib_connection_state" />
    <xs:attribute name="ProcessId" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="ipv4_connection_table">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:ipv4_connection_table_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="if_table_entry">
    <xs:sequence>
      <xs:element name="Type" type="xs:unsignedInt" />
      <xs:element name="Mtu" type="xs:unsignedInt" />
      <xs:element name="Speed" type="xs:unsignedInt" />
      <xs:element name="AdminStatus" type="xs:unsignedInt" />
      <xs:element name="OperatingStatus" type="xs:unsignedInt" />
      <xs:element name="LastChange" type="xs:unsignedInt" />
      <xs:element name="InOctets" type="xs:unsignedInt" />
      <xs:element name="InUcastPkts" type="xs:unsignedInt" />
      <xs:element name="InNUcastPkts" type="xs:unsignedInt" />
      <xs:element name="InDiscards" type="xs:unsignedInt" />
      <xs:element name="InErrors" type="xs:unsignedInt" />
      <xs:element name="InUnknownProtos" type="xs:unsignedInt" />
      <xs:element name="OutOctets" type="xs:unsignedInt" />
      <xs:element name="OutUcastPkts" type="xs:unsignedInt" />
      <xs:element name="OutNUcastPkts" type="xs:unsignedInt" />
      <xs:element name="OutDiscards" type="xs:unsignedInt" />
      <xs:element name="OutErrors" type="xs:unsignedInt" />
      <xs:element name="OutQLen" type="xs:unsignedInt" />
    </xs:sequence>
    <xs:attribute name="Index" type="xs:unsignedInt" use="required" />
    <xs:attribute name="PhysicalAddress" type="xs:string" use="required" />
    <xs:attribute name="Description" type="xs:string" use="optional" />
  </xs:complexType>
  <xs:complexType name="if_table">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:if_table_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ipv4_forward_table_entry" >
    <xs:sequence>
      <xs:element name="DestinationString" type="xs:string" />
      <xs:element name="MaskString" type="xs:string" />
      <xs:element name="NextHopString" type="xs:string" />
      <xs:element name="IfIndex" type="xs:unsignedInt" />
      <xs:element name="Metric1" type="xs:unsignedInt" />
    </xs:sequence>
    <xs:attribute name="Destination" type="xs:unsignedInt" />
    <xs:attribute name="Mask" type="xs:unsignedInt" />
    <xs:attribute name="Policy" type="xs:unsignedInt" />
    <xs:attribute name="NextHop" type="xs:unsignedInt" />
    <xs:attribute name="Type" type="xs:unsignedInt" />
    <xs:attribute name="Proto" type="xs:unsignedInt" />
    <xs:attribute name="Age" type="xs:unsignedInt" />
    <xs:attribute name="NextHopAS" type="xs:unsignedInt" />
    <xs:attribute name="Metric2" type="xs:unsignedInt" />
    <xs:attribute name="Metric3" type="xs:unsignedInt" />
    <xs:attribute name="Metric4" type="xs:unsignedInt" />
    <xs:attribute name="Metric5" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="ipv4_forward_table">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:ipv4_forward_table_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="ipv4_net_table_entry">
    <xs:sequence>
      <xs:element name="AddressString" type="xs:string" />
      <xs:element name="PhysicalAddressString" type="xs:string" />
    </xs:sequence>
    <xs:attribute name="Index" type="xs:unsignedInt" />
    <xs:attribute name="Address" type="xs:unsignedInt" />
    <xs:attribute name="Type" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="ipv4_net_table">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:ipv4_net_table_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="dns_resolver_cache_entry">
    <xs:sequence>
      <xs:element name="Type" type="xs:unsignedInt" />
      <xs:element name="Ttl" type="xs:unsignedInt" />
      <xs:element name="Section" type="xs:unsignedInt" />
      <xs:element name="Data" type="xs:string" />
    </xs:sequence>
    <xs:attribute name="Name" type="xs:string" use="required" />
  </xs:complexType>
  <xs:complexType name="dns_resolver_cache">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:dns_resolver_cache_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="desktop_window">
    <xs:sequence>
      <xs:element name="ProcessId" type="xs:unsignedInt" />
      <xs:element name="ThreadId" type="xs:unsignedInt" />
      <xs:element name="Unicode" type="xs:boolean" />
      <xs:element name="Visible" type="xs:boolean" />
    </xs:sequence>
    <xs:attribute name="Handle" type="xs:unsignedLong" />
    <xs:attribute name="WindowText" type="xs:string" use="optional" />
  </xs:complexType>
  <xs:complexType name="desktop_window_list">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:desktop_window" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="lm_session_entry" >
    <xs:sequence>
      <xs:element name="Opens" type="xs:unsignedInt" />
      <xs:element name="Time" type="xs:unsignedInt" />
      <xs:element name="IdleTime" type="xs:unsignedInt" />
      <xs:element name="UserFlags" type="xs:unsignedInt" />
      <xs:element name="ClientType" type="xs:string" />
      <xs:element name="Transport" type="xs:string" />
    </xs:sequence>
    <xs:attribute name="CName" type="xs:string" />
    <xs:attribute name="UserName" type="xs:string" />
  </xs:complexType>
  <xs:complexType name="lm_session_table">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:lm_session_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="UnknownResourceEntry">
    <xs:sequence>
    </xs:sequence>
    <xs:attribute  name="Type" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="UnknownResourceList">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:UnknownResourceEntry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="MemoryResourceEntry">
    <xs:sequence>
      <xs:element name="BaseAddress" type="xs:unsignedLong" />
      <xs:element name="EndAddress" type="xs:unsignedLong" />
    </xs:sequence>
    <xs:attribute name="Flags" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="MemoryResourceList">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:MemoryResourceEntry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="IoResourceEntry">
    <xs:sequence>
      <xs:element name="BaseAddress" type="xs:unsignedLong" />
      <xs:element name="EndAddress" type="xs:unsignedLong" />
    </xs:sequence>
    <xs:attribute name="Flags" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="IoResourceList">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:IoResourceEntry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="DmaResourceEntry">
    <xs:sequence>
      <xs:element name="Channel" type="xs:unsignedInt" />
    </xs:sequence>
    <xs:attribute name="Flags" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="DmaResourceList">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:DmaResourceEntry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="IrqResourceEntry">
    <xs:sequence>
      <xs:element name="IRQ" type="xs:unsignedInt" />
      <xs:element name="Affinity" type="xs:unsignedLong" />
    </xs:sequence>
    <xs:attribute name="Flags" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="IrqResourceList">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:IrqResourceEntry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="BusNumberResourceEntry">
    <xs:sequence>
      <xs:element name="Base" type="xs:unsignedInt" />
      <xs:element name="End" type="xs:unsignedInt" />
    </xs:sequence>
    <xs:attribute name="Flags" type="xs:unsignedInt" />
  </xs:complexType>
  <xs:complexType name="BusNumberResourceList">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:BusNumberResourceEntry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="PNPDeviceResourceEntry">
    <xs:sequence>
      <xs:element name="MemoryResources" type="fau:MemoryResourceList" minOccurs="0" maxOccurs="unbounded" />
      <xs:element name="IoResources" type="fau:IoResourceList" minOccurs="0" maxOccurs="unbounded" />
      <xs:element name="DmaResources" type="fau:DmaResourceList" minOccurs="0" maxOccurs="unbounded" />
      <xs:element name="IrqResources" type="fau:IrqResourceList" minOccurs="0" maxOccurs="unbounded" />
      <xs:element name="BusNumberResources" type="fau:BusNumberResourceList" minOccurs="0" maxOccurs="unbounded" />
      <xs:element name="UnknownResources" type="fau:UnknownResourceList" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
    <xs:attribute name="InstanceID" type="xs:string" />
    <xs:attribute name="SymbolicLinkName" type="xs:string" />
    <xs:attribute name="FriendlyName" type="xs:string" />
    <xs:attribute name="Class" type="xs:string" />
    <xs:attribute name="ClassDescription" type="xs:string" />
    <xs:attribute name="DeviceDescription" type="xs:string" />
    <xs:attribute name="Driver" type="xs:string" />
    <xs:attribute name="DriverVersion" type="xs:string" />
    <xs:attribute name="DriverLastAccessTime" type="xs:dateTime" use="optional" />
    <xs:attribute name="Active" type="xs:boolean" use="optional" />
    <xs:attribute name="Default" type="xs:boolean" use="optional" />
    <xs:attribute name="Removed" type="xs:boolean" use="optional" />
  </xs:complexType>
  <xs:complexType name="PNPDeviceResourceList">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:PNPDeviceResourceEntry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
  </xs:complexType>
  <xs:complexType name="user_system_state_type">
    <xs:sequence>
      <xs:element name="ProcessSnapshot" type="fau:process_snapshot" />
      <xs:element name="ConnectionTable" type="fau:ipv4_connection_table" />
      <xs:element name="IfTable" type="fau:if_table" />
      <xs:element name="Ipv4ForwardTable" type="fau:ipv4_forward_table" />
      <xs:element name="DNSResolverCache" type="fau:dns_resolver_cache" />
      <xs:element name="DesktopWindows" type="fau:desktop_window_list" minOccurs="0" />
      <xs:element name="ArpCache" type="fau:ipv4_net_table" minOccurs="0" />
      <xs:element name="Sessions" type="fau:lm_session_table" minOccurs="0" />
      <xs:element name="PNPDeviceResources" type="fau:PNPDeviceResourceList" minOccurs="0" />
    </xs:sequence>
    <xs:attributeGroup ref="fau:General_info" />
  </xs:complexType>
  <xs:complexType name="system_file_check_catalog_entry">
    <xs:sequence>
      <xs:element name="Catalog" type="xs:string" minOccurs="0" maxOccurs="1" />
      <xs:element name="Hash" type="xs:hexBinary" minOccurs="0"  maxOccurs="1" />
      <xs:element name="HashError" type="xs:string" minOccurs="0" maxOccurs="1" />
    </xs:sequence>
    <xs:attribute name="Path" type="xs:string" use="required" />
    <xs:attribute name="Ok" type="xs:boolean" use="required" />
  </xs:complexType>
  <xs:complexType name="system_file_check_catalog">
    <xs:sequence>
      <xs:element name="count" type="xs:unsignedInt" />
      <xs:element name="item" type="fau:system_file_check_catalog_entry" minOccurs="0" maxOccurs="unbounded" />
    </xs:sequence>
    <xs:attributeGroup ref="fau:General_info" />
  </xs:complexType>
	<xs:element name="Security_catalog" type="fau:Security_Catalog_Type" />
	<xs:element name="dd_contents" type="fau:dd_scatter_gather_contents_type" />
	<xs:element name="File_metadata_catalog" type="fau:File_metadata_catalog_type" />
  <xs:element name="UserSystemState" type="fau:user_system_state_type" />
  <xs:element name="SFCCatalog" type="fau:system_file_check_catalog" />
</xs:schema>