https://cacontology.projectvic.org/forensics#ForensicImage
A bit-for-bit copy of digital media created using forensically sound methods, maintaining evidence integrity.
Instances of cacontology-forensics:ForensicImage can have the following properties:
| PROPERTY | TYPE | DESCRIPTION | RANGE |
|---|
By the associated SHACL property shapes, instances of cacontology-forensics:ForensicImage can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| cacontology-forensics:ForensicImage | |||||||
| cacontology-forensics:acquisitionMethod | owl:DatatypeProperty | The method used for forensic acquisition (e.g., 'physical', 'logical', 'live', 'chip-off'). sh:message Forensic image must specify acquisition method from the allowed list. |
1 | 1 | xsd:string |
sh:in
physical_imaging, logical_imaging, live_imaging, chip_off, jtag, selective_imaging
|
xsd:string |
cacontology-forensics:compressionUsed |
-- | sh:message Must specify if compression was used (gUFO quality aspect) |
0 | 1 | xsd:boolean | -- | |
cacontology-forensics:imageFormat |
-- | sh:message Image format must be E01, DD, AFF, VMDK, or VHD |
0 | 1 | xsd:string |
sh:in
E01, DD, AFF, VMDK, VHD
|
-- |
cacontology-forensics:imageIntegrity |
-- | sh:message Image integrity must be verified, corrupted, or unknown (gUFO quality aspect) |
0 | 1 | xsd:string |
sh:in
verified, corrupted, unknown
|
-- |
| cacontology-forensics:sourceHash | owl:ObjectProperty | Links a forensic image to the hash of its source media for verification. sh:message A forensic image must have at least one source hash for verification |
1 | * | uco-core:UcoObject | uco-types:Hash | |
| cacontology-forensics:verificationHash | owl:ObjectProperty | Links a forensic artifact to its verification hash digest for integrity checking. sh:message A forensic image must have at least one verification hash |
1 | * | uco-core:UcoObject | uco-types:Hash | |
| cacontology-forensics:writeBlockingUsed | owl:DatatypeProperty | Indicates whether write-blocking hardware or software was used during acquisition. sh:message Forensic image must specify if write blocking was used. |
1 | 1 | xsd:boolean | xsd:boolean | |
gufo:hasBeginPointInXSDDateTimeStamp |
-- | sh:message Forensic image must have creation timestamp (gUFO temporal) |
1 | 1 | xsd:dateTimeStamp | -- | |
rdfs:comment |
-- | sh:message Comment should be between 10 and 1000 characters when provided. |
0 | 1 | xsd:string |
sh:minLength
10
sh:maxLength
1000
|
-- |
rdfs:label |
-- | sh:message Label should be between 5 and 200 characters when provided. |
0 | 1 | xsd:string |
sh:minLength
5
sh:maxLength
200
|
-- |
uco-core:createdTime |
-- | sh:message Forensic image must specify creation time. |
1 | 1 | xsd:dateTime | -- | |
uco-core:sizeInBytes |
-- | sh:message Image size must be between 0 and 1TB (in bytes). |
0 | 1 | xsd:decimal |
sh:minInclusive
0.0
sh:maxInclusive
1000000000000.0
|
-- |
| cac-core:Artifact | |||||||
rdfs:label |
-- | label Every artifact should have at least one human-readable label. |
1 | * | xsd:string | -- | |
| cac-core:EnduringEntity | |||||||
(gufo:hasBeginPointInXSDDateTimeStamp | gufo:hasEndPointInXSDDateTimeStamp) |
-- | sh:message gUFO Objects should have temporal existence markers when applicable. |
0 | * | -- | ||
@prefix cac-core: <https://cacontology.projectvic.org/core#> .
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
cacontology-forensics:ForensicImage a owl:Class ;
rdfs:label "Forensic Image"@en ;
rdfs:comment "A bit-for-bit copy of digital media created using forensically sound methods, maintaining evidence integrity."@en ;
rdfs:subClassOf cac-core:Artifact,
uco-observable:Image .