https://cacontology.projectvic.org/forensics#K9AssistedForensics
Forensic process enhanced by K9 detection capabilities for electronic storage devices.
Instances of cacontology-forensics:K9AssistedForensics can have the following properties:
| PROPERTY | TYPE | DESCRIPTION | RANGE |
|---|
By the associated SHACL property shapes, instances of cacontology-forensics:K9AssistedForensics can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| cacontology-forensics:K9AssistedForensics | |||||||
| cacontology-forensics:k9AssistanceProvided | owl:DatatypeProperty | Whether K9 assistance was provided during forensic acquisition. sh:message K9 assisted forensics must specify if K9 assistance was provided. |
1 | 1 | xsd:boolean | xsd:boolean | |
uco-core:startTime |
-- | sh:message K9 assisted forensics must specify start time. |
1 | 1 | xsd:dateTime | -- | |
| cacontology-forensics:ForensicAcquisitionAction | |||||||
cacontology-forensics:acquisitionCompleteness |
-- | sh:message Acquisition completeness must be between 0.0 and 1.0 (gUFO quality aspect) |
0 | 1 | xsd:double |
sh:minInclusive
0.0
sh:maxInclusive
1.0
|
-- |
| cacontology-forensics:acquisitionMethod | owl:DatatypeProperty | The method used for forensic acquisition (e.g., 'physical', 'logical', 'live', 'chip-off'). sh:message Acquisition method must be one of: physical, logical, live, remote, network; Forensic acquisition must specify acquisition method from the allowed list. |
1 | 1 | xsd:string |
sh:in
physical, logical, live, chip_off, jtag, selective, remote, network
|
xsd:string |
cacontology-forensics:acquisitionQuality |
-- | sh:message Acquisition quality must be excellent, good, acceptable, or poor (gUFO quality aspect) |
0 | 1 | xsd:string |
sh:in
excellent, good, acceptable, poor
|
-- |
| cacontology-forensics:evidenceSeized | owl:ObjectProperty | Links an acquisition action to the original evidence item that was seized. sh:message A forensic acquisition action must specify at least one evidence item seized |
1 | * | uco-core:UcoObject | uco-observable:ObservableObject | |
| cacontology-forensics:forensicCopy | owl:ObjectProperty | Links an acquisition action to the forensic copy that was created. sh:message A forensic acquisition action must produce at least one forensic copy |
1 | * | cacontology-forensics:ForensicImage | cacontology-forensics:ForensicImage | |
| cacontology-forensics:writeBlockingUsed | owl:DatatypeProperty | Indicates whether write-blocking hardware or software was used during acquisition. sh:message A forensic acquisition action must specify whether write-blocking was used; Forensic acquisition must specify if write blocking was used. |
1 | 1 | xsd:boolean | xsd:boolean | |
gufo:hasBeginPointInXSDDateTimeStamp |
-- | sh:message Forensic acquisition must have exactly one begin timestamp (gUFO temporal) |
1 | 1 | xsd:dateTimeStamp | -- | |
gufo:hasEndPointInXSDDateTimeStamp |
-- | sh:message Forensic acquisition must have at most one end timestamp (gUFO temporal) |
0 | 1 | xsd:dateTimeStamp | -- | |
rdfs:comment |
-- | sh:message Comment should be between 10 and 1000 characters when provided. |
0 | 1 | xsd:string |
sh:minLength
10
sh:maxLength
1000
|
-- |
rdfs:label |
-- | sh:message Label should be between 5 and 200 characters when provided. |
0 | 1 | xsd:string |
sh:minLength
5
sh:maxLength
200
|
-- |
uco-action:usesTool |
-- | sh:message A forensic acquisition action must specify at least one tool used |
1 | * | uco-tool:Tool | -- | |
uco-core:endTime |
-- | sh:message Forensic acquisition may specify end time. |
0 | 1 | xsd:dateTime | -- | |
uco-core:startTime |
-- | sh:message Forensic acquisition must specify start time. |
1 | 1 | xsd:dateTime | -- | |
| cac-core:InvestigativeAction | |||||||
gufo:hasBeginPointInXSDDateTimeStamp |
-- | begin time |
0 | 1 | xsd:dateTimeStamp | -- | |
gufo:hasEndPointInXSDDateTimeStamp |
-- | end time |
0 | 1 | xsd:dateTimeStamp | -- | |
rdfs:label |
-- | label |
1 | * | xsd:string | -- | |
| cac-core:Event | |||||||
(cacontology-forensics:examinedBy | cacontology-forensics:performedBy | cacontology-forensics:witnessedBy | cacontology-forensics:authorizedBy) |
-- | sh:message Every forensic event must have at least one participant (gUFO participation) |
1 | * | -- | ||
(cacontology-grooming:targetsVictim | cacontology-grooming:performedBy | cacontology-grooming:witnessedBy | cacontology-grooming:facilitatedBy) |
-- | sh:message Every grooming event must have at least one participant (gUFO participation) |
1 | * | -- | ||
(cacontology-usa-federal:prosecutedBy | cacontology-usa-federal:investigatedBy | cacontology-usa-federal:defendedBy | cacontology-usa-federal:victimizedBy) |
-- | sh:message Every federal criminal event must have at least one participant |
1 | * | -- | ||
(gufo:hasBeginPointInXSDDateTimeStamp | cacontology-enterprises:hasCoercionEventBeginDate | cacontology-enterprises:hasInvestigationBeginDate) |
-- | sh:message gUFO Events must have at least one temporal beginning point. |
1 | * | -- | ||
gufo:hasBeginPointInXSDDateTimeStamp |
-- | begin time Optional temporal begin point for the event. sh:message Event can have at most one begin point; Forensic action must have at most one begin timestamp (gUFO temporal constraint); Grooming behavior must have at most one begin timestamp (gUFO temporal); Production event must have exactly one begin point. |
1 | 1 | xsd:dateTimeStamp | -- | |
gufo:hasEndPointInXSDDateTimeStamp |
-- | end time Optional temporal end point for the event. sh:message Event can have at most one end point; Forensic action must have at most one end timestamp (gUFO temporal constraint); Grooming behavior must have at most one end timestamp (gUFO temporal); Production event may have an end point. |
0 | 1 | xsd:dateTimeStamp | -- | |
rdfs:label |
-- | label Every event should have at least one human-readable label. |
1 | * | xsd:string | -- | |
| case-investigation:InvestigativeAction | |||||||
uco-action:endTime |
-- | sh:message When present, action endTime should be at most one xsd:dateTime literal. |
0 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
uco-action:object |
-- | sh:message Action must reference at least one object IRI. |
1 | * | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:performer |
-- | sh:message Action must have exactly one performer IRI. |
1 | 1 | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:result |
-- | sh:message When present, action result values should be IRI nodes. |
0 | * | sh:IRI |
sh:severity
sh:Warning
|
-- |
uco-action:startTime |
-- | sh:message Action must have exactly one startTime (xsd:dateTime). |
1 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
| uco-action:Action | |||||||
uco-action:endTime |
-- | sh:message When present, action endTime should be at most one xsd:dateTime literal. |
0 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
uco-action:object |
-- | sh:message Action must reference at least one object IRI. |
1 | * | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:performer |
-- | sh:message Action must have exactly one performer IRI. |
1 | 1 | sh:IRI |
sh:severity
sh:Violation
|
-- |
uco-action:result |
-- | sh:message When present, action result values should be IRI nodes. |
0 | * | sh:IRI |
sh:severity
sh:Warning
|
-- |
uco-action:startTime |
-- | sh:message Action must have exactly one startTime (xsd:dateTime). |
1 | 1 | xsd:dateTime |
sh:severity
sh:Warning
|
-- |
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
cacontology-forensics:K9AssistedForensics a owl:Class ;
rdfs:label "K9 Assisted Forensics"@en ;
rdfs:comment "Forensic process enhanced by K9 detection capabilities for electronic storage devices."@en ;
rdfs:subClassOf cacontology-forensics:ForensicAcquisitionAction .