https://cacontology.projectvic.org/forensics#RecoveredFile
A file recovered from deleted or unallocated space on digital media through forensic analysis techniques.
Instances of cacontology-forensics:RecoveredFile can have the following properties:
| PROPERTY | TYPE | DESCRIPTION | RANGE |
|---|
By the associated SHACL property shapes, instances of cacontology-forensics:RecoveredFile can have the following properties:
| PROPERTY | PROPERTY TYPE | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS | GLOBAL RANGE |
|---|---|---|---|---|---|---|---|
| cacontology-forensics:RecoveredFile | |||||||
cacontology-forensics:dataIntegrity |
-- | sh:message Data integrity must be complete, partial, or corrupted (gUFO quality aspect) |
0 | 1 | xsd:string |
sh:in
complete, partial, corrupted
|
-- |
cacontology-forensics:recoveryConfidence |
-- | sh:message Recovery confidence must be between 0.0 and 1.0 (gUFO quality aspect) |
0 | 1 | xsd:double |
sh:minInclusive
0.0
sh:maxInclusive
1.0
|
-- |
| cacontology-forensics:recoveryMethod | owl:DatatypeProperty | The method used to recover deleted or hidden files (e.g., 'unallocated space carving', 'file system journal'). sh:message Recovered file must specify recovery method from the allowed list.; Recovery method must be from allowed list: undelete, carving, slack-space, unallocated-space, registry-recovery |
1 | 1 | xsd:string |
sh:in
undelete, carving, slack-space, unallocated-space, registry-recovery, file_carving, undelete_utility, hex_editor, specialized_software, hardware_recovery, manual_reconstruction
|
xsd:string |
gufo:hasBeginPointInXSDDateTimeStamp |
-- | sh:message Recovered file may have recovery timestamp (gUFO temporal) |
0 | 1 | xsd:dateTimeStamp | -- | |
uco-core:createdTime |
-- | sh:message Recovered file may specify creation time. |
0 | 1 | xsd:dateTime | -- | |
uco-core:modifiedTime |
-- | sh:message Recovered file may specify modification time. |
0 | 1 | xsd:dateTime | -- | |
uco-observable:fileName |
-- | sh:message Recovered file must specify file name (1-255 characters). |
1 | 1 | xsd:string |
sh:minLength
1
sh:maxLength
255
|
-- |
uco-observable:filePath |
-- | sh:message Recovered file must specify file path (1-1000 characters). |
1 | 1 | xsd:string |
sh:minLength
1
sh:maxLength
1000
|
-- |
| cac-core:Artifact | |||||||
rdfs:label |
-- | label Every artifact should have at least one human-readable label. |
1 | * | xsd:string | -- | |
| cac-core:EnduringEntity | |||||||
(gufo:hasBeginPointInXSDDateTimeStamp | gufo:hasEndPointInXSDDateTimeStamp) |
-- | sh:message gUFO Objects should have temporal existence markers when applicable. |
0 | * | -- | ||
@prefix cac-core: <https://cacontology.projectvic.org/core#> .
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
cacontology-forensics:RecoveredFile a owl:Class ;
rdfs:label "Recovered File"@en ;
rdfs:comment "A file recovered from deleted or unallocated space on digital media through forensic analysis techniques."@en ;
rdfs:subClassOf cac-core:Artifact,
uco-observable:File .