https://cacontology.projectvic.org/forensics#ChainOfCustodyIntegrityBusinessRule
Instances of cacontology-forensics:ChainOfCustodyAction can have the following properties:
PROPERTY |
MIN COUNT |
MAX COUNT |
TYPE |
|
|---|---|---|---|---|
| cacontology-forensics:ChainOfCustodyAction | ||||
| 1 |
xsd:string
|
|||
| cacontology-forensics:custodyReason | 1 | 1 |
xsd:string
|
|
| cacontology-forensics:custodyTransferredFrom | 1 | 1 |
uco-core:UcoObject
|
|
| cacontology-forensics:custodyTransferredTo | 1 | 1 |
uco-core:UcoObject
|
|
| 1 | 1 |
xsd:dateTimeStamp
|
||
| 1 |
xsd:dateTimeStamp
|
|||
| 1 | 1 |
xsd:dateTime
|
||
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
cacontology-forensics:ChainOfCustodyIntegrityBusinessRule a sh:NodeShape ;
sh:sparql [ sh:message "Chain of custody gaps compromise evidence integrity"@en ;
sh:prefixes [ sh:declare [ sh:namespace "https://cacontology.projectvic.org/forensics#"^^xsd:anyURI ;
sh:prefix "cacontology-forensics" ],
[ sh:namespace "https://ontology.unifiedcyberontology.org/uco/core/"^^xsd:anyURI ;
sh:prefix "uco-core" ] ] ;
sh:select """
SELECT $this
WHERE {
$this uco-core:startTime ?thisStart .
?previousAction uco-core:endTime ?previousEnd .
?previousAction cacontology-forensics:custodyTransferredTo ?transferee .
$this cacontology-forensics:custodyTransferredFrom ?transferee .
FILTER (?thisStart > (?previousEnd + "PT1H"^^xsd:duration))
}
""" ] ;
sh:targetClass cacontology-forensics:ChainOfCustodyAction .