https://cacontology.projectvic.org/forensics#ForensicAcquisitionActionExtendedShape
Extended validation shape for forensic acquisition action instances.
Instances of cacontology-forensics:ForensicAcquisitionAction can have the following properties:
PROPERTY |
MIN COUNT |
MAX COUNT |
TYPE |
|
|---|---|---|---|---|
| cacontology-forensics:ForensicAcquisitionAction | ||||
| 1 |
xsd:double
|
|||
| cacontology-forensics:acquisitionMethod | 1 | 1 |
xsd:string
|
|
| 1 |
xsd:string
|
|||
| cacontology-forensics:evidenceSeized | 1 |
uco-core:UcoObject
|
||
| cacontology-forensics:forensicCopy | 1 |
cacontology-forensics:ForensicImage
|
||
| cacontology-forensics:writeBlockingUsed | 1 | 1 |
xsd:boolean
|
|
| 1 | 1 |
xsd:dateTimeStamp
|
||
| 1 |
xsd:dateTimeStamp
|
|||
| 1 |
uco-tool:Tool
|
|||
| 0 | 1 |
xsd:dateTime
|
||
| 1 | 1 |
xsd:dateTime
|
||
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
cacontology-forensics:ForensicAcquisitionActionExtendedShape a sh:NodeShape ;
rdfs:label "Forensic Acquisition Action Extended Shape"@en ;
rdfs:comment "Extended validation shape for forensic acquisition action instances."@en ;
sh:property [ sh:datatype xsd:string ;
sh:in ( "physical" "logical" "live" "chip_off" "jtag" "selective" ) ;
sh:maxCount 1 ;
sh:message "Forensic acquisition must specify acquisition method from the allowed list."@en ;
sh:minCount 1 ;
sh:path cacontology-forensics:acquisitionMethod ],
[ sh:datatype xsd:boolean ;
sh:maxCount 1 ;
sh:message "Forensic acquisition must specify if write blocking was used."@en ;
sh:minCount 1 ;
sh:path cacontology-forensics:writeBlockingUsed ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:message "Forensic acquisition must specify start time."@en ;
sh:minCount 1 ;
sh:path uco-core:startTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:message "Forensic acquisition may specify end time."@en ;
sh:minCount 0 ;
sh:path uco-core:endTime ] ;
sh:targetClass cacontology-forensics:ForensicAcquisitionAction .