cacontology-forensics:ForensicAcquisitionActionShape leaf node

sh:Shape
- cacontology-forensics:ForensicAcquisitionActionShape

URI

https://cacontology.projectvic.org/forensics#ForensicAcquisitionActionShape

Label

Forensic Acquisition Action Shape

Targets (1)

cacontology-forensics:ForensicAcquisitionAction sh:targetClass

Property Constraints (9)

Focus nodes of this shape (cacontology-forensics:ForensicAcquisitionAction) can have the following properties:

PROPERTY	DESCRIPTION	MIN	MAX	VALUE TYPE	OTHER CONSTRAINTS
`cacontology-forensics:acquisitionCompleteness`	sh:message Acquisition completeness must be between 0.0 and 1.0 (gUFO quality aspect)	0	1	xsd:double	sh:minInclusive `0.0` sh:maxInclusive `1.0`
cacontology-forensics:acquisitionMethod	The method used for forensic acquisition (e.g., 'physical', 'logical', 'live', 'chip-off'). sh:message Acquisition method must be one of: physical, logical, live, remote, network	1	1	xsd:string	sh:in physical, logical, live, remote, network
`cacontology-forensics:acquisitionQuality`	sh:message Acquisition quality must be excellent, good, acceptable, or poor (gUFO quality aspect)	0	1	xsd:string	sh:in excellent, good, acceptable, poor
cacontology-forensics:evidenceSeized	Links an acquisition action to the original evidence item that was seized. sh:message A forensic acquisition action must specify at least one evidence item seized	1	*	uco-core:UcoObject
cacontology-forensics:forensicCopy	Links an acquisition action to the forensic copy that was created. sh:message A forensic acquisition action must produce at least one forensic copy	1	*	cacontology-forensics:ForensicImage
cacontology-forensics:writeBlockingUsed	Indicates whether write-blocking hardware or software was used during acquisition. sh:message A forensic acquisition action must specify whether write-blocking was used	1	1	xsd:boolean
`gufo:hasBeginPointInXSDDateTimeStamp`	sh:message Forensic acquisition must have exactly one begin timestamp (gUFO temporal)	1	1	xsd:dateTimeStamp
`gufo:hasEndPointInXSDDateTimeStamp`	sh:message Forensic acquisition must have at most one end timestamp (gUFO temporal)	0	1	xsd:dateTimeStamp
`uco-action:usesTool`	sh:message A forensic acquisition action must specify at least one tool used	1	*	uco-tool:Tool

Implementation

@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix gufo: <http://purl.org/nemo/gufo#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix uco-action: <https://ontology.unifiedcyberontology.org/uco/action/> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix uco-tool: <https://ontology.unifiedcyberontology.org/uco/tool/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
cacontology-forensics:ForensicAcquisitionActionShape a sh:NodeShape ;
    rdfs:label "Forensic Acquisition Action Shape"@en ;
    sh:property [ sh:datatype xsd:dateTimeStamp ;
            sh:maxCount 1 ;
            sh:message "Forensic acquisition must have exactly one begin timestamp (gUFO temporal)"@en ;
            sh:minCount 1 ;
            sh:path gufo:hasBeginPointInXSDDateTimeStamp ],
        [ sh:datatype xsd:dateTimeStamp ;
            sh:maxCount 1 ;
            sh:message "Forensic acquisition must have at most one end timestamp (gUFO temporal)"@en ;
            sh:path gufo:hasEndPointInXSDDateTimeStamp ],
        [ sh:class uco-tool:Tool ;
            sh:message "A forensic acquisition action must specify at least one tool used"@en ;
            sh:minCount 1 ;
            sh:path uco-action:usesTool ],
        [ sh:datatype xsd:string ;
            sh:in ( "physical" "logical" "live" "remote" "network" ) ;
            sh:maxCount 1 ;
            sh:message "Acquisition method must be one of: physical, logical, live, remote, network"@en ;
            sh:minCount 1 ;
            sh:path cacontology-forensics:acquisitionMethod ],
        [ sh:datatype xsd:boolean ;
            sh:maxCount 1 ;
            sh:message "A forensic acquisition action must specify whether write-blocking was used"@en ;
            sh:minCount 1 ;
            sh:path cacontology-forensics:writeBlockingUsed ],
        [ sh:class uco-core:UcoObject ;
            sh:message "A forensic acquisition action must specify at least one evidence item seized"@en ;
            sh:minCount 1 ;
            sh:path cacontology-forensics:evidenceSeized ],
        [ sh:class cacontology-forensics:ForensicImage ;
            sh:message "A forensic acquisition action must produce at least one forensic copy"@en ;
            sh:minCount 1 ;
            sh:path cacontology-forensics:forensicCopy ],
        [ sh:datatype xsd:string ;
            sh:in ( "excellent" "good" "acceptable" "poor" ) ;
            sh:maxCount 1 ;
            sh:message "Acquisition quality must be excellent, good, acceptable, or poor (gUFO quality aspect)"@en ;
            sh:path cacontology-forensics:acquisitionQuality ],
        [ sh:datatype xsd:double ;
            sh:maxCount 1 ;
            sh:maxInclusive 1.0 ;
            sh:message "Acquisition completeness must be between 0.0 and 1.0 (gUFO quality aspect)"@en ;
            sh:minInclusive 0.0 ;
            sh:path cacontology-forensics:acquisitionCompleteness ] ;
    sh:targetClass cacontology-forensics:ForensicAcquisitionAction .