https://cacontology.projectvic.org/forensics#ForensicImageExtendedShape
Extended validation shape for forensic image instances with comprehensive digital evidence requirements.
Focus nodes of this shape (cacontology-forensics:ForensicImage) can have the following properties:
| PROPERTY | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS |
|---|---|---|---|---|---|
| cacontology-forensics:acquisitionMethod | The method used for forensic acquisition (e.g., 'physical', 'logical', 'live', 'chip-off'). sh:message Forensic image must specify acquisition method from the allowed list. |
1 | 1 | xsd:string |
sh:in
physical_imaging, logical_imaging, live_imaging, chip_off, jtag, selective_imaging
|
| cacontology-forensics:writeBlockingUsed | Indicates whether write-blocking hardware or software was used during acquisition. sh:message Forensic image must specify if write blocking was used. |
1 | 1 | xsd:boolean | |
uco-core:createdTime |
sh:message Forensic image must specify creation time. |
1 | 1 | xsd:dateTime | |
uco-core:sizeInBytes |
sh:message Image size must be between 0 and 1TB (in bytes). |
0 | 1 | xsd:decimal |
sh:minInclusive
0.0
sh:maxInclusive
1000000000000.0
|
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
cacontology-forensics:ForensicImageExtendedShape a sh:NodeShape ;
rdfs:label "Forensic Image Extended Shape"@en ;
rdfs:comment "Extended validation shape for forensic image instances with comprehensive digital evidence requirements."@en ;
sh:property [ sh:datatype xsd:string ;
sh:in ( "physical_imaging" "logical_imaging" "live_imaging" "chip_off" "jtag" "selective_imaging" ) ;
sh:maxCount 1 ;
sh:message "Forensic image must specify acquisition method from the allowed list."@en ;
sh:minCount 1 ;
sh:path cacontology-forensics:acquisitionMethod ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:message "Forensic image must specify creation time."@en ;
sh:minCount 1 ;
sh:path uco-core:createdTime ],
[ sh:datatype xsd:boolean ;
sh:maxCount 1 ;
sh:message "Forensic image must specify if write blocking was used."@en ;
sh:minCount 1 ;
sh:path cacontology-forensics:writeBlockingUsed ],
[ sh:datatype xsd:decimal ;
sh:maxCount 1 ;
sh:maxInclusive 1000000000000.0 ;
sh:message "Image size must be between 0 and 1TB (in bytes)."@en ;
sh:minCount 0 ;
sh:minInclusive 0.0 ;
sh:path uco-core:sizeInBytes ] ;
sh:targetClass cacontology-forensics:ForensicImage .