https://cacontology.projectvic.org/forensics#ForensicImageShape
Focus nodes of this shape (cacontology-forensics:ForensicImage) can have the following properties:
| PROPERTY | DESCRIPTION | MIN | MAX | VALUE TYPE | OTHER CONSTRAINTS |
|---|---|---|---|---|---|
cacontology-forensics:compressionUsed |
sh:message Must specify if compression was used (gUFO quality aspect) |
0 | 1 | xsd:boolean | |
cacontology-forensics:imageFormat |
sh:message Image format must be E01, DD, AFF, VMDK, or VHD |
0 | 1 | xsd:string |
sh:in
E01, DD, AFF, VMDK, VHD
|
cacontology-forensics:imageIntegrity |
sh:message Image integrity must be verified, corrupted, or unknown (gUFO quality aspect) |
0 | 1 | xsd:string |
sh:in
verified, corrupted, unknown
|
| cacontology-forensics:sourceHash | Links a forensic image to the hash of its source media for verification. sh:message A forensic image must have at least one source hash for verification |
1 | * | uco-core:UcoObject | |
| cacontology-forensics:verificationHash | Links a forensic artifact to its verification hash digest for integrity checking. sh:message A forensic image must have at least one verification hash |
1 | * | uco-core:UcoObject | |
gufo:hasBeginPointInXSDDateTimeStamp |
sh:message Forensic image must have creation timestamp (gUFO temporal) |
1 | 1 | xsd:dateTimeStamp |
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix gufo: <http://purl.org/nemo/gufo#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
cacontology-forensics:ForensicImageShape a sh:NodeShape ;
rdfs:label "Forensic Image Shape"@en ;
sh:property [ sh:datatype xsd:dateTimeStamp ;
sh:maxCount 1 ;
sh:message "Forensic image must have creation timestamp (gUFO temporal)"@en ;
sh:minCount 1 ;
sh:path gufo:hasBeginPointInXSDDateTimeStamp ],
[ sh:class uco-core:UcoObject ;
sh:message "A forensic image must have at least one verification hash"@en ;
sh:minCount 1 ;
sh:path cacontology-forensics:verificationHash ],
[ sh:class uco-core:UcoObject ;
sh:message "A forensic image must have at least one source hash for verification"@en ;
sh:minCount 1 ;
sh:path cacontology-forensics:sourceHash ],
[ sh:datatype xsd:string ;
sh:in ( "E01" "DD" "AFF" "VMDK" "VHD" ) ;
sh:maxCount 1 ;
sh:message "Image format must be E01, DD, AFF, VMDK, or VHD"@en ;
sh:path cacontology-forensics:imageFormat ],
[ sh:datatype xsd:boolean ;
sh:maxCount 1 ;
sh:message "Must specify if compression was used (gUFO quality aspect)"@en ;
sh:path cacontology-forensics:compressionUsed ],
[ sh:datatype xsd:string ;
sh:in ( "verified" "corrupted" "unknown" ) ;
sh:maxCount 1 ;
sh:message "Image integrity must be verified, corrupted, or unknown (gUFO quality aspect)"@en ;
sh:path cacontology-forensics:imageIntegrity ] ;
sh:targetClass cacontology-forensics:ForensicImage .