https://cacontology.projectvic.org/forensics#RecoveredFileExtendedShape
Extended validation shape for recovered file instances.
Instances of cacontology-forensics:RecoveredFile can have the following properties:
PROPERTY |
MIN COUNT |
MAX COUNT |
TYPE |
|
|---|---|---|---|---|
| cacontology-forensics:RecoveredFile | ||||
| 1 |
xsd:string
|
|||
| 1 |
xsd:double
|
|||
| cacontology-forensics:recoveryMethod | 1 | 1 |
xsd:string
|
|
| 1 |
xsd:dateTimeStamp
|
|||
| 0 | 1 |
xsd:dateTime
|
||
| 0 | 1 |
xsd:dateTime
|
||
| 1 | 1 |
xsd:string
|
||
| 1 | 1 |
xsd:string
|
||
@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
cacontology-forensics:RecoveredFileExtendedShape a sh:NodeShape ;
rdfs:label "Recovered File Extended Shape"@en ;
rdfs:comment "Extended validation shape for recovered file instances."@en ;
sh:property [ sh:datatype xsd:string ;
sh:in ( "file_carving" "undelete_utility" "hex_editor" "specialized_software" "hardware_recovery" "manual_reconstruction" ) ;
sh:maxCount 1 ;
sh:message "Recovered file must specify recovery method from the allowed list."@en ;
sh:minCount 1 ;
sh:path cacontology-forensics:recoveryMethod ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:maxLength 255 ;
sh:message "Recovered file must specify file name (1-255 characters)."@en ;
sh:minCount 1 ;
sh:minLength 1 ;
sh:path uco-observable:fileName ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:maxLength 1000 ;
sh:message "Recovered file must specify file path (1-1000 characters)."@en ;
sh:minCount 1 ;
sh:minLength 1 ;
sh:path uco-observable:filePath ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:message "Recovered file may specify creation time."@en ;
sh:minCount 0 ;
sh:path uco-core:createdTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:message "Recovered file may specify modification time."@en ;
sh:minCount 0 ;
sh:path uco-core:modifiedTime ] ;
sh:targetClass cacontology-forensics:RecoveredFile .