cacontology-forensics:RecoveredFileExtendedShape leaf node

sh:Shape
- cacontology-forensics:RecoveredFileExtendedShape

URI

https://cacontology.projectvic.org/forensics#RecoveredFileExtendedShape

Label

Recovered File Extended Shape

Description

Extended validation shape for recovered file instances.

Targets (1)

cacontology-forensics:RecoveredFile sh:targetClass

Property Constraints (5)

Focus nodes of this shape (cacontology-forensics:RecoveredFile) can have the following properties:

PROPERTY	DESCRIPTION	MIN	MAX	VALUE TYPE	OTHER CONSTRAINTS
cacontology-forensics:recoveryMethod	The method used to recover deleted or hidden files (e.g., 'unallocated space carving', 'file system journal'). sh:message Recovered file must specify recovery method from the allowed list.	1	1	xsd:string	sh:in file_carving, undelete_utility, hex_editor, specialized_software, hardware_recovery, manual_reconstruction
`uco-core:createdTime`	sh:message Recovered file may specify creation time.	0	1	xsd:dateTime
`uco-core:modifiedTime`	sh:message Recovered file may specify modification time.	0	1	xsd:dateTime
`uco-observable:fileName`	sh:message Recovered file must specify file name (1-255 characters).	1	1	xsd:string	sh:minLength `1` sh:maxLength `255`
`uco-observable:filePath`	sh:message Recovered file must specify file path (1-1000 characters).	1	1	xsd:string	sh:minLength `1` sh:maxLength `1000`

Implementation

@prefix cacontology-forensics: <https://cacontology.projectvic.org/forensics#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
cacontology-forensics:RecoveredFileExtendedShape a sh:NodeShape ;
    rdfs:label "Recovered File Extended Shape"@en ;
    rdfs:comment "Extended validation shape for recovered file instances."@en ;
    sh:property [ sh:datatype xsd:string ;
            sh:in ( "file_carving" "undelete_utility" "hex_editor" "specialized_software" "hardware_recovery" "manual_reconstruction" ) ;
            sh:maxCount 1 ;
            sh:message "Recovered file must specify recovery method from the allowed list."@en ;
            sh:minCount 1 ;
            sh:path cacontology-forensics:recoveryMethod ],
        [ sh:datatype xsd:string ;
            sh:maxCount 1 ;
            sh:maxLength 255 ;
            sh:message "Recovered file must specify file name (1-255 characters)."@en ;
            sh:minCount 1 ;
            sh:minLength 1 ;
            sh:path uco-observable:fileName ],
        [ sh:datatype xsd:string ;
            sh:maxCount 1 ;
            sh:maxLength 1000 ;
            sh:message "Recovered file must specify file path (1-1000 characters)."@en ;
            sh:minCount 1 ;
            sh:minLength 1 ;
            sh:path uco-observable:filePath ],
        [ sh:datatype xsd:dateTime ;
            sh:maxCount 1 ;
            sh:message "Recovered file may specify creation time."@en ;
            sh:minCount 0 ;
            sh:path uco-core:createdTime ],
        [ sh:datatype xsd:dateTime ;
            sh:maxCount 1 ;
            sh:message "Recovered file may specify modification time."@en ;
            sh:minCount 0 ;
            sh:path uco-core:modifiedTime ] ;
    sh:targetClass cacontology-forensics:RecoveredFile .