Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
4584 lines (3234 sloc) 148 KB
@prefix : <http://case.example.org/core#> .
@prefix dc: <http://purl.org/dc/elements/1.1/> .
@prefix olo: <http://purl.org/ontology/olo/core#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix xml: <http://www.w3.org/XML/1998/namespace> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@base <http://case.example.org/core> .
<http://case.example.org/core> rdf:type owl:Ontology ;
owl:priorVersion 0.0 ;
owl:versionInfo "0.1"^^xsd:string ;
dc:title "Cyber-investigation Analysis Schema Expression (CASE)"^^xsd:string .
#################################################################
# Annotation properties
#################################################################
### http://case.example.org/core#item
:item rdf:type owl:AnnotationProperty ;
rdfs:range :Item .
### http://purl.org/dc/terms/source
<http://purl.org/dc/terms/source> rdf:type owl:AnnotationProperty .
### http://www.w3.org/2002/07/owl#maxQualifiedCardinality
owl:maxQualifiedCardinality rdf:type owl:AnnotationProperty .
#################################################################
# Datatypes
#################################################################
### http://www.w3.org/2001/XMLSchema#duration
xsd:duration rdf:type rdfs:Datatype .
#################################################################
# Object Properties
#################################################################
### http://case.example.org/core#accessedDirectory
:accessedDirectory rdf:type owl:ObjectProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range :Trace .
### http://case.example.org/core#accessedFile
:accessedFile rdf:type owl:ObjectProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range :Trace .
### http://case.example.org/core#accountType
:accountType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Account ;
rdfs:range :AccountType .
### http://case.example.org/core#actionStatus
:actionStatus rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Action ;
rdfs:range :ActionStatus .
### http://case.example.org/core#application
:application rdf:type owl:ObjectProperty ;
rdfs:subPropertyOf owl:topObjectProperty ;
rdf:type owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :ApplicationAccount
:BrowserBookmark
:BrowserCookie
:Calendar
:CalendarEntry
:Contact
:Message
)
] ;
rdfs:range :Trace ;
rdfs:comment "Defines the application-like item used by this account." .
### http://case.example.org/core#attendant
:attendant rdf:type owl:ObjectProperty ;
rdfs:domain :CalendarEntry ;
rdfs:range :UcoObject .
### http://case.example.org/core#authorizationType
:authorizationType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Authorization ;
rdfs:range :AuthorizationType .
### http://case.example.org/core#bcc
:bcc rdf:type owl:ObjectProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :Trace .
### http://case.example.org/core#binary
:binary rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Process ;
rdfs:range :Trace .
### http://case.example.org/core#bodyMultipart
:bodyMultipart rdf:type owl:ObjectProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :MimePartType .
### http://case.example.org/core#bodyRaw
:bodyRaw rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :Trace .
### http://case.example.org/core#buildInformationType
:buildInformationType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty .
### http://case.example.org/core#byteOrder
:byteOrder rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :ContentData ;
rdfs:range :ByteOrder .
### http://case.example.org/core#cc
:cc rdf:type owl:ObjectProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :Trace .
### http://case.example.org/core#compressionMethod
:compressionMethod rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Compression
:EWFImage
)
] ;
rdfs:range :CompressionMethod .
### http://case.example.org/core#configurationSetting
:configurationSetting rdf:type owl:ObjectProperty ;
rdfs:domain :ToolConfiguration ;
rdfs:range :ConfigurationSetting .
### http://case.example.org/core#createdBy
:createdBy rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :UcoObject ;
rdfs:range :Identity .
### http://case.example.org/core#creator
:creator rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsRegistryKey ;
rdfs:range :Trace .
### http://case.example.org/core#creatorUser
:creatorUser rdf:type owl:ObjectProperty ;
rdfs:domain :Process ;
rdfs:range :Trace .
### http://case.example.org/core#currentWorkingDirectory
:currentWorkingDirectory rdf:type owl:ObjectProperty ;
rdfs:domain :Process ;
rdfs:range :FilePath .
### http://case.example.org/core#dataPath
:dataPath rdf:type owl:ObjectProperty ;
rdfs:domain :Package ;
rdfs:range :Trace ;
rdfs:comment "Path designated by the OS to be used by that package application." .
### http://case.example.org/core#dataType
:dataType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsRegistryValue ;
rdfs:range :DataType .
### http://case.example.org/core#destination
:destination rdf:type owl:ObjectProperty ;
rdfs:domain :NetworkConnection ;
rdfs:range :UcoObject .
### http://case.example.org/core#deviceType
:deviceType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Device ;
rdfs:range :DeviceType .
### http://case.example.org/core#diskPartitionType
:diskPartitionType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range :DiskPartitionType .
### http://case.example.org/core#diskType
:diskType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Disk ;
rdfs:range :DiskType .
### http://case.example.org/core#documentInformation
:documentInformation rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :PDFFile .
### http://case.example.org/core#encodingMethod
:encodingMethod rdf:type owl:ObjectProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Encoding
:ExtractedString
)
] ;
rdfs:range :EncodingMethod .
### http://case.example.org/core#encryptionMethod
:encryptionMethod rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Encryption ;
rdfs:range :EncryptionMethod .
### http://case.example.org/core#encryptionMode
:encryptionMode rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Encryption ;
rdfs:range :EncryptionMode .
### http://case.example.org/core#endAction
:endAction rdf:type owl:ObjectProperty ;
rdfs:domain :Investigation ;
rdfs:range :Action .
### http://case.example.org/core#environment
:environment rdf:type owl:ObjectProperty ;
rdfs:subPropertyOf owl:topObjectProperty ;
rdfs:domain :Action ;
rdfs:range :UcoObject ;
rdfs:comment "Defines the environment of an Action. This can point to things like the descriptions of the area the action was performed or information about the computer that was used." .
### http://case.example.org/core#environmentVariable
:environmentVariable rdf:type owl:ObjectProperty ;
rdfs:domain :Process ;
rdfs:range :DictionaryItem .
### http://case.example.org/core#error
:error rdf:type owl:ObjectProperty ;
rdfs:domain :Action ;
rdfs:range :UcoObject .
### http://case.example.org/core#errorType
:errorType rdf:type owl:ObjectProperty .
### http://case.example.org/core#exifData
:exifData rdf:type owl:ObjectProperty ;
rdfs:domain :EXIF ;
rdfs:range :DictionaryItem .
### http://case.example.org/core#extractedCodeSnippet
:extractedCodeSnippet rdf:type owl:ObjectProperty ;
rdfs:domain :ExtractedFeatures ;
rdfs:range :Trace ,
[ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:someValuesFrom :ExtractedString
] .
### http://case.example.org/core#extractedImport
:extractedImport rdf:type owl:ObjectProperty ;
rdfs:domain :ExtractedFeatures ;
rdfs:range :Trace ,
[ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:someValuesFrom :ExtractedString
] .
### http://case.example.org/core#extractedString
:extractedString rdf:type owl:ObjectProperty ;
rdfs:domain :ExtractedFeatures ;
rdfs:range :Trace ,
[ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:someValuesFrom :ExtractedString
] .
### http://case.example.org/core#fileHeader
:fileHeader rdf:type owl:ObjectProperty ;
rdfs:domain :WindowsPEBinaryFile ;
rdfs:range :WindowsPEFileHeader .
### http://case.example.org/core#filePathSegments
:filePathSegments rdf:type owl:ObjectProperty ;
rdfs:domain :FilePath ;
rdfs:range olo:OrderedList .
[ rdf:type owl:Axiom ;
owl:annotatedSource :filePathSegments ;
owl:annotatedProperty rdfs:range ;
owl:annotatedTarget olo:OrderedList ;
rdfs:comment "TODO: This should point to an array of strings."
] .
### http://case.example.org/core#fileSystemType
:fileSystemType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :FileSystem ;
rdfs:range :FileSystemType .
### http://case.example.org/core#forensicActions
:forensicActions rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Investigation ;
rdfs:range olo:OrderedList ,
[ rdf:type owl:Restriction ;
owl:onProperty olo:slot ;
owl:allValuesFrom [ rdf:type owl:Restriction ;
owl:onProperty olo:item ;
owl:allValuesFrom :ForensicAction
]
] .
### http://case.example.org/core#from
:from rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Message
:PhoneCall
)
] ;
rdfs:range :Trace ;
rdfs:comment "The designated sender of the object." .
### http://case.example.org/core#globalFlagList
:globalFlagList rdf:type owl:ObjectProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range :GlobalFlagType .
### http://case.example.org/core#hasPartition
:hasPartition rdf:type owl:ObjectProperty ;
rdfs:domain :Disk ;
rdfs:range :Trace .
### http://case.example.org/core#hash
:hash rdf:type owl:ObjectProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :ContentData
:ExtractedString
:WindowsPEFileHeader
:WindowsPEOptionalHeader
:WindowsPESection
:X509Certificate
)
] ;
rdfs:range :Hash .
### http://case.example.org/core#hashMethod
:hashMethod rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Hash ;
rdfs:range :HashMethod .
### http://case.example.org/core#headerRaw
:headerRaw rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :Trace .
### http://case.example.org/core#homeDirectory
:homeDirectory rdf:type owl:ObjectProperty ;
rdfs:domain :UserAccount ;
rdfs:range :FilePath .
### http://case.example.org/core#imageCompressionMethod
:imageCompressionMethod rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :RasterPicture ;
rdfs:range :ImageCompressionMethod .
### http://case.example.org/core#imageType
:imageType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Image ;
rdfs:range :ImageType .
### http://case.example.org/core#inReplyTo
:inReplyTo rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :Trace .
### http://case.example.org/core#instrument
:instrument rdf:type owl:ObjectProperty ;
rdfs:domain :ActionReferences ;
rdfs:range :UcoObject ;
rdfs:comment "The instrument the acutator used to perform the action. (This is usually an item that contains a tool property bundle.)" .
### http://case.example.org/core#investigator
:investigator rdf:type owl:ObjectProperty ;
rdfs:domain :Investigation ;
rdfs:range [ rdf:type owl:Class ;
owl:unionOf ( :Identity
:Role
)
] .
### http://case.example.org/core#language
:language rdf:type owl:ObjectProperty ;
rdfs:domain :ExtractedString ;
rdfs:range :Language .
### http://case.example.org/core#lifecycle
:lifecycle rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:range :ActionLifecycle .
### http://case.example.org/core#location
:location rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :ActionReferences
:CalendarEntry
:GeoLocationEntry
)
] ;
rdfs:range :Location .
### http://case.example.org/core#messageID
:messageID rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :EmailMessage
:Message
)
] ;
rdfs:range :Trace .
### http://case.example.org/core#messages
:messages rdf:type owl:ObjectProperty ;
rdfs:domain :MessageThread ;
rdfs:range olo:OrderedList ,
[ rdf:type owl:Restriction ;
owl:onProperty olo:slot ;
owl:allValuesFrom [ rdf:type owl:Restriction ;
owl:onProperty olo:item ;
owl:allValuesFrom [ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:someValuesFrom :Message
]
]
] .
### http://case.example.org/core#mimeType
:mimeType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :ContentData ;
rdfs:range :MimeType .
### http://case.example.org/core#mismatchType
:mismatchType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :FileMetadataMismatch ;
rdfs:range :FileMismatchType .
### http://case.example.org/core#object
:object rdf:type owl:ObjectProperty ;
rdfs:subPropertyOf owl:topObjectProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :ActionReferences
:Annotation
:Attachment
:ProvenanceRecord
:Role
)
] ;
rdfs:range :UcoObject .
### http://case.example.org/core#operatingSystem
:operatingSystem rdf:type owl:ObjectProperty ;
rdfs:domain :Application ;
rdfs:range :Trace ,
[ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:someValuesFrom :OperatingSystem
] .
### http://case.example.org/core#optionalHeader
:optionalHeader rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range :WindowsPEOptionalHeader .
### http://case.example.org/core#otherHeader
:otherHeader rdf:type owl:ObjectProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :DictionaryItem .
### http://case.example.org/core#owner
:owner rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Account
:Calendar
:CalendarEntry
:FilePermissions
)
] ;
rdfs:range :UcoObject .
### http://case.example.org/core#parentProcess
:parentProcess rdf:type owl:ObjectProperty ;
rdfs:domain :Process ;
rdfs:range :Trace ,
[ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:minQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onClass :Process
] .
### http://case.example.org/core#participant
:participant rdf:type owl:ObjectProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :ActionReferences
:Message
:PhoneCall
)
] ;
rdfs:comment """Describes people who are involved. Participants are not necessarily the sender or recipients of the object.
This property is useful if the people involved are known, but the sender cannot be determined.""" .
### http://case.example.org/core#passwordType
:passwordType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :AccountAuthentication ;
rdfs:range :PasswordType .
### http://case.example.org/core#peType
:peType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEBinaryFile ;
rdfs:range :PEType .
### http://case.example.org/core#performer
:performer rdf:type owl:ObjectProperty ;
rdfs:subPropertyOf owl:topObjectProperty ;
rdf:type owl:FunctionalProperty ;
rdfs:domain :ActionReferences ;
rdfs:range :UcoObject ;
rdfs:comment "Defines the person, action, or thing that caused this action." .
### http://case.example.org/core#propertyBundle
:propertyBundle rdf:type owl:ObjectProperty ;
rdfs:subPropertyOf owl:topObjectProperty ;
rdfs:domain :UcoObject ;
rdfs:range :PropertyBundle .
### http://case.example.org/core#protocols
:protocols rdf:type owl:ObjectProperty ;
rdfs:domain :NetworkConnection .
### http://case.example.org/core#received
:received rdf:type owl:ObjectProperty ;
rdfs:domain :Message ;
rdfs:range :ReceivedEvent .
### http://case.example.org/core#receiver
:receiver rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :ReceivedEvent ;
rdfs:range :Trace .
### http://case.example.org/core#reference
:reference rdf:type owl:ObjectProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :Trace .
### http://case.example.org/core#regionalInternetRegistry
:regionalInternetRegistry rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :AutonomousSystem .
### http://case.example.org/core#registeredOrganization
:registeredOrganization rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range :Identity .
### http://case.example.org/core#registeredOwner
:registeredOwner rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range :Identity .
### http://case.example.org/core#registryValue
:registryValue rdf:type owl:ObjectProperty ;
rdfs:domain :WindowsRegistryKey ;
rdfs:range :WindowsRegistryValue .
### http://case.example.org/core#result
:result rdf:type owl:ObjectProperty ;
rdfs:subPropertyOf owl:topObjectProperty ;
rdfs:domain :ActionReferences ;
rdfs:range :UcoObject .
### http://case.example.org/core#sections
:sections rdf:type owl:ObjectProperty ;
rdfs:domain :WindowsPEBinaryFile ;
rdfs:range :WindowsPESection .
### http://case.example.org/core#serviceStatus
:serviceStatus rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsService ;
rdfs:range :ServiceStatus .
### http://case.example.org/core#serviceType
:serviceType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsService ;
rdfs:range :Servicetype .
### http://case.example.org/core#source
:source rdf:type owl:ObjectProperty ;
rdfs:subPropertyOf owl:topObjectProperty ;
rdf:type owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :NetworkConnection
:Relationship
)
] ;
rdfs:range :UcoObject .
### http://case.example.org/core#startAction
:startAction rdf:type owl:ObjectProperty ;
rdfs:domain :Investigation ;
rdfs:range :Action .
### http://case.example.org/core#startType
:startType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsService ;
rdfs:range :StartType .
### http://case.example.org/core#startupInfo
:startupInfo rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsProcess .
### http://case.example.org/core#subAction
:subAction rdf:type owl:ObjectProperty ;
rdfs:domain :Action ;
rdfs:range :Action .
### http://case.example.org/core#target
:target rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Relationship ;
rdfs:range :UcoObject .
### http://case.example.org/core#to
:to rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Message
:PhoneCall
)
] ;
rdfs:range :Trace ;
rdfs:comment "The designated recipients of the Message." .
### http://case.example.org/core#uri
:uri rdf:type owl:ObjectProperty ;
rdfs:domain :Attachment ;
rdfs:range :URI .
### http://case.example.org/core#urlTargeted
:urlTargeted rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :BrowserBookmark ;
rdfs:range :URI .
### http://case.example.org/core#victim
:victim rdf:type owl:ObjectProperty ;
rdfs:domain :Investigation ;
rdfs:range [ rdf:type owl:Class ;
owl:unionOf ( :Identity
:Role
)
] .
### http://case.example.org/core#visibility
:visibility rdf:type owl:ObjectProperty ;
rdfs:domain :MessageThread ;
rdfs:range :VisibilityType .
### http://case.example.org/core#volume
:volume rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range :Trace .
### http://case.example.org/core#volumeType
:volumeType rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :Volume .
### http://case.example.org/core#windowsDirectory
:windowsDirectory rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range :Trace .
### http://case.example.org/core#windowsSystemDirectory
:windowsSystemDirectory rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range :Trace .
### http://case.example.org/core#windowsTempDirectory
:windowsTempDirectory rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range :Trace .
### http://case.example.org/core#x509V3Extensions
:x509V3Extensions rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range :X509V3Extensions .
### http://case.example.org/core#xOriginatingIP
:xOriginatingIP rdf:type owl:ObjectProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range :Trace .
### http://purl.org/ontology/olo/core#item
olo:item rdf:type owl:ObjectProperty .
### http://purl.org/ontology/olo/core#next
olo:next rdf:type owl:ObjectProperty .
### http://purl.org/ontology/olo/core#ordered_list
olo:ordered_list rdf:type owl:ObjectProperty .
### http://purl.org/ontology/olo/core#previous
olo:previous rdf:type owl:ObjectProperty .
### http://purl.org/ontology/olo/core#slot
olo:slot rdf:type owl:ObjectProperty .
#################################################################
# Data properties
#################################################################
### http://case.example.org/core#accessedTime
:accessedTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :BrowserBookmark
:BrowserCookie
:File
)
] ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#accountIdentifier
:accountIdentifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Account ;
rdfs:range xsd:string .
### http://case.example.org/core#accountIssuer
:accountIssuer rdf:type owl:DatatypeProperty ;
rdfs:domain :Account ;
rdfs:range xsd:string .
### http://case.example.org/core#accountLogin
:accountLogin rdf:type owl:DatatypeProperty ;
rdfs:domain :DigitalAccount ;
rdfs:range xsd:string .
### http://case.example.org/core#acquiryDate
:acquiryDate rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#addressOfEntryPoint
:addressOfEntryPoint rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#alternateDataStream
:alternateDataStream rdf:type owl:DatatypeProperty ;
rdfs:domain :NTFSFileSystem ;
rdfs:range xsd:string .
### http://case.example.org/core#applicationFileName
:applicationFileName rdf:type owl:DatatypeProperty ;
rdfs:subPropertyOf owl:topDataProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range xsd:string .
### http://case.example.org/core#applicationIdentifier
:applicationIdentifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Application ;
rdfs:range xsd:string .
### http://case.example.org/core#applicationName
:applicationName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Package ;
rdfs:range xsd:string ;
rdfs:comment "The name of the application (friendly name)" .
### http://case.example.org/core#arguments
:arguments rdf:type owl:DatatypeProperty ;
rdfs:domain :Process ;
rdfs:range xsd:string .
### http://case.example.org/core#asHandle
:asHandle rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :AutonomousSystem ;
rdfs:range xsd:string .
### http://case.example.org/core#aslrEnabled
:aslrEnabled rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsProcess ;
rdfs:range xsd:boolean .
### http://case.example.org/core#audioType
:audioType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Audio ;
rdfs:range xsd:string .
### http://case.example.org/core#authorityKeyIdentifier
:authorityKeyIdentifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#authorizationIdentifier
:authorizationIdentifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Authorization ;
rdfs:range xsd:string .
### http://case.example.org/core#baseOfCode
:baseOfCode rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#basicContraints
:basicContraints rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#bidirectional
:bidirectional rdf:type owl:DatatypeProperty ;
rdfs:domain :Relationship ;
rdfs:range xsd:boolean .
### http://case.example.org/core#biosVersion
:biosVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ComputerSpecification ;
rdfs:range xsd:string .
### http://case.example.org/core#birthDate
:birthDate rdf:type owl:DatatypeProperty ;
rdfs:domain :BirthInformation ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#bitRate
:bitRate rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Audio ;
rdfs:range xsd:long .
### http://case.example.org/core#bitsPerPixel
:bitsPerPixel rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :RasterPicture ;
rdfs:range xsd:integer .
### http://case.example.org/core#bookmarkPath
:bookmarkPath rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :BrowserBookmark ;
rdfs:range xsd:string .
### http://case.example.org/core#byteStringValue
:byteStringValue rdf:type owl:DatatypeProperty ;
rdfs:domain :ExtractedString ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#callType
:callType rdf:type owl:DatatypeProperty ;
rdfs:domain :PhoneCall ;
rdfs:range xsd:string .
### http://case.example.org/core#canEscalatePrivs
:canEscalatePrivs rdf:type owl:DatatypeProperty ;
rdfs:domain :UserAccount ;
rdfs:range xsd:boolean .
### http://case.example.org/core#caseNumber
:caseNumber rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:integer .
### http://case.example.org/core#category
:category rdf:type owl:DatatypeProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :CalendarEntry
:EmailMessage
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#certificatePolicies
:certificatePolicies rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#characteristics
:characteristics rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#checksum
:checksum rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#clusterSize
:clusterSize rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :FileSystem ;
rdfs:range xsd:long .
### http://case.example.org/core#code
:code rdf:type owl:DatatypeProperty ;
rdfs:domain :ICMPConnection ;
rdfs:range xsd:string .
### http://case.example.org/core#columnName
:columnName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SQLiteBlob ;
rdfs:range xsd:string .
### http://case.example.org/core#comment
:comment rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ArchiveFile ;
rdfs:range xsd:string .
### http://case.example.org/core#compressionRatio
:compressionRatio rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Compression ;
rdfs:range xsd:double .
### http://case.example.org/core#configurationSettingDescription
:configurationSettingDescription rdf:type owl:DatatypeProperty ;
rdfs:range xsd:string .
### http://case.example.org/core#contactIdentifier
:contactIdentifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Contact ;
rdfs:range xsd:string .
### http://case.example.org/core#contactName
:contactName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Contact ;
rdfs:range xsd:string .
### http://case.example.org/core#contactType
:contactType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Contact ;
rdfs:range xsd:string .
### http://case.example.org/core#contentDisposition
:contentDisposition rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range xsd:string .
### http://case.example.org/core#contentType
:contentType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range xsd:string .
### http://case.example.org/core#cookieName
:cookieName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :BrowserCookie ;
rdfs:range xsd:string .
### http://case.example.org/core#cookiePath
:cookiePath rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :BrowserCookie ;
rdfs:range xsd:string .
### http://case.example.org/core#country
:country rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SimpleAddress ;
rdfs:range xsd:string .
### http://case.example.org/core#cpuFamily
:cpuFamily rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ComputerSpecification ;
rdfs:range xsd:string .
### http://case.example.org/core#createdTime
:createdTime rdf:type owl:DatatypeProperty ;
rdfs:subPropertyOf owl:topDataProperty ;
rdf:type owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Account
:BrowserBookmark
:BrowserCookie
:CalendarEntry
:DiskPartition
:File
:GeoLocationEntry
:GeoLocationLog
:Message
:PhoneCall
:Process
:UcoObject
)
] ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#crlDistributionPoints
:crlDistributionPoints rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#dataPayload
:dataPayload rdf:type owl:DatatypeProperty ;
rdfs:domain :ContentData ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#dataPayloadReferenceURL
:dataPayloadReferenceURL rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ContentData ;
rdfs:range xsd:string .
### http://case.example.org/core#delimiter
:delimiter rdf:type owl:DatatypeProperty ;
rdfs:domain :FilePath ;
rdfs:range xsd:string .
### http://case.example.org/core#depEnabled
:depEnabled rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsProcess ;
rdfs:range xsd:boolean .
### http://case.example.org/core#description
:description rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:string .
### http://case.example.org/core#destinationFlags
:destinationFlags rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :TCPConnection ;
rdfs:range xsd:string .
### http://case.example.org/core#destinationPort
:destinationPort rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :TCPConnection
:UDPConnection
)
] ;
rdfs:range xsd:integer .
### http://case.example.org/core#diskSize
:diskSize rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Disk ;
rdfs:range xsd:long .
### http://case.example.org/core#displayName
:displayName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :DigitalAccount
:MessageThread
:WindowsService
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#dllCharacteristics
:dllCharacteristics rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#domain
:domain rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :BrowserCookie
:NetworkLocation
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#driveLetter
:driveLetter rdf:type owl:DatatypeProperty ;
rdfs:domain :WindowsVolume ;
rdfs:range xsd:string .
### http://case.example.org/core#duration
:duration rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Audio
:CalendarEntry
:PhoneCall
)
] ;
rdfs:range xsd:duration .
### http://case.example.org/core#edition
:edition rdf:type owl:DatatypeProperty ;
rdfs:range xsd:string .
### http://case.example.org/core#emailAddress
:emailAddress rdf:type owl:DatatypeProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Contact
:EmailAccount
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#encryptedRootPlist
:encryptedRootPlist rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :FVDEEncryption ;
rdfs:range xsd:string ;
rdfs:comment "path to the EncryptedRoot.plist.wipekey file" .
### http://case.example.org/core#encryptionIV
:encryptionIV rdf:type owl:DatatypeProperty ;
rdfs:domain :Encryption ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#encryptionKey
:encryptionKey rdf:type owl:DatatypeProperty ;
rdfs:domain :Encryption ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#endTime
:endTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Action
:CalendarEntry
:GeoLocationTrack
:NetworkConnection
:PhoneCall
:Relationship
)
] ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#englishTranslation
:englishTranslation rdf:type owl:DatatypeProperty ;
rdfs:domain :ExtractedString ;
rdfs:range xsd:string .
### http://case.example.org/core#entropy
:entropy rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :ContentData
:WindowsPEOptionalHeader
)
] ;
rdfs:range xsd:float .
### http://case.example.org/core#errorGranularity
:errorGranularity rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:integer .
### http://case.example.org/core#eventStatus
:eventStatus rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :CalendarEntry ;
rdfs:range xsd:string .
### http://case.example.org/core#eventType
:eventType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :CalendarEntry ;
rdfs:range xsd:string .
### http://case.example.org/core#evidenceNumber
:evidenceNumber rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:string .
### http://case.example.org/core#examinerName
:examinerName rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:string .
### http://case.example.org/core#exhibitNumber
:exhibitNumber rdf:type owl:DatatypeProperty ;
rdfs:domain :ProvenanceRecord ;
rdfs:range xsd:string .
### http://case.example.org/core#expirationTime
:expirationTime rdf:type owl:DatatypeProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Account
:BrowserCookie
)
] ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#extDeletionTime
:extDeletionTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#extFileType
:extFileType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:int .
### http://case.example.org/core#extFlags
:extFlags rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:int .
### http://case.example.org/core#extHardLinkCount
:extHardLinkCount rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:int .
### http://case.example.org/core#extInodeChangeTime
:extInodeChangeTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#extInodeID
:extInodeID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:int .
### http://case.example.org/core#extPermissions
:extPermissions rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:int .
### http://case.example.org/core#extSGID
:extSGID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:int .
### http://case.example.org/core#extSUID
:extSUID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ExtInode ;
rdfs:range xsd:int .
### http://case.example.org/core#extendedKeyUsage
:extendedKeyUsage rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#extension
:extension rdf:type owl:DatatypeProperty ;
rdfs:domain :File ;
rdfs:range xsd:string ;
rdfs:comment "The file extension." .
### http://case.example.org/core#familyName
:familyName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SimpleName ;
rdfs:range xsd:string .
### http://case.example.org/core#fileAlignment
:fileAlignment rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#fileName
:fileName rdf:type owl:DatatypeProperty ;
rdfs:domain :File ;
rdfs:range xsd:string .
### http://case.example.org/core#filePath
:filePath rdf:type owl:DatatypeProperty ;
rdfs:domain :File ;
rdfs:range xsd:string .
### http://case.example.org/core#firstLoginTime
:firstLoginTime rdf:type owl:DatatypeProperty ;
rdfs:domain :DigitalAccount ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#firstName
:firstName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Contact ;
rdfs:range xsd:string .
### http://case.example.org/core#firstRunTime
:firstRunTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#format
:format rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Audio
:EWFImage
:RasterPicture
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#fragmentIndex
:fragmentIndex rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Fragment ;
rdfs:range xsd:int .
### http://case.example.org/core#freeSpace
:freeSpace rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Disk ;
rdfs:range xsd:long .
### http://case.example.org/core#gid
:gid rdf:type owl:DatatypeProperty ;
rdfs:domain :UNIXAccount ;
rdfs:range xsd:integer .
### http://case.example.org/core#givenName
:givenName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SimpleName ;
rdfs:range xsd:string .
### http://case.example.org/core#groupName
:groupName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :UNIXAccount
:WindowsAccount
:WindowsActiveDirectoryAccount
:WindowsService
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#guid
:guid rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:string .
### http://case.example.org/core#hashValue
:hashValue rdf:type owl:DatatypeProperty ;
rdfs:domain :Hash ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#hfsBackupTime
:hfsBackupTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :HFSFileSystem ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#hiveType
:hiveType rdf:type owl:DatatypeProperty ;
rdfs:domain :WindowsRegistryHive ;
rdfs:range xsd:string .
### http://case.example.org/core#httpMessageBodyData
:httpMessageBodyData rdf:type owl:DatatypeProperty ;
rdfs:domain :HTTPConnection ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#httpMessageBodyLength
:httpMessageBodyLength rdf:type owl:DatatypeProperty ;
rdfs:domain :HTTPConnection ;
rdfs:range xsd:integer .
### http://case.example.org/core#httpRequestHeader
:httpRequestHeader rdf:type owl:DatatypeProperty ;
rdfs:domain :HTTPConnection ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#httpRequestLine
:httpRequestLine rdf:type owl:DatatypeProperty ;
rdfs:domain :HTTPConnection ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#identifier
:identifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :MessageThread
:UcoObject
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#imageBase
:imageBase rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#imageHeight
:imageHeight rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :RasterPicture ;
rdfs:range xsd:positiveInteger .
### http://case.example.org/core#imageWidth
:imageWidth rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :RasterPicture ;
rdfs:range xsd:positiveInteger .
### http://case.example.org/core#impHash
:impHash rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEBinaryFile ;
rdfs:range xsd:string .
### http://case.example.org/core#index
:index rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:range xsd:positiveInteger .
### http://case.example.org/core#inhibitAnyPolicy
:inhibitAnyPolicy rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#ipAddress
:ipAddress rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :NetworkLocation ;
rdfs:range xsd:string ;
rdfs:comment "Change this to an already defined ip address type." .
### http://case.example.org/core#isActive
:isActive rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Account ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isAllocated
:isAllocated rdf:type owl:DatatypeProperty ;
rdfs:domain :File ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isDirectory
:isDirectory rdf:type owl:DatatypeProperty ;
rdfs:domain :File ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isDisabled
:isDisabled rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DigitalAccount ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isEncrypted
:isEncrypted rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ContentData ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isHidden
:isHidden rdf:type owl:DatatypeProperty ;
rdfs:domain :Process ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isMimeEncoded
:isMimeEncoded rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isMultipart
:isMultipart rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isOptimized
:isOptimized rdf:type owl:DatatypeProperty ;
rdfs:domain :PDFFile ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isPrivate
:isPrivate rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :CalendarEntry ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isPrivileged
:isPrivileged rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :UserAccount ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isRead
:isRead rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Message ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isSecure
:isSecure rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :BrowserCookie ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isSelfSigned
:isSelfSigned rdf:type owl:DatatypeProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isServiceAccount
:isServiceAccount rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :UserAccount ;
rdfs:range xsd:boolean .
### http://case.example.org/core#isTLD
:isTLD rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DomainName ;
rdfs:range xsd:boolean .
### http://case.example.org/core#issuer
:issuer rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:string .
### http://case.example.org/core#issuerAlternativeName
:issuerAlternativeName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#itemDescription
:itemDescription rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ConfigurationSetting ;
rdfs:range xsd:string .
### http://case.example.org/core#itemName
:itemName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ConfigurationSetting ;
rdfs:range xsd:string .
### http://case.example.org/core#itemType
:itemType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ConfigurationSetting ;
rdfs:range xsd:string .
### http://case.example.org/core#itemValue
:itemValue rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ConfigurationSetting ;
rdfs:range xsd:string .
### http://case.example.org/core#key
:key rdf:type owl:DatatypeProperty ;
rdfs:domain :DictionaryItem ;
rdfs:range xsd:string .
### http://case.example.org/core#keyUsage
:keyUsage rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#kindOfRelationship
:kindOfRelationship rdf:type owl:DatatypeProperty ;
rdfs:domain :Relationship ;
rdfs:range xsd:string .
### http://case.example.org/core#label
:label rdf:type owl:DatatypeProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :CalendarEntry
:EmailMessage
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#lastLoginTime
:lastLoginTime rdf:type owl:DatatypeProperty ;
rdfs:domain :DigitalAccount ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#lastName
:lastName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Contact ;
rdfs:range xsd:string .
### http://case.example.org/core#lastRunTime
:lastRunTime rdf:type owl:DatatypeProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#latitude
:latitude rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :LatLongCoordinates ;
rdfs:range xsd:float .
### http://case.example.org/core#length
:length rdf:type owl:DatatypeProperty ;
rdfs:domain :ExtractedString ;
rdfs:range xsd:integer .
### http://case.example.org/core#loaderFlags
:loaderFlags rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#locality
:locality rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SimpleAddress ;
rdfs:range xsd:string .
### http://case.example.org/core#longitude
:longitude rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :LatLongCoordinates ;
rdfs:range xsd:float .
### http://case.example.org/core#machine
:machine rdf:type owl:DatatypeProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#magic
:magic rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary ;
rdfs:comment "TODO: Is this different from the magicNumber propery used by ContentData?" .
### http://case.example.org/core#magicNumber
:magicNumber rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ContentData ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#majorImageVersion
:majorImageVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#majorOSVersion
:majorOSVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#majorSubsystemVersion
:majorSubsystemVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#majorlinkerVersion
:majorlinkerVersion rdf:type owl:DatatypeProperty ;
rdfs:subPropertyOf owl:topDataProperty ;
rdf:type owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#manufacturer
:manufacturer rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Device
:OperatingSystem
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#messageText
:messageText rdf:type owl:DatatypeProperty ;
rdfs:domain :Message ;
rdfs:range xsd:string .
### http://case.example.org/core#messageType
:messageType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Message ;
rdfs:range xsd:string .
### http://case.example.org/core#metadataChangedTime
:metadataChangedTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :File ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#mftFileID
:mftFileID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:integer .
### http://case.example.org/core#mftFileNameAccessedTime
:mftFileNameAccessedTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#mftFileNameCreatedTime
:mftFileNameCreatedTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#mftFileNameLength
:mftFileNameLength rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:integer .
### http://case.example.org/core#mftFileNameModifiedTime
:mftFileNameModifiedTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#mftFileNameRecordChangeTime
:mftFileNameRecordChangeTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#mftFlags
:mftFlags rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:integer .
### http://case.example.org/core#mftParentID
:mftParentID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:integer .
### http://case.example.org/core#mftRecordChangeTime
:mftRecordChangeTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#middleName
:middleName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Contact ;
rdfs:range xsd:string .
### http://case.example.org/core#mimeClass
:mimeClass rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ContentData ;
rdfs:range xsd:string ;
rdfs:comment "TODO: Define proper range." .
### http://case.example.org/core#minorImageVersion
:minorImageVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#minorLinkerVersion
:minorLinkerVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#minorOSVersion
:minorOSVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#minorSubsystemVersion
:minorSubsystemVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#model
:model rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Device ;
rdfs:range xsd:string .
### http://case.example.org/core#modifedTime
:modifedTime rdf:type owl:DatatypeProperty ;
rdfs:subPropertyOf owl:topDataProperty ;
rdf:type owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :BrowserBookmark
:CalendarEntry
:File
:WindowsRegistryKey
)
] ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#mountPoint
:mountPoint rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range xsd:string .
### http://case.example.org/core#msProductID
:msProductID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range xsd:string .
### http://case.example.org/core#msProductName
:msProductName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range xsd:string .
### http://case.example.org/core#name
:name rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Mutex
:WindowsPESection
:WindowsRegistryValue
)
] ;
rdfs:range xsd:string ;
rdfs:comment "The name property defines a common word or phrase that describes the meaning of the object." .
### http://case.example.org/core#nameContraints
:nameContraints rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#netBiosName
:netBiosName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range xsd:string .
### http://case.example.org/core#notes
:notes rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:string .
### http://case.example.org/core#ntfsHardLinkCount
:ntfsHardLinkCount rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:integer .
### http://case.example.org/core#ntfsOwnerID
:ntfsOwnerID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:string .
### http://case.example.org/core#ntfsOwnerSID
:ntfsOwnerSID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :MftRecord ;
rdfs:range xsd:string .
### http://case.example.org/core#number
:number rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :AutonomousSystem ;
rdfs:range xsd:int .
### http://case.example.org/core#numberOfLaunches
:numberOfLaunches rdf:type owl:DatatypeProperty ;
rdfs:domain :Application ;
rdfs:range xsd:positiveInteger .
### http://case.example.org/core#numberOfRVAAndSizes
:numberOfRVAAndSizes rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#numberOfSections
:numberOfSections rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#numberOfSubkeys
:numberOfSubkeys rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsRegistryKey ;
rdfs:range xsd:integer .
### http://case.example.org/core#numberOfSymbols
:numberOfSymbols rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#objectGUID
:objectGUID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsActiveDirectoryAccount ;
rdfs:range xsd:string .
### http://case.example.org/core#objectID
:objectID rdf:type owl:DatatypeProperty ;
rdfs:range xsd:string .
### http://case.example.org/core#operatingSystemUsed
:operatingSystemUsed rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:string .
### http://case.example.org/core#ownerSID
:ownerSID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsProcess ;
rdfs:range xsd:string .
### http://case.example.org/core#packageName
:packageName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Package ;
rdfs:range xsd:string ;
rdfs:comment "The package name (identifier)" .
### http://case.example.org/core#packagePermission
:packagePermission rdf:type owl:DatatypeProperty ;
rdfs:domain :Package ;
rdfs:range xsd:string ;
rdfs:comment "Defines a permission associated with the application." .
### http://case.example.org/core#partitionIdentifier
:partitionIdentifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range xsd:int .
### http://case.example.org/core#partitionLength
:partitionLength rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range xsd:int .
### http://case.example.org/core#partitionOffset
:partitionOffset rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range xsd:long .
### http://case.example.org/core#password
:password rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :AccountAuthentication
:BDEVolume
:EWFImage
:FVDEEncryption
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#passwordLastChanged
:passwordLastChanged rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :AccountAuthentication ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#path
:path rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :PathRelation ;
rdfs:range xsd:string .
### http://case.example.org/core#payload
:payload rdf:type owl:DatatypeProperty ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#pdfId0
:pdfId0 rdf:type owl:DatatypeProperty ;
rdfs:domain :PDFFile ;
rdfs:range xsd:string .
### http://case.example.org/core#pdfId1
:pdfId1 rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :PDFFile ;
rdfs:range xsd:string .
### http://case.example.org/core#phoneNumber
:phoneNumber rdf:type owl:DatatypeProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Contact
:PhoneAccount
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#pid
:pid rdf:type owl:DatatypeProperty ;
rdfs:domain :Process ;
rdfs:range xsd:integer .
### http://case.example.org/core#pointerToSymbolTable
:pointerToSymbolTable rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#policyConstraints
:policyConstraints rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#policyMappings
:policyMappings rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#postalCode
:postalCode rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SimpleAddress ;
rdfs:range xsd:string .
### http://case.example.org/core#prefetchHash
:prefetchHash rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range xsd:string .
### http://case.example.org/core#priority
:priority rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :EmailMessage
:WindowsProcess
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#privateKeyUsagePeriodNotAfter
:privateKeyUsagePeriodNotAfter rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#privateKeyUsagePeriodNotBefore
:privateKeyUsagePeriodNotBefore rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#rangeOffset
:rangeOffset rdf:type owl:DatatypeProperty ;
rdfs:domain :DataRange ;
rdfs:range xsd:positiveInteger .
### http://case.example.org/core#rangeOffsetType
:rangeOffsetType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DataRange ;
rdfs:range xsd:string .
### http://case.example.org/core#rangeSize
:rangeSize rdf:type owl:DatatypeProperty ;
rdfs:domain :DataRange ;
rdfs:range xsd:positiveInteger .
### http://case.example.org/core#receivedLine
:receivedLine rdf:type owl:DatatypeProperty ;
rdfs:domain :EmailMessage ;
rdfs:range xsd:string .
### http://case.example.org/core#receivedTime
:receivedTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ReceivedEvent ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#recoveryPassword
:recoveryPassword rdf:type owl:DatatypeProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :BDEVolume
:FVDEEncryption
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#recurrence
:recurrence rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :CalendarEntry ;
rdfs:range xsd:string .
### http://case.example.org/core#region
:region rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SimpleAddress ;
rdfs:range xsd:string .
### http://case.example.org/core#registryKey
:registryKey rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsRegistryKey ;
rdfs:range xsd:string .
### http://case.example.org/core#remindTime
:remindTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :CalendarEntry ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#rowCondition
:rowCondition rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SQLiteBlob ;
rdfs:range xsd:string .
### http://case.example.org/core#rowIndex
:rowIndex rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SQLiteBlob ;
rdfs:range xsd:positiveInteger .
### http://case.example.org/core#screenName
:screenName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Contact ;
rdfs:range xsd:string .
### http://case.example.org/core#sectionAlignment
:sectionAlignment rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sectorSize
:sectorSize rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Volume ;
rdfs:range xsd:long .
### http://case.example.org/core#sectorsPerChunk
:sectorsPerChunk rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:integer .
### http://case.example.org/core#sentTime
:sentTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Message ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#serialNumber
:serialNumber rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Device
:X509Certificate
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#serviceDescription
:serviceDescription rdf:type owl:DatatypeProperty ;
rdfs:domain :WindowsService ;
rdfs:range xsd:string .
### http://case.example.org/core#sessionID
:sessionID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Message ;
rdfs:range xsd:string .
### http://case.example.org/core#shell
:shell rdf:type owl:DatatypeProperty ;
rdfs:domain :UNIXAccount ;
rdfs:range xsd:string .
### http://case.example.org/core#sid
:sid rdf:type owl:DatatypeProperty ;
rdfs:domain :NTFSFileSystem ;
rdfs:range xsd:string .
### http://case.example.org/core#signatureAlgorithm
:signatureAlgorithm rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:string .
### http://case.example.org/core#sizeInBytes
:sizeInBytes rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :ContentData
:File
:WindowsPESection
)
] ;
rdfs:range xsd:positiveInteger ;
rdfs:comment "Size of file in bytes." .
### http://case.example.org/core#sizeOfCode
:sizeOfCode rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfHeaders
:sizeOfHeaders rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfHeapCommit
:sizeOfHeapCommit rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfHeapReserve
:sizeOfHeapReserve rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfImage
:sizeOfImage rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfInitializedData
:sizeOfInitializedData rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfOptionalHeader
:sizeOfOptionalHeader rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfStackCommit
:sizeOfStackCommit rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfStackReserve
:sizeOfStackReserve rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#sizeOfUnintialializedData
:sizeOfUnintialializedData rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#snapshotID
:snapshotID rdf:type owl:DatatypeProperty ;
rdfs:domain :VShadow ;
rdfs:range xsd:string .
### http://case.example.org/core#softwareLanguage
:softwareLanguage rdf:type owl:DatatypeProperty ;
rdfs:range xsd:string .
### http://case.example.org/core#softwareVersionUsed
:softwareVersionUsed rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:string .
### http://case.example.org/core#sourceFlags
:sourceFlags rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :TCPConnection ;
rdfs:range xsd:string .
### http://case.example.org/core#sourcePort
:sourcePort rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :TCPConnection
:UDPConnection
)
] ;
rdfs:range xsd:integer .
### http://case.example.org/core#spaceLeft
:spaceLeft rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range xsd:long .
### http://case.example.org/core#spaceUsed
:spaceUsed rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range xsd:long .
### http://case.example.org/core#specVersion
:specVersion rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :UcoObject ;
rdfs:range xsd:string .
### http://case.example.org/core#startCommandLine
:startCommandLine rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsService ;
rdfs:range xsd:string .
### http://case.example.org/core#startTime
:startTime rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Action
:CalendarEntry
:GeoLocationTrack
:NetworkConnection
:PhoneCall
:Relationship
)
] ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#startupKey
:startupKey rdf:type owl:DatatypeProperty ;
rdfs:domain :BDEVolume ;
rdfs:range xsd:base64Binary .
### http://case.example.org/core#street
:street rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SimpleAddress ;
rdfs:range xsd:string .
### http://case.example.org/core#stringValue
:stringValue rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :EmailAddress
:ExtractedString
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#subject
:subject rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :CalendarEntry ;
rdfs:range xsd:string .
### http://case.example.org/core#subjectAlternativeName
:subjectAlternativeName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#subjectDirectoryAttribute
:subjectDirectoryAttribute rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#subjectKeyIdentifier
:subjectKeyIdentifier rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509V3Extensions ;
rdfs:range xsd:string .
### http://case.example.org/core#subjectPublicKeyAlgorithm
:subjectPublicKeyAlgorithm rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:string .
### http://case.example.org/core#subjectPublicKeyExponent
:subjectPublicKeyExponent rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:integer .
### http://case.example.org/core#subjectPublicKeyModulus
:subjectPublicKeyModulus rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:string .
### http://case.example.org/core#subsystem
:subsystem rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#suspectedOffense
:suspectedOffense rdf:type owl:DatatypeProperty ;
rdfs:domain :Investigation ;
rdfs:range xsd:string .
### http://case.example.org/core#swid
:swid rdf:type owl:DatatypeProperty ;
rdfs:range xsd:string .
### http://case.example.org/core#systemDate
:systemDate rdf:type owl:DatatypeProperty ;
rdfs:domain :EWFImage ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#tableName
:tableName rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :SQLiteBlob ;
rdfs:range xsd:string .
### http://case.example.org/core#tag
:tag rdf:type owl:DatatypeProperty ;
rdfs:domain :Annotation ;
rdfs:range xsd:string .
### http://case.example.org/core#timeDateStamp
:timeDateStamp rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEFileHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#timesExecuted
:timesExecuted rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPrefetch ;
rdfs:range xsd:long .
### http://case.example.org/core#toolType
:toolType rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Tool ;
rdfs:range xsd:string .
### http://case.example.org/core#totalFragments
:totalFragments rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Fragment ;
rdfs:range xsd:int .
### http://case.example.org/core#totalRam
:totalRam rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :ComputerSpecification ;
rdfs:range xsd:string .
### http://case.example.org/core#totalSpace
:totalSpace rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :DiskPartition ;
rdfs:range xsd:long .
### http://case.example.org/core#type
:type rdf:type owl:DatatypeProperty ;
rdfs:domain :UcoObject ;
rdfs:range xsd:string ;
rdfs:comment "A cyber-relevant concept. This is the base object defining the minimal core set of properties to act as a consistent, unifying and interoperable foundation for all explicit and interrelateable content objects within the Unified Cyber Ontology (uco)." .
### http://case.example.org/core#update
:update rdf:type owl:DatatypeProperty ;
rdfs:range xsd:string .
### http://case.example.org/core#validityNotAfter
:validityNotAfter rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#validityNotBefore
:validityNotBefore rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :X509Certificate ;
rdfs:range xsd:dateTimeStamp .
### http://case.example.org/core#value
:value rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :DictionaryItem
:DomainName
:IPv4Address
:IPv6Address
:MACAddress
:URI
:WindowsRegistryValue
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#vendor
:vendor rdf:type owl:DatatypeProperty ;
rdfs:domain :Tool ;
rdfs:range xsd:string .
### http://case.example.org/core#version
:version rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain [ rdf:type owl:Class ;
owl:unionOf ( :Application
:ArchiveFile
:OperatingSystem
:PDFFile
:Package
:Tool
:X509Certificate
)
] ;
rdfs:range xsd:string .
### http://case.example.org/core#visitCount
:visitCount rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :BrowserBookmark ;
rdfs:range xsd:int .
### http://case.example.org/core#volumeID
:volumeID rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :Volume ;
rdfs:range xsd:string .
### http://case.example.org/core#volumeIndex
:volumeIndex rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :LVMVolume ;
rdfs:range xsd:integer .
### http://case.example.org/core#win32VersionValue
:win32VersionValue rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsPEOptionalHeader ;
rdfs:range xsd:hexBinary .
### http://case.example.org/core#windowsDomain
:windowsDomain rdf:type owl:DatatypeProperty ;
rdfs:domain :WindowsComputerSpecification ;
rdfs:range xsd:string .
### http://case.example.org/core#windowsTitle
:windowsTitle rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :WindowsProcess ;
rdfs:range xsd:string .
### http://case.example.org/core#xMailer
:xMailer rdf:type owl:DatatypeProperty ,
owl:FunctionalProperty ;
rdfs:domain :EmailMessage ;
rdfs:range xsd:string .
#################################################################
# Classes
#################################################################
### http://case.example.org/core#AFFImage
:AFFImage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Account
:Account rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :accountIdentifier ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] ;
rdfs:comment "The fundamental properties of an account." .
### http://case.example.org/core#AccountAuthentication
:AccountAuthentication rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "The authentication information related to an account." .
### http://case.example.org/core#AccountType
:AccountType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Action
:Action rdf:type owl:Class ;
rdfs:subClassOf :UcoObject ;
rdfs:comment "Something that may be done or performed." .
### http://case.example.org/core#ActionLifecycle
:ActionLifecycle rdf:type owl:Class ;
rdfs:subClassOf :ArrayOfAction ,
:UcoObject ;
rdfs:comment "An action pattern consisting of an ordered set of multiple actions or sub action-lifecycles." .
### http://case.example.org/core#ActionReferences
:ActionReferences rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "A grouping of properties characterizing the core elements (who, how, with what, where, etc.) for an action. The properties consist of identifier references to separate UCO objects detailing the particular property." .
### http://case.example.org/core#ActionStatus
:ActionStatus rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#AndroidPackage
:AndroidPackage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Annotation
:Annotation rdf:type owl:Class ;
rdfs:subClassOf :Assertion ;
rdfs:comment "A statement asserted to be true in relation to one or more other objects." .
### http://case.example.org/core#Application
:Application rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of a software application." .
### http://case.example.org/core#ApplicationAccount
:ApplicationAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of an account within a particular application." .
### http://case.example.org/core#ArchiveFile
:ArchiveFile rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties specific to archive files." .
### http://case.example.org/core#ArrayOfAction
:ArrayOfAction rdf:type owl:Class ;
rdfs:subClassOf olo:OrderedList ;
rdfs:comment "An ordered list of action object references." .
### http://case.example.org/core#ArrayOfHash
:ArrayOfHash rdf:type owl:Class ;
rdfs:subClassOf olo:OrderedList ;
rdfs:comment "An ordered list of hash values." .
### http://case.example.org/core#ArrayOfObject
:ArrayOfObject rdf:type owl:Class ;
rdfs:subClassOf olo:OrderedList ;
rdfs:comment "An ordered list of object references." .
### http://case.example.org/core#ArrayOfString
:ArrayOfString rdf:type owl:Class ;
rdfs:subClassOf olo:OrderedList ;
rdfs:comment "An ordered list of string values." .
### http://case.example.org/core#Assertion
:Assertion rdf:type owl:Class ;
rdfs:subClassOf :UcoObject .
### http://case.example.org/core#Attachment
:Attachment rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment """Defines an object that is an attachment of a message.
Note: This property bundle is different. Instead of putting this as a property bundle of the attachment itself, you put this on the message.""" .
### http://case.example.org/core#Attorney
:Attorney rdf:type owl:Class ;
rdfs:subClassOf :BenevolentRole .
### http://case.example.org/core#Audio
:Audio rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Authorization
:Authorization rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :authorizationType ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onClass :AuthorizationType
] ,
[ rdf:type owl:Restriction ;
owl:onProperty :authorizationIdentifier ;
owl:minQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] .
### http://case.example.org/core#AuthorizationType
:AuthorizationType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#AutonomousSystem
:AutonomousSystem rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :number ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:int
] ;
rdfs:comment "Basic characteristics of an Internet autonomous system." .
### http://case.example.org/core#BDEVolume
:BDEVolume rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#BenevolentRole
:BenevolentRole rdf:type owl:Class ;
rdfs:subClassOf :Role .
### http://case.example.org/core#BirthInformation
:BirthInformation rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#BrowserBookmark
:BrowserBookmark rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "A bookmark to a web pages or files using a web browser." .
### http://case.example.org/core#BrowserCookie
:BrowserCookie rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "A piece of data used by a (remote) web page, stored on the local machine." .
### http://case.example.org/core#BrowserHistory
:BrowserHistory rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Bundle
:Bundle rdf:type owl:Class ;
rdfs:subClassOf :UcoObject ;
rdfs:comment "A contained compilation of UCO content with no presumption of shared context." .
### http://case.example.org/core#ByteOrder
:ByteOrder rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Calendar
:Calendar rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#CalendarEntry
:CalendarEntry rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of an entry (appointment, meeting, event) within a calendar." .
### http://case.example.org/core#Compression
:Compression rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of compression applied to a body of data content." .
### http://case.example.org/core#CompressionMethod
:CompressionMethod rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#ComputerSpecification
:ComputerSpecification rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characterizes a computer system (as a combination of both software and hardware)." .
### http://case.example.org/core#ConfigurationSetting
:ConfigurationSetting rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ,
[ rdf:type owl:Restriction ;
owl:onProperty :itemName ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] ,
[ rdf:type owl:Restriction ;
owl:onProperty :itemValue ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] ;
rdfs:comment "Describes a particular configuration setting for a tool, application or other cyber object." .
### http://case.example.org/core#Contact
:Contact rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Contact found in an application, for example an entry in an address book." .
### http://case.example.org/core#ContentData
:ContentData rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of a block of digital data." .
### http://case.example.org/core#CountriesOfResidence
:CountriesOfResidence rdf:type owl:Class ;
rdfs:subClassOf :IdentityPropertyBundle ;
rdfs:comment "<Needs fleshed out from CIQ>" .
### http://case.example.org/core#DataRange
:DataRange rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Bounding characteristics of a range within a block of digital data." .
### http://case.example.org/core#DataType
:DataType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Device
:Device rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#DeviceType
:DeviceType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#DictionaryItem
:DictionaryItem rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ,
[ rdf:type owl:Restriction ;
owl:onProperty :key ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] ,
[ rdf:type owl:Restriction ;
owl:onProperty :value ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] .
### http://case.example.org/core#DigitalAccount
:DigitalAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Disk
:Disk rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "DC3 needed" .
### http://case.example.org/core#DiskPartition
:DiskPartition rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of a region on a hard disk or other secondary storage." .
### http://case.example.org/core#DiskPartitionType
:DiskPartitionType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#DiskType
:DiskType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#DomainName
:DomainName rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses .
### http://case.example.org/core#EWFImage
:EWFImage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#EXIF
:EXIF rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "TODO: Use imported exif ontology" .
### http://case.example.org/core#EmailAccount
:EmailAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of an account within an email domain." .
### http://case.example.org/core#EmailAddress
:EmailAddress rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ;
rdfs:comment "TODO: Merge this into EmailAccount?" .
### http://case.example.org/core#EmailMessage
:EmailMessage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :isMimeEncoded ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:boolean
] ,
[ rdf:type owl:Restriction ;
owl:onProperty :isMultipart ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:boolean
] ;
owl:disjointWith :SMSMessage ;
rdfs:comment "The properties unique to an email message corresponding to the internet message format described in RFC 5322 and related RFCs." .
### http://case.example.org/core#Encoding
:Encoding rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Represents the encoding-related properties of some encoded thing." .
### http://case.example.org/core#EncodingMethod
:EncodingMethod rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Encryption
:Encryption rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Represents the encryption-related properties of some encrypted data." .
### http://case.example.org/core#EncryptionMethod
:EncryptionMethod rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#EncryptionMode
:EncryptionMode rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Enumeration
:Enumeration rdf:type owl:Class .
### http://case.example.org/core#Error
:Error rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#ErrorType
:ErrorType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Event
:Event rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Examiner
:Examiner rdf:type owl:Class ;
rdfs:subClassOf :BenevolentRole .
### http://case.example.org/core#ExtInode
:ExtInode rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characterizes the details of a single EXT file." .
### http://case.example.org/core#ExtractedFeatures
:ExtractedFeatures rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#ExtractedString
:ExtractedString rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "A string extracted from a cyber item." .
### http://case.example.org/core#FVDEEncryption
:FVDEEncryption rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "The FileVault Drive Encryption (FVDE) encryption credentials." .
### http://case.example.org/core#File
:File rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "The basic properties associated with the storage of a file on a file system." .
### http://case.example.org/core#FileMetadataMismatch
:FileMetadataMismatch rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#FileMismatchType
:FileMismatchType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#FilePath
:FilePath rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ;
rdfs:comment "TODO: Determine if this object is wanted, or if we want to stick with strings." .
### http://case.example.org/core#FilePermissions
:FilePermissions rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of permissions or access rights for a file." .
### http://case.example.org/core#FileSystem
:FileSystem rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Represents the properties of a file system." .
### http://case.example.org/core#FileSystemType
:FileSystemType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#ForensicAction
:ForensicAction rdf:type owl:Class ;
rdfs:subClassOf :Action ,
[ rdf:type owl:Restriction ;
owl:onProperty :result ;
owl:allValuesFrom [ rdf:type owl:Class ;
owl:unionOf ( :ForensicAction
:ProvenanceRecord
)
]
] ,
[ rdf:type owl:Restriction ;
owl:onProperty :source ;
owl:allValuesFrom [ rdf:type owl:Class ;
owl:unionOf ( :ForensicAction
:ProvenanceRecord
)
]
] ;
rdfs:comment """A forensic examination action taken as part of a cyber investigation.
A ForensicAction is an Action that must have its results and source properties only be ProvenanceRecords or other ForensicActions.""" .
### http://case.example.org/core#Fragment
:Fragment rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of an individual fragment of a file." .
### http://case.example.org/core#GeoLocationEntry
:GeoLocationEntry rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :application ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onClass :Trace
] ;
rdfs:comment "Characteristics of a single application-specific geolocation entry." .
### http://case.example.org/core#GeoLocationLog
:GeoLocationLog rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :application ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onClass :Trace
] ;
rdfs:comment "A log containing geolocation tracks and/or geolocation entries." .
### http://case.example.org/core#GeoLocationTrack
:GeoLocationTrack rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :application ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onClass :Trace
] ;
rdfs:comment "Characteristics of a set of contiguous geolocation entries representing a path/track taken." .
### http://case.example.org/core#GlobalFlagType
:GlobalFlagType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#HFSFileSystem
:HFSFileSystem rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties specific to the storage of the file on the HFS file system." .
### http://case.example.org/core#HTTPConnection
:HTTPConnection rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Hash
:Hash rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#HashMethod
:HashMethod rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#ICMPConnection
:ICMPConnection rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
owl:disjointWith :TCPConnection .
### http://case.example.org/core#IOSPackage
:IOSPackage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#IPv4Address
:IPv4Address rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ,
[ rdf:type owl:Restriction ;
owl:onProperty :value ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] .
### http://case.example.org/core#IPv6Address
:IPv6Address rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ,
[ rdf:type owl:Restriction ;
owl:onProperty :value ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] .
### http://case.example.org/core#Identity
:Identity rdf:type owl:Class ;
rdfs:subClassOf :UcoObject ,
[ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:allValuesFrom :IdentityPropertyBundle
] ;
rdfs:comment "Characterization of the identifying properties of an individual or organization." .
### http://case.example.org/core#IdentityPropertyBundle
:IdentityPropertyBundle rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Image
:Image rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of a complete copy of a hard disk, memory or other digital media." .
### http://case.example.org/core#ImageCompressionMethod
:ImageCompressionMethod rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#ImageType
:ImageType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Investigation
:Investigation rdf:type owl:Class ;
rdfs:subClassOf :UcoObject .
### http://case.example.org/core#Investigator
:Investigator rdf:type owl:Class ;
rdfs:subClassOf :BenevolentRole .
### http://case.example.org/core#LVMVolume
:LVMVolume rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "the Locaical Volume Manager (LVM) path specification" .
### http://case.example.org/core#Language
:Language rdf:type owl:Class ;
rdfs:subClassOf :Enumeration ;
rdfs:comment "TODO: We probably can use an already existing schema for this." .
### http://case.example.org/core#LatLongCoordinates
:LatLongCoordinates rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#LinuxPackage
:LinuxPackage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Location
:Location rdf:type owl:Class ;
rdfs:subClassOf :UcoObject ;
rdfs:comment "A geophysical place, site or position." .
### http://case.example.org/core#MACAddress
:MACAddress rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses .
### http://case.example.org/core#MaliciousRole
:MaliciousRole rdf:type owl:Class ;
rdfs:subClassOf :Role .
### http://case.example.org/core#Memory
:Memory rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Message
:Message rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of an electronic message." .
### http://case.example.org/core#MessageThread
:MessageThread rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#MftRecord
:MftRecord rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characterizes the details of a single NTFS file." .
### http://case.example.org/core#MimePartType
:MimePartType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#MimeType
:MimeType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Mutex
:Mutex rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#NTFSFileSystem
:NTFSFileSystem rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties specific to the storage of the file on the NTFS file system." .
### http://case.example.org/core#NetworkConnection
:NetworkConnection rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#NetworkLocation
:NetworkLocation rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#NetworkPacket
:NetworkPacket rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#NetworkRoute
:NetworkRoute rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#NetworkSocket
:NetworkSocket rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#NetworkSubnet
:NetworkSubnet rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#NeutralRole
:NeutralRole rdf:type owl:Class ;
rdfs:subClassOf :Role .
### http://case.example.org/core#Occupation
:Occupation rdf:type owl:Class ;
rdfs:subClassOf :IdentityPropertyBundle ;
rdfs:comment "<Needs fleshed out from CIQ>" .
### http://case.example.org/core#OperatingSystem
:OperatingSystem rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#OrganizationDetails
:OrganizationDetails rdf:type owl:Class ;
rdfs:subClassOf :IdentityPropertyBundle ;
rdfs:comment "<Needs fleshed out from CIQ>" .
### http://case.example.org/core#PDFFile
:PDFFile rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#PEType
:PEType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Package
:Package rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment """Defines a software application package.
TODO: Determine which of these properties are valid and which need to go into a specific property bundle (AndoridPackage, iOSPackage, LinuxPackage, etc.)""" .
### http://case.example.org/core#PasswordType
:PasswordType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#PathRelation
:PathRelation rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment """Defines path relationship between two pieces of data.
When placed on a Relationship object, the source data is related to the target data by its path.""" .
### http://case.example.org/core#PhoneAccount
:PhoneAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#PhoneCall
:PhoneCall rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment """NFI Needed
TODO: Community discuss""" .
### http://case.example.org/core#Process
:Process rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#PropertyBundle
:PropertyBundle rdf:type owl:Class ;
rdfs:comment "A grouping of properties characterizing a particular aspect/facet of an object." .
### http://case.example.org/core#ProvenanceRecord
:ProvenanceRecord rdf:type owl:Class ;
rdfs:subClassOf :UcoObject .
### http://case.example.org/core#QCOWImage
:QCOWImage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#RasterPicture
:RasterPicture rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#ReceivedEvent
:ReceivedEvent rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ,
[ rdf:type owl:Restriction ;
owl:onProperty :receiver ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onClass :Trace
] ,
[ rdf:type owl:Restriction ;
owl:onProperty :receivedTime ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:dateTimeStamp
] ;
rdfs:comment """Defines received events.
Contains information on who received it and when.""" .
### http://case.example.org/core#Relationship
:Relationship rdf:type owl:Class ;
rdfs:subClassOf :UcoObject .
### http://case.example.org/core#Role
:Role rdf:type owl:Class ;
rdfs:subClassOf :UcoObject .
### http://case.example.org/core#SMSMessage
:SMSMessage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characteristics of a Short Message Service (SMS) \"text\" message." .
### http://case.example.org/core#SQLiteBlob
:SQLiteBlob rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#ServiceStatus
:ServiceStatus rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Servicetype
:Servicetype rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#SimpleAddress
:SimpleAddress rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#SimpleName
:SimpleName rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#StartType
:StartType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Subject
:Subject rdf:type owl:Class ;
rdfs:subClassOf :MaliciousRole .
### http://case.example.org/core#SupportingClasses
:SupportingClasses rdf:type owl:Class ;
rdfs:subClassOf owl:Thing .
### http://case.example.org/core#SymbolicLink
:SymbolicLink rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#System
:System rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#TCPConnection
:TCPConnection rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#Tool
:Tool rdf:type owl:Class ;
rdfs:subClassOf :UcoObject ;
rdfs:comment "Characteristics of a tool used in a cyber context potentially including its usage environment and configuration characteristics." .
### http://case.example.org/core#ToolArguments
:ToolArguments rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#ToolConfiguration
:ToolConfiguration rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characterizes the configuration for a tool." .
### http://case.example.org/core#Trace
:Trace rdf:type owl:Class ;
rdfs:subClassOf :UcoObject ,
[ rdf:type owl:Restriction ;
owl:onProperty :propertyBundle ;
owl:minQualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onClass :PropertyBundle
] ;
rdfs:comment "An object that must contain at least one property bundle." .
### http://case.example.org/core#UDPConnection
:UDPConnection rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#UNIXAccount
:UNIXAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
owl:disjointWith :WindowsAccount ;
rdfs:comment "Properties specific to an account on a UNIX system" .
### http://case.example.org/core#UNIXNetworkRoute
:UNIXNetworkRoute rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
owl:disjointWith :WindowsNetworkRoute .
### http://case.example.org/core#UNIXProcess
:UNIXProcess rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
owl:disjointWith :WindowsProcess .
### http://case.example.org/core#UNIXVolume
:UNIXVolume rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#URI
:URI rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses .
### http://case.example.org/core#UcoObject
:UcoObject rdf:type owl:Class ;
rdfs:subClassOf [ rdf:type owl:Restriction ;
owl:onProperty :identifier ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] ;
rdfs:comment "A cyber-relevant concept. This is the base object defining the minmal core set of properties to act as a consistent, unifying and interoperable foundation to all explicit and interrelateable content objects within the Unified Cyber Onotology (uco)." .
### http://case.example.org/core#UserAccount
:UserAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties of an instance of a user account on a system." .
### http://case.example.org/core#VShadow
:VShadow rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Describes a Volume Shadow Snapshot (VSS)." .
### http://case.example.org/core#Victim
:Victim rdf:type owl:Class ;
rdfs:subClassOf :NeutralRole .
### http://case.example.org/core#VisibilityType
:VisibilityType rdf:type owl:Class ;
rdfs:subClassOf :Enumeration .
### http://case.example.org/core#Volume
:Volume rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#WHOIS
:WHOIS rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#WindowsAccount
:WindowsAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties specific to an account on a Microsoft Windows (tm) system." .
### http://case.example.org/core#WindowsActiveDirectoryAccount
:WindowsActiveDirectoryAccount rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :objectGUID ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] ;
rdfs:comment "Properties specific to a Windows Active Directory account." .
### http://case.example.org/core#WindowsComputerSpecification
:WindowsComputerSpecification rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Specifies Windows-specific system properties." .
### http://case.example.org/core#WindowsMutex
:WindowsMutex rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#WindowsNetworkRoute
:WindowsNetworkRoute rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#WindowsPEBinaryFile
:WindowsPEBinaryFile rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties specific to Windows portable executable (PE) files." .
### http://case.example.org/core#WindowsPEFileHeader
:WindowsPEFileHeader rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses ,
[ rdf:type owl:Restriction ;
owl:onProperty :machine ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:hexBinary
] ;
rdfs:comment "Properties of the PE file header, sometimes referred to as the COFF header." .
### http://case.example.org/core#WindowsPEOptionalHeader
:WindowsPEOptionalHeader rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses .
### http://case.example.org/core#WindowsPESection
:WindowsPESection rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses .
### http://case.example.org/core#WindowsPackage
:WindowsPackage rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#WindowsPrefetch
:WindowsPrefetch rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characterizes entries in the Windows prefetch files. Starting with Windows XP, prefetching was introduced to speed up application startup." .
### http://case.example.org/core#WindowsProcess
:WindowsProcess rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties specific to a Windows's process." .
### http://case.example.org/core#WindowsRegistryHive
:WindowsRegistryHive rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "(Undocumented)" .
### http://case.example.org/core#WindowsRegistryKey
:WindowsRegistryKey rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Properties of a Windows registry key." .
### http://case.example.org/core#WindowsRegistryValue
:WindowsRegistryValue rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses .
### http://case.example.org/core#WindowsService
:WindowsService rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ,
[ rdf:type owl:Restriction ;
owl:onProperty :name ;
owl:qualifiedCardinality "1"^^xsd:nonNegativeInteger ;
owl:onDataRange xsd:string
] .
### http://case.example.org/core#WindowsSystem
:WindowsSystem rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#WindowsVolume
:WindowsVolume rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle ;
rdfs:comment "Characterizes a Windows disk volume." .
### http://case.example.org/core#X509Certificate
:X509Certificate rdf:type owl:Class ;
rdfs:subClassOf :PropertyBundle .
### http://case.example.org/core#X509V3Extensions
:X509V3Extensions rdf:type owl:Class ;
rdfs:subClassOf :SupportingClasses .
### http://purl.org/ontology/olo/core#OrderedList
olo:OrderedList rdf:type owl:Class .
### http://purl.org/ontology/olo/core#Slot
olo:Slot rdf:type owl:Class .
#################################################################
# Individuals
#################################################################
### http://case.example.org/core#AES
:AES rdf:type owl:NamedIndividual ,
:EncryptionMethod .
### http://case.example.org/core#BDE
:BDE rdf:type owl:NamedIndividual ,
:FileSystemType ;
rdfs:comment "The Bitlocker Drive Encryption (BDE) credentials." .
### http://case.example.org/core#BMP
:BMP rdf:type owl:NamedIndividual ,
:ImageCompressionMethod .
### http://case.example.org/core#BZIP2
:BZIP2 rdf:type owl:NamedIndividual ,
:CompressionMethod .
### http://case.example.org/core#Base16
:Base16 rdf:type owl:NamedIndividual ,
:EncodingMethod .
### http://case.example.org/core#Base32
:Base32 rdf:type owl:NamedIndividual ,
:EncodingMethod .
### http://case.example.org/core#Base64
:Base64 rdf:type owl:NamedIndividual ,
:EncodingMethod .
### http://case.example.org/core#BigEndian
:BigEndian rdf:type owl:NamedIndividual ,
:ByteOrder .
### http://case.example.org/core#Blowfish
:Blowfish rdf:type owl:NamedIndividual ,
:EncryptionMethod .
### http://case.example.org/core#CBC
:CBC rdf:type owl:NamedIndividual ,
:EncryptionMode .
### http://case.example.org/core#CFB
:CFB rdf:type owl:NamedIndividual ,
:EncryptionMode .
### http://case.example.org/core#CPIO
:CPIO rdf:type owl:NamedIndividual ,
:FileSystemType .
### http://case.example.org/core#Critical
:Critical rdf:type owl:NamedIndividual ,
:ErrorType .
### http://case.example.org/core#DES
:DES rdf:type owl:NamedIndividual ,
:EncryptionMethod .
### http://case.example.org/core#DES3
:DES3 rdf:type owl:NamedIndividual ,
:EncryptionMethod .
### http://case.example.org/core#Debug
:Debug rdf:type owl:NamedIndividual ,
:ErrorType .
### http://case.example.org/core#Deflate
:Deflate rdf:type owl:NamedIndividual ,
:CompressionMethod .
### http://case.example.org/core#ECB
:ECB rdf:type owl:NamedIndividual ,
:EncryptionMode .
### http://case.example.org/core#EWF
:EWF rdf:type owl:NamedIndividual ,
:ImageType .
### http://case.example.org/core#EXT4
:EXT4 rdf:type owl:NamedIndividual ,
:FileSystemType .
### http://case.example.org/core#English
:English rdf:type owl:NamedIndividual ,
:Language .
### http://case.example.org/core#Error
:Error rdf:type owl:NamedIndividual ,
:ErrorType .
### http://case.example.org/core#F2FS
:F2FS rdf:type owl:NamedIndividual ,
:FileSystemType .
### http://case.example.org/core#French
:French rdf:type owl:NamedIndividual ,
:Language .
### http://case.example.org/core#GZIP
:GZIP rdf:type owl:NamedIndividual ,
:CompressionMethod .
### http://case.example.org/core#HFS
:HFS rdf:type owl:NamedIndividual ,
:FileSystemType .
### http://case.example.org/core#Huffman
:Huffman rdf:type owl:NamedIndividual ,
:ImageCompressionMethod .
### http://case.example.org/core#Info
:Info rdf:type owl:NamedIndividual ,
:ErrorType .
### http://case.example.org/core#JPEG
:JPEG rdf:type owl:NamedIndividual ,
:ImageCompressionMethod .
### http://case.example.org/core#LVM
:LVM rdf:type owl:NamedIndividual ,
:FileSystemType .
### http://case.example.org/core#LZMA
:LZMA rdf:type owl:NamedIndividual ,
:CompressionMethod .
### http://case.example.org/core#LZW
:LZW rdf:type owl:NamedIndividual ,
:ImageCompressionMethod .
### http://case.example.org/core#LittleEndian
:LittleEndian rdf:type owl:NamedIndividual ,
:ByteOrder .
### http://case.example.org/core#MD5
:MD5 rdf:type owl:NamedIndividual ,
:HashMethod .
### http://case.example.org/core#NTFS
:NTFS rdf:type owl:NamedIndividual ,
:FileSystemType .
### http://case.example.org/core#OFB
:OFB rdf:type owl:NamedIndividual ,
:EncryptionMode .
### http://case.example.org/core#PNG
:PNG rdf:type owl:NamedIndividual ,
:ImageCompressionMethod .
### http://case.example.org/core#Private
:Private rdf:type owl:NamedIndividual ,
:VisibilityType .
### http://case.example.org/core#Public
:Public rdf:type owl:NamedIndividual ,
:VisibilityType .
### http://case.example.org/core#QCOW
:QCOW rdf:type owl:NamedIndividual ,
:ImageType .
### http://case.example.org/core#RAW
:RAW rdf:type owl:NamedIndividual ,
:ImageType .
### http://case.example.org/core#RC4
:RC4 rdf:type owl:NamedIndividual ,
:EncryptionMethod .
### http://case.example.org/core#SHA
:SHA rdf:type owl:NamedIndividual ,
:HashMethod .
### http://case.example.org/core#SHA-1
:SHA-1 rdf:type owl:NamedIndividual ,
:HashMethod .
### http://case.example.org/core#SHA-2
:SHA-2 rdf:type owl:NamedIndividual ,
:HashMethod .
### http://case.example.org/core#SHA256
:SHA256 rdf:type owl:NamedIndividual ,
:HashMethod .
### http://case.example.org/core#SevenZ
:SevenZ rdf:type owl:NamedIndividual ,
:FileSystemType .
### http://case.example.org/core#Spanish
:Spanish rdf:type owl:NamedIndividual ,
:Language .