From 1459af1debc58e8f060c46b9c39349c1e5aec2c0 Mon Sep 17 00:00:00 2001 From: casework Date: Thu, 29 Sep 2016 11:29:24 -0400 Subject: [PATCH] Removed null properties and comments in examples to make them valid. --- examples/call_log.json | 2 +- examples/device.json | 1 - examples/email.json | 3 +- examples/exif_data.json | 1 - examples/file.json | 20 +------ examples/forensic_lifecycle.json | 89 ++++++++++---------------------- examples/location.json | 9 ++-- examples/raw_data.json | 3 -- 8 files changed, 32 insertions(+), 96 deletions(-) diff --git a/examples/call_log.json b/examples/call_log.json index 9310128..c2c5ade 100644 --- a/examples/call_log.json +++ b/examples/call_log.json @@ -40,7 +40,7 @@ "propertyBundle": [ { "@type": "PhoneCall", - "callType": "mobile", // TODO: What are valid call types? + "callType": "mobile", "startTime": "2010-01-15T17:59:43.25Z", "endTime": "2010-01-15T18:30:41.25Z", "sender": "phone_account1", diff --git a/examples/device.json b/examples/device.json index 043d2cc..fd398b9 100644 --- a/examples/device.json +++ b/examples/device.json @@ -3,7 +3,6 @@ "@vocab": "http://case.example.org/core#", "olo": "http://purl.org/ontology/olo/core#", "acme": "http://custompb.acme.org/core#" - // This prefix is used to show the use of the ability to extend with custom property bundles. }, "@graph": [ { diff --git a/examples/email.json b/examples/email.json index b4c371b..16d94e2 100644 --- a/examples/email.json +++ b/examples/email.json @@ -14,8 +14,7 @@ "facebook_identity1", "google_identity1", "email_account1" - ], - "propertyBundle": null + ] }, { "@id": "facebook_identity1", diff --git a/examples/exif_data.json b/examples/exif_data.json index 6758654..aecf404 100644 --- a/examples/exif_data.json +++ b/examples/exif_data.json @@ -59,7 +59,6 @@ "width": 12345, "bitsPerPixel": 2 }, - // TODO: This exif data will be switched to an imported ontology. { "@type": "EXIF", "exifData": [ diff --git a/examples/file.json b/examples/file.json index 354bc1c..0d298a7 100644 --- a/examples/file.json +++ b/examples/file.json @@ -4,10 +4,6 @@ "olo": "http://purl.org/ontology/olo/core#" }, "@graph": [ - // Each data container has a parentDataContainer property which allows us to layer them. - // If you trace down this object, you will see that, the first object represents a Base64 encoded file found within an AES encrypted TAR archive which was a blob within a SQLite database found within an EXT4 file system that was the third partition within an image file found within an NTFS file system. - - // This represents a base64 decoded file. { "@id": "decoded_attachment", "@type": "Trace", @@ -46,8 +42,6 @@ } ] }, - - // This represents a file within a TAR archive. { "@id": "tar_archive_file", "@type": "Trace", @@ -81,8 +75,6 @@ } ] }, - - // This represents an AES decrypted file. (Which in this case is a TAR archive file.) { "@id": "decrypted_blob", "@type": "Trace", @@ -119,8 +111,6 @@ } ] }, - - // This represents a SQLite blob file. { "@id": "sqlite_blob", "@type": "Trace", @@ -138,8 +128,6 @@ } ] }, - - // This represents a database file found within an EXT4 formatted volume. { "@id": "sqlite_database", "@type": "Trace", @@ -169,8 +157,6 @@ } ] }, - - // This represents a partition found in an android image. { "@id": "image_partition", "@type": "Trace", @@ -187,15 +173,12 @@ } ] }, - - // This represents the android image. { "@id": "android_image", "@type": "Trace", "propertyBundle": [ { "@type": "DataContainer", - "parentDataContainer": null, "dataContainerType": "NTFS", "extension": "img", "isDirectory": false, @@ -208,8 +191,7 @@ }, { "@type": "NTFS", - "sid": 1, - "alternateDataStream": null // Leave null when describing the main data stream. + "sid": 1 } ] } diff --git a/examples/forensic_lifecycle.json b/examples/forensic_lifecycle.json index a9d3760..d60f796 100644 --- a/examples/forensic_lifecycle.json +++ b/examples/forensic_lifecycle.json @@ -3,10 +3,8 @@ "@vocab": "http://case.example.org/core#", "olo": "http://purl.org/ontology/olo/core#", "acme": "http://custompb.acme.org/core#" - // This prefix is used to show the use of the ability to extend with custom property bundles. }, "@graph": [ - // Ordered lists are defined using the OrderedListOntology (http://purl.org/ontology/olo/core) { "@id": "forensic_lifecycle1", "@type": "ActionLifecycle", @@ -33,8 +31,7 @@ "olo:index": 5, "olo:item": "phase5" } - ], - "propertyBundle": null + ] }, { "@id": "phase1", @@ -113,8 +110,6 @@ ] }, - // Forensic Actions - { "@id": "forensic_action1", "@type": "ForensicAction", @@ -124,8 +119,7 @@ "performer": "role2", "result": [ "provenance_record1" - ], - "propertyBundle": null + ] }, { "@id": "lifecycle_phase1", @@ -158,8 +152,7 @@ "provenance_record2", "provenance_record3" ], - "location": "fedex_dropoff_location1", - "propertyBundle": null + "location": "fedex_dropoff_location1" }, { "@id": "lifecycle_phase2", @@ -178,8 +171,7 @@ ], "object": [ "forensic_action3" - ], - "propertyBundle": null + ] }, { "@id": "forensic_action3", @@ -258,8 +250,7 @@ "text": "Run Plaso tool to find communications and multimedia exchanged between subject and victim.", "object": [ "forensic_action5" - ], - "propertyBundle": null + ] }, { "@id": "forensic_action5", @@ -301,7 +292,6 @@ ], "isHidden": false }, - // Custom propertybundle that allows us to reference the objects were created for this specific software. { "@type": "acme:PlasoArguments", "input": "android_image", @@ -334,8 +324,6 @@ "forensic_action6" ] }, - // This forensic_action was spawned by the main tool action. It shows the resulting Trace that were produced when - // running a specific parser on specific files found within the image. { "@id": "forensic_action6", "@type": "ForensicAction", @@ -363,7 +351,6 @@ "location": "forensic_lab1", "environment": "forensic_lab_computer1", "propertyBundle": [ - // Custom property bundle used to define arguments used by the parser. { "@type": "acme:PlasoParserArguments", "parsedFile": "message_database", @@ -376,176 +363,152 @@ } ] }, - - // Provenance Records - { "@id": "provenance_record1", "@type": "ProvenanceRecord", "description": "Android Smartphone", "exhibitNumber": "ACME-676553402357", - "object": "device1", - "propertyBundle": null + "object": "device1" }, { "@id": "provenance_record2", "@type": "ProvenanceRecord", "description": "Android Smartphone", "exhibitNumber": "DFL-20140712-001A", - "object": "device1", - "propertyBundle": null + "object": "device1" }, { "@id": "provenance_record3", "@type": "ProvenanceRecord", "description": "SD Card", "exhibitNumber": "DFL-20140712-001B", - "object": "device1", - "propertyBundle": null + "object": "device1" }, { "@id": "provenance_record4", "@type": "ProvenanceRecord", "description": "Forensic image of Android Smartphone", "exhibitNumber": "DFL-20140712-001C", - "object": "android_image", - "propertyBundle": null + "object": "android_image" }, { "@id": "provenance_record5", "@type": "ProvenanceRecord", "description": "Forensic image of SD Card", "exhibitNumber": "DFL-20140712-001D", - "object": "sd_card", - "propertyBundle": null + "object": "sd_card" }, { "@id": "provenance_record6", "@type": "ProvenanceRecord", "description": "Chat Messages Report", "exhibitNumber": "DFL-20140712-001E", - "object": "chat_messages_report", - "propertyBundle": null + "object": "chat_messages_report" }, { "@id": "provenance_record7", "@type": "ProvenanceRecord", "description": "Plaso Storage File", "exhibitNumber": "DFL-20140712-001F", - "object": "plaso_storage_file", - "propertyBundle": null + "object": "plaso_storage_file" }, { "@id": "provenance_record8", "@type": "ProvenanceRecord", "description": "Android OS Information", "exhibitNumber": "DFL-20140712-0020", - "object": "os1", - "propertyBundle": null + "object": "os1" }, { "@id": "provenance_record9", "@type": "ProvenanceRecord", "description": "Contraband photograph", "exhibitNumber": "DFL-20140712-0021", - "object": "attachment_file", - "propertyBundle": null + "object": "attachment_file" }, { "@id": "provenance_record10", "@type": "ProvenanceRecord", "description": "WhatsApp message database", "exhibitNumber": "DFL-20140712-0022", - "object": "message_database", - "propertyBundle": null + "object": "message_database" }, { "@id": "provenance_record11", "@type": "ProvenanceRecord", "description": "WhatsApp thumbnail database", "exhibitNumber": "DFL-20140712-0023", - "object": "thumbnail_database", - "propertyBundle": null + "object": "thumbnail_database" }, { "@id": "provenance_record12", "@type": "ProvenanceRecord", "description": "Android data partition", "exhibitNumber": "DFL-20140712-0024", - "object": "image_partition", - "propertyBundle": null + "object": "image_partition" }, { "@id": "provenance_record13", "@type": "ProvenanceRecord", "description": "WhatsApp message being sent from subject to victim", "exhibitNumber": "DFL-20140712-0025", - "object": "message_action1", - "propertyBundle": null + "object": "message_action1" }, { "@id": "provenance_record14", "@type": "ProvenanceRecord", "description": "WhatsApp chat message thread between subject and victim", "exhibitNumber": "DFL-20140712-0026", - "object": "thread1", - "propertyBundle": null + "object": "thread1" }, { "@id": "provenance_record15", "@type": "ProvenanceRecord", "description": "WhatsApp chat message containing contraband attachment", "exhibitNumber": "DFL-20140712-0027", - "object": "message1", - "propertyBundle": null + "object": "message1" }, { "@id": "provenance_record16", "@type": "ProvenanceRecord", "description": "Location of subject when using WhatsApp", "exhibitNumber": "DFL-20140712-0028", - "object": "location1", - "propertyBundle": null + "object": "location1" }, { "@id": "provenance_record17", "@type": "ProvenanceRecord", "description": "Subject's WhatsApp account", "exhibitNumber": "DFL-20140712-0029", - "object": "account1", - "propertyBundle": null + "object": "account1" }, { "@id": "provenance_record18", "@type": "ProvenanceRecord", "description": "Victim's WhatsApp account", "exhibitNumber": "DFL-20140712-002A", - "object": "account2", - "propertyBundle": null + "object": "account2" }, { "@id": "provenance_record19", "@type": "ProvenanceRecord", "description": "Thumbnail of contraband picture", "exhibitNumber": "DFL-20140712-002B", - "object": "decoded_blob", - "propertyBundle": null + "object": "decoded_blob" }, { "@id": "provenance_record20", "@type": "ProvenanceRecord", "description": "Encoded thumbnail of contraband picture", "exhibitNumber": "DFL-20140712-002C", - "object": "decrypted_blob", - "propertyBundle": null + "object": "decrypted_blob" }, { "@id": "provenance_record21", "@type": "ProvenanceRecord", "description": "Encrypted thumbnail of contraband picture", "exhibitNumber": "DFL-20140712-002D", - "object": "sqlite_blob", - "propertyBundle": null + "object": "sqlite_blob" } ] } \ No newline at end of file diff --git a/examples/location.json b/examples/location.json index 5ccf417..808e668 100644 --- a/examples/location.json +++ b/examples/location.json @@ -2,14 +2,13 @@ "@context": { "@vocab": "http://case.example.org/core#", "olo": "http://purl.org/ontology/olo/core#", - "schema": "http://schema.org", // This example will show the use of schema.org to describe Location and Identity objects. This ontology is only a placeholder until an ontology has been chosen. - "acme": "http://custompb.acme.org/core#" // This prefix is used to show the use of the ability to extend with custom property bundles. + "schema": "http://schema.org", + "acme": "http://custompb.acme.org/core#" }, "@graph": [ { "@id": "location1", "@type": "Location", - // Example using another defined ontology to represent our location. "schema:Address": { "@type": "schema:PostalAddress", "schema:addressLocality": "Seattle", @@ -17,7 +16,6 @@ "schema:postalCode": "98052", "schema:streetAddress": "20341 Whitworth Institute 405 N. Whitworth" }, - // This is an example of how you can extend an Trace with a custom property bundle. "propertyBundle": [ { "@type": "acme:InternalLocation", @@ -35,8 +33,7 @@ "schema:addressRegion": "", "schema:postalCode": "F-75002", "schema:streetAddress": "38 Bad Guy Headquarters st." - }, - "propertyBundle": null + } } ] } \ No newline at end of file diff --git a/examples/raw_data.json b/examples/raw_data.json index 196a88e..fc04479 100644 --- a/examples/raw_data.json +++ b/examples/raw_data.json @@ -3,9 +3,6 @@ "@vocab": "http://case.example.org/core#" }, "@graph": [ - - // This represents a range of data found within a digital photograph which contains the thumbnail of the image. - // This thumbnail is a 2878 byte file located at offset 224 within the digital photograph. { "@id": "digital_photograph_thumbnail1", "@type": "Trace",