From e22e8d83cbf7a9cf02b414c38c9c798b1e471e79 Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Mon, 25 Sep 2023 21:52:17 -0400 Subject: [PATCH 1/4] Add to pre-commit Python review rules used in other CASE repos Some existing scripts were updated from pre-commit review. This is in preparation of adding a Python script to CASE-Examples. No effects were observed on Make-managed files. Signed-off-by: Alex Nelson --- .pre-commit-config.yaml | 17 ++++++++++++++++- examples/illustrations/message/test_message.py | 15 +++++++++------ .../src/generic_snippet_combiner.py | 11 +++++++++-- 3 files changed, 34 insertions(+), 9 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 0e429a60..ba630d0f 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,5 +1,5 @@ repos: -- repo: https://github.com/pre-commit/pre-commit-hooks + - repo: https://github.com/pre-commit/pre-commit-hooks rev: v4.4.0 hooks: - id: check-json @@ -9,3 +9,18 @@ repos: - --indent=4 - --no-ensure-ascii - --no-sort-keys + - repo: https://github.com/psf/black + rev: 23.9.1 + hooks: + - id: black + - repo: https://github.com/pycqa/flake8 + rev: 6.1.0 + hooks: + - id: flake8 + args: + - --extend-ignore=E203,E501 + - repo: https://github.com/pycqa/isort + rev: 5.12.0 + hooks: + - id: isort + name: isort (python) diff --git a/examples/illustrations/message/test_message.py b/examples/illustrations/message/test_message.py index 080f9136..e65a611a 100644 --- a/examples/illustrations/message/test_message.py +++ b/examples/illustrations/message/test_message.py @@ -11,12 +11,11 @@ # # We would appreciate acknowledgement if the software is used. -import logging -import os import pathlib import rdflib.plugins.sparql + def test_messages_have_sent_times() -> None: expected = set() computed = set() @@ -24,13 +23,15 @@ def test_messages_have_sent_times() -> None: graph = rdflib.Graph() srcdir_path = pathlib.Path(__file__).parent message_json_path = srcdir_path / "message.json" - assert message_json_path.exists(), "message.json not found in same directory as test." + assert ( + message_json_path.exists() + ), "message.json not found in same directory as test." # TODO - Remove 'format' parameter when an rdflib release with this PR is issued: # https://github.com/RDFLib/rdflib/pull/1403 graph.parse(str(message_json_path), format="json-ld") - nsdict = {k:v for (k,v) in graph.namespace_manager.namespaces()} + nsdict = {k: v for (k, v) in graph.namespace_manager.namespaces()} query_str = """\ SELECT ?nMessage @@ -39,7 +40,7 @@ def test_messages_have_sent_times() -> None: ?nMessageFacet a uco-observable:MessageFacet . FILTER NOT EXISTS { ?nMessageFacet uco-observable:sentTime ?lSentTime . - } + } } """ query_object = rdflib.plugins.sparql.prepareQuery(query_str, initNs=nsdict) @@ -47,4 +48,6 @@ def test_messages_have_sent_times() -> None: n_message = result[0] computed.add(n_message.toPython()) - assert expected == computed, "Message objects with IRIs in the 'computed' set do not have sent-times. Please ensure this example has sent-times." + assert ( + expected == computed + ), "Message objects with IRIs in the 'computed' set do not have sent-times. Please ensure this example has sent-times." diff --git a/examples/illustrations/src/generic_snippet_combiner.py b/examples/illustrations/src/generic_snippet_combiner.py index 19d78dd8..e31ae6bc 100644 --- a/examples/illustrations/src/generic_snippet_combiner.py +++ b/examples/illustrations/src/generic_snippet_combiner.py @@ -22,13 +22,14 @@ __version__ = "0.1.2" -import logging import json +import logging import os import sys _logger = logging.getLogger(os.path.basename(__file__)) + def main(): obj = None _logger.info("args.in_json = %r.", args.in_json) @@ -58,10 +59,16 @@ def main(): json.dump(obj, sys.stdout, indent=4, sort_keys=True) sys.stdout.write("\n") + if __name__ == "__main__": import argparse + parser = argparse.ArgumentParser() - parser.add_argument("in_json", nargs="+", help="The first argument is the \"base\" JSON-LD file, including context dictionary.") + parser.add_argument( + "in_json", + nargs="+", + help='The first argument is the "base" JSON-LD file, including context dictionary.', + ) args = parser.parse_args() logging.basicConfig(level=logging.INFO) main() From 4c26ca7afe3e9224102ce2f657835aa1f640953a Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Mon, 25 Sep 2023 21:56:47 -0400 Subject: [PATCH 2/4] Add proof of concept script and framework for Relationship illustration This also sets up README sections, and in some cases stub README files, to show the availability of the Relationship renders. A follow-on patch will regenerate Make-managed files. Disclaimer: Participation by NIST in the creation of the documentation of mentioned software is not intended to imply a recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that any specific software is necessarily the best available for the purpose. Signed-off-by: Alex Nelson --- README.md | 14 +- examples/illustrations/Oresteia/Makefile | 2 + examples/illustrations/Oresteia/README.md | 9 +- examples/illustrations/accounts/Makefile | 2 + examples/illustrations/accounts/README.md | 8 + .../bulk_extractor_forensic_path/Makefile | 2 + .../bulk_extractor_forensic_path/README.md | 7 + examples/illustrations/cell_site/Makefile | 2 + examples/illustrations/cell_site/README.md | 9 ++ .../illustrations/cell_site/src/README.md.in | 9 ++ .../illustrations/database_records/Makefile | 2 + .../illustrations/database_records/README.md | 7 + .../database_records/src/README.md.in | 7 + examples/illustrations/file/Makefile | 2 + examples/illustrations/file/README.md | 7 + .../illustrations/forensic_lifecycle/Makefile | 2 + .../forensic_lifecycle/README.md | 8 + examples/illustrations/message/Makefile | 2 + examples/illustrations/message/README.md | 8 + .../mobile_device_and_sim_card/Makefile | 2 + .../mobile_device_and_sim_card/README.md | 8 + .../illustrations/multipart_file/Makefile | 2 + .../illustrations/multipart_file/README.md | 7 + .../illustrations/network_connection/Makefile | 2 + .../network_connection/README.md | 8 + examples/illustrations/raw_data/Makefile | 2 + examples/illustrations/raw_data/README.md | 8 + .../illustrations/reconstructed_file/Makefile | 2 + .../reconstructed_file/README.md | 7 + .../illustrations/sms_and_contacts/Makefile | 2 + .../illustrations/sms_and_contacts/README.md | 8 + .../illustrations/spear_phishing/Makefile | 2 + .../illustrations/spear_phishing/README.md | 7 + .../illustrations/src/illustration-basedir.mk | 3 + .../illustrations/src/illustration-nosrc.mk | 28 ++++ src/case_relationships_dot.py | 138 ++++++++++++++++++ 36 files changed, 337 insertions(+), 8 deletions(-) create mode 100644 examples/illustrations/accounts/README.md create mode 100644 examples/illustrations/forensic_lifecycle/README.md create mode 100644 examples/illustrations/message/README.md create mode 100644 examples/illustrations/mobile_device_and_sim_card/README.md create mode 100644 examples/illustrations/network_connection/README.md create mode 100644 examples/illustrations/raw_data/README.md create mode 100644 examples/illustrations/sms_and_contacts/README.md create mode 100644 src/case_relationships_dot.py diff --git a/README.md b/README.md index 7af8eee9..3b7995c1 100644 --- a/README.md +++ b/README.md @@ -9,7 +9,7 @@ Further illustration can be found at the [CASE narratives gallery](https://caseo Mapping notes & respective JSON-LD output: -- [Accounts](examples/illustrations/accounts/accounts.json) +- [Accounts](examples/illustrations/accounts/accounts.json) ([*info*](examples/illustrations/accounts/)) - [Analysis](examples/illustrations/analysis/analysis.json) ([*info*](examples/illustrations/analysis/)) - [Bulk Extractor Forensic Path](examples/illustrations/bulk_extractor_forensic_path/bulk_extractor_forensic_path.json) (*[info](examples/illustrations/bulk_extractor_forensic_path/)*) - [Call Log](examples/illustrations/call_log/call_log.json) @@ -19,17 +19,17 @@ Mapping notes & respective JSON-LD output: - [EXIF Data](examples/illustrations/exif_data/exif_data.json) - [Event](examples/illustrations/event/event.json) - [Files](examples/illustrations/file/file.json) (*[info](examples/illustrations/file/)*) -- [Forensic Lifecycle](examples/illustrations/forensic_lifecycle/forensic_lifecycle.json) +- [Forensic Lifecycle](examples/illustrations/forensic_lifecycle/forensic_lifecycle.json) ([*info*](examples/illustrations/forensic_lifecycle/)) - [Location](examples/illustrations/location/location.json) -- [Message](examples/illustrations/message/message.json) -- [Mobile device and SIM card](examples/illustrations/mobile_device_and_sim_card/mobile_device_and_sim_card.json) +- [Message](examples/illustrations/message/message.json) ([*info*](examples/illustrations/message/)) +- [Mobile device and SIM card](examples/illustrations/mobile_device_and_sim_card/mobile_device_and_sim_card.json) ([*info*](examples/illustrations/mobile_device_and_sim_card/)) - [Multipart File](examples/illustrations/multipart_file/multipart_file.json) (*[info](examples/illustrations/multipart_file/)*) -- [Network connection](examples/illustrations/network_connection/network_connection.json) +- [Network connection](examples/illustrations/network_connection/network_connection.json) (*[info](examples/illustrations/network_connection/)*) - [Oresteia](examples/illustrations/Oresteia/Oresteia.json) (*[info](examples/illustrations/Oresteia/)*) -- [Raw Data](examples/illustrations/raw_data/raw_data.json) +- [Raw Data](examples/illustrations/raw_data/raw_data.json) (*[info](examples/illustrations/raw_data/)*) - [Reconstructed File](examples/illustrations/reconstructed_file/reconstructed_file.json) (*[info](examples/illustrations/reconstructed_file/)*) - [Recoverability](examples/illustrations/recoverability/recoverability.json) (*[info](examples/illustrations/recoverability/)*) -- [SMS and Contacts](examples/illustrations/sms_and_contacts/sms_and_contacts.json) +- [SMS and Contacts](examples/illustrations/sms_and_contacts/sms_and_contacts.json) (*[info](examples/illustrations/sms_and_contacts/)*) - [Spear Phishing](examples/illustrations/spear_phishing/spear_phishing.json), scenario drafted by [Open Cybersecurity Alliance](https://github.com/opencybersecurityalliance/oca-ontology) (*[info](examples/illustrations/spear_phishing/)*) diff --git a/examples/illustrations/Oresteia/Makefile b/examples/illustrations/Oresteia/Makefile index a8a5de30..1c6e5e7a 100644 --- a/examples/illustrations/Oresteia/Makefile +++ b/examples/illustrations/Oresteia/Makefile @@ -13,4 +13,6 @@ RENDER_PROV := yes +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/Oresteia/README.md b/examples/illustrations/Oresteia/README.md index d6b5234d..e227f372 100644 --- a/examples/illustrations/Oresteia/README.md +++ b/examples/illustrations/Oresteia/README.md @@ -7,9 +7,16 @@ collectively called The Oresteia. For illustrative purposes, the characters of these ancient stories are given access to modern technology. +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/Oresteia-relationships.svg](figures/Oresteia-relationships.svg) + + ## Provenance illustrations -Following visual-design practices of [PROV-O](https://www.w3.org/TR/prov-o/), the following renders of this scenario are available: +Following visual-design practices of [PROV-O](https://www.w3.org/TR/prov-o/), the following renders of this scenario's provenance are available: | Figure's contents | Time hidden | Time displayed | | --- | --- | --- | diff --git a/examples/illustrations/accounts/Makefile b/examples/illustrations/accounts/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/accounts/Makefile +++ b/examples/illustrations/accounts/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/accounts/README.md b/examples/illustrations/accounts/README.md new file mode 100644 index 00000000..536f6ee8 --- /dev/null +++ b/examples/illustrations/accounts/README.md @@ -0,0 +1,8 @@ +# Accounts Example + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/accounts-relationships.svg](figures/accounts-relationships.svg) diff --git a/examples/illustrations/bulk_extractor_forensic_path/Makefile b/examples/illustrations/bulk_extractor_forensic_path/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/bulk_extractor_forensic_path/Makefile +++ b/examples/illustrations/bulk_extractor_forensic_path/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/bulk_extractor_forensic_path/README.md b/examples/illustrations/bulk_extractor_forensic_path/README.md index 7ed2d43d..4bb3f023 100644 --- a/examples/illustrations/bulk_extractor_forensic_path/README.md +++ b/examples/illustrations/bulk_extractor_forensic_path/README.md @@ -22,3 +22,10 @@ extract out the email addresses. - *relationship3* (Compression : GZIP) -> **decompressed_gzip0** - *relationship0* (DataRange : 1600) -> **extracted_email_address0** - *relationship1* (DataRange : 16095) -> **extracted_email_address1** + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/bulk_extractor_forensic_path-relationships.svg](figures/bulk_extractor_forensic_path-relationships.svg) diff --git a/examples/illustrations/cell_site/Makefile b/examples/illustrations/cell_site/Makefile index 1e1a0893..61da515e 100644 --- a/examples/illustrations/cell_site/Makefile +++ b/examples/illustrations/cell_site/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-basedir.mk diff --git a/examples/illustrations/cell_site/README.md b/examples/illustrations/cell_site/README.md index b3c15890..4f2d2d0d 100644 --- a/examples/illustrations/cell_site/README.md +++ b/examples/illustrations/cell_site/README.md @@ -350,6 +350,15 @@ Per practice of this example organization, the derivation of the relationship is ] ``` + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/cell_site-relationships.svg](figures/cell_site-relationships.svg) + + + [^1]: Creative Commons License OpenCelliD Project is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. [^2]: The example organization has not discussed policy on how to handle matters such as cell sites being retired from service. Such a policy would be necessary to process that no record is currently found with `cellSiteIdentifier` value `29220952` within their data source. This is a practice that would be better explored by interested investigative community members. [^3]: SOSA defines that a `sosa:Observation` uniquely has one `Property` that is the subject of the measurement. As OWL ontology data, that property does not necessarily need to be recorded. By leaving the property absent, we still express that the feature of interest, the cell site, was observed; we just do not say what about it we were observing. "The property that expresses the location of this object" is not something for which CASE or UCO yet has a clear representation practice, so we omit it in this example. diff --git a/examples/illustrations/cell_site/src/README.md.in b/examples/illustrations/cell_site/src/README.md.in index db320949..cbca73ab 100644 --- a/examples/illustrations/cell_site/src/README.md.in +++ b/examples/illustrations/cell_site/src/README.md.in @@ -122,6 +122,15 @@ Per practice of this example organization, the derivation of the relationship is @CELL_SITE_CDR_SITE_LOCATION_JSON@ ``` + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/cell_site-relationships.svg](figures/cell_site-relationships.svg) + + + [^1]: Creative Commons License OpenCelliD Project is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. [^2]: The example organization has not discussed policy on how to handle matters such as cell sites being retired from service. Such a policy would be necessary to process that no record is currently found with `cellSiteIdentifier` value `29220952` within their data source. This is a practice that would be better explored by interested investigative community members. [^3]: SOSA defines that a `sosa:Observation` uniquely has one `Property` that is the subject of the measurement. As OWL ontology data, that property does not necessarily need to be recorded. By leaving the property absent, we still express that the feature of interest, the cell site, was observed; we just do not say what about it we were observing. "The property that expresses the location of this object" is not something for which CASE or UCO yet has a clear representation practice, so we omit it in this example. diff --git a/examples/illustrations/database_records/Makefile b/examples/illustrations/database_records/Makefile index 1e1a0893..61da515e 100644 --- a/examples/illustrations/database_records/Makefile +++ b/examples/illustrations/database_records/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-basedir.mk diff --git a/examples/illustrations/database_records/README.md b/examples/illustrations/database_records/README.md index 680370af..bc5ab2c1 100644 --- a/examples/illustrations/database_records/README.md +++ b/examples/illustrations/database_records/README.md @@ -177,3 +177,10 @@ This allows an identified artifact (such as a message) to be linked to a databas ] ``` + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/database_records-relationships.svg](figures/database_records-relationships.svg) diff --git a/examples/illustrations/database_records/src/README.md.in b/examples/illustrations/database_records/src/README.md.in index 75440707..a2cc57a8 100644 --- a/examples/illustrations/database_records/src/README.md.in +++ b/examples/illustrations/database_records/src/README.md.in @@ -43,3 +43,10 @@ This allows an identified artifact (such as a message) to be linked to a databas @DATABASE_RECORDS_ARTIFACT_LINKING_JSON@ ``` + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/database_records-relationships.svg](figures/database_records-relationships.svg) diff --git a/examples/illustrations/file/Makefile b/examples/illustrations/file/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/file/Makefile +++ b/examples/illustrations/file/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/file/README.md b/examples/illustrations/file/README.md index 58f740a7..bd3f0662 100644 --- a/examples/illustrations/file/README.md +++ b/examples/illustrations/file/README.md @@ -50,3 +50,10 @@ encoding algorithm used to decode the `target` file. For the extraction of an embedded section of raw bytes within the `target` file, we use the **DataRange** property bundle which provides the offset location and range size within the `target` file. + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/file-relationships.svg](figures/file-relationships.svg) diff --git a/examples/illustrations/forensic_lifecycle/Makefile b/examples/illustrations/forensic_lifecycle/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/forensic_lifecycle/Makefile +++ b/examples/illustrations/forensic_lifecycle/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/forensic_lifecycle/README.md b/examples/illustrations/forensic_lifecycle/README.md new file mode 100644 index 00000000..477a142f --- /dev/null +++ b/examples/illustrations/forensic_lifecycle/README.md @@ -0,0 +1,8 @@ +# Forensic lifecycle Example + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/forensic_lifecycle-relationships.svg](figures/forensic_lifecycle-relationships.svg) diff --git a/examples/illustrations/message/Makefile b/examples/illustrations/message/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/message/Makefile +++ b/examples/illustrations/message/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/message/README.md b/examples/illustrations/message/README.md new file mode 100644 index 00000000..5c32fb37 --- /dev/null +++ b/examples/illustrations/message/README.md @@ -0,0 +1,8 @@ +# Message Example + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/message-relationships.svg](figures/message-relationships.svg) diff --git a/examples/illustrations/mobile_device_and_sim_card/Makefile b/examples/illustrations/mobile_device_and_sim_card/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/mobile_device_and_sim_card/Makefile +++ b/examples/illustrations/mobile_device_and_sim_card/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/mobile_device_and_sim_card/README.md b/examples/illustrations/mobile_device_and_sim_card/README.md new file mode 100644 index 00000000..62a3a23e --- /dev/null +++ b/examples/illustrations/mobile_device_and_sim_card/README.md @@ -0,0 +1,8 @@ +# Mobile Device and SIM Card Example + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/mobile_device_and_sim_card-relationships.svg](figures/mobile_device_and_sim_card-relationships.svg) diff --git a/examples/illustrations/multipart_file/Makefile b/examples/illustrations/multipart_file/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/multipart_file/Makefile +++ b/examples/illustrations/multipart_file/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/multipart_file/README.md b/examples/illustrations/multipart_file/README.md index 2ee16b01..38dc1631 100644 --- a/examples/illustrations/multipart_file/README.md +++ b/examples/illustrations/multipart_file/README.md @@ -11,3 +11,10 @@ that is explained in [*file*](../file/). By using **Relationship** objects with each fragment of the file can be explicitly associated with the overall file. Each fragment object would then have a **Fragment** property bundle that describes the position (*fragmentIndex*) of this particular fragment within the reconstructed file. The *totalFragments* property may be used to help the serializer know how many total fragments to look for. + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/multipart_file-relationships.svg](figures/multipart_file-relationships.svg) diff --git a/examples/illustrations/network_connection/Makefile b/examples/illustrations/network_connection/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/network_connection/Makefile +++ b/examples/illustrations/network_connection/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/network_connection/README.md b/examples/illustrations/network_connection/README.md new file mode 100644 index 00000000..ce976dc5 --- /dev/null +++ b/examples/illustrations/network_connection/README.md @@ -0,0 +1,8 @@ +# Network Connection Example + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/network_connection-relationships.svg](figures/network_connection-relationships.svg) diff --git a/examples/illustrations/raw_data/Makefile b/examples/illustrations/raw_data/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/raw_data/Makefile +++ b/examples/illustrations/raw_data/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/raw_data/README.md b/examples/illustrations/raw_data/README.md new file mode 100644 index 00000000..91ee1066 --- /dev/null +++ b/examples/illustrations/raw_data/README.md @@ -0,0 +1,8 @@ +# Raw Data Example + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/raw_data-relationships.svg](figures/raw_data-relationships.svg) diff --git a/examples/illustrations/reconstructed_file/Makefile b/examples/illustrations/reconstructed_file/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/reconstructed_file/Makefile +++ b/examples/illustrations/reconstructed_file/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/reconstructed_file/README.md b/examples/illustrations/reconstructed_file/README.md index e3bacf93..04f7dc9a 100644 --- a/examples/illustrations/reconstructed_file/README.md +++ b/examples/illustrations/reconstructed_file/README.md @@ -29,3 +29,10 @@ The reconstructed file can be extracted using dd as follows: % shasum -a 256 reconstructed_file ee8b9c17c44e128e9e95d60fe219e95feae53c463b01016a312f8c5b732f21de reconstructed_file.jpg ``` + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/reconstructed_file-relationships.svg](figures/reconstructed_file-relationships.svg) diff --git a/examples/illustrations/sms_and_contacts/Makefile b/examples/illustrations/sms_and_contacts/Makefile index e66880d6..078be6d2 100644 --- a/examples/illustrations/sms_and_contacts/Makefile +++ b/examples/illustrations/sms_and_contacts/Makefile @@ -11,4 +11,6 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk diff --git a/examples/illustrations/sms_and_contacts/README.md b/examples/illustrations/sms_and_contacts/README.md new file mode 100644 index 00000000..e86da10d --- /dev/null +++ b/examples/illustrations/sms_and_contacts/README.md @@ -0,0 +1,8 @@ +# SMS and Contacts Example + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/sms_and_contacts-relationships.svg](figures/sms_and_contacts-relationships.svg) diff --git a/examples/illustrations/spear_phishing/Makefile b/examples/illustrations/spear_phishing/Makefile index b37c0838..e4c65240 100644 --- a/examples/illustrations/spear_phishing/Makefile +++ b/examples/illustrations/spear_phishing/Makefile @@ -11,6 +11,8 @@ # # We would appreciate acknowledgement if the software is used. +RENDER_RELATIONSHIPS := yes + include ../src/illustration-nosrc.mk all: spear_phishing.ttl diff --git a/examples/illustrations/spear_phishing/README.md b/examples/illustrations/spear_phishing/README.md index bc6317c7..79472d47 100644 --- a/examples/illustrations/spear_phishing/README.md +++ b/examples/illustrations/spear_phishing/README.md @@ -12,3 +12,10 @@ The UCO rule requiring all named individuals end with a UUID has been deactivate As documentation and figures are transcribed to RDF, all named individuals are initially given only the type `uco-core:UcoThing`. At the end of the scenario rendering process, all individuals will have the most specific types available within CASE and UCO, and all predicates in the graph with the prefix `unmapped:` will be replaced with approprate properties or `uco-core:Relationship` objects. + + +## Relationship illustrations + +Using a proof-of-concept illustration system, a render of this scenario's `uco-core:Relationship` objects is available: + +![figures/spear_phishing-relationships.svg](figures/spear_phishing-relationships.svg) diff --git a/examples/illustrations/src/illustration-basedir.mk b/examples/illustrations/src/illustration-basedir.mk index 9a288076..2e069ede 100644 --- a/examples/illustrations/src/illustration-basedir.mk +++ b/examples/illustrations/src/illustration-basedir.mk @@ -18,6 +18,7 @@ top_srcdir := $(shell cd ../../.. ; pwd) illustration_name := $(shell basename $$PWD) RENDER_PROV ?= +RENDER_RELATIONSHIPS ?= # `diff` is used to determine if a copy operation should happen. # If it happens each time, validation files will be regenerated on every @@ -34,6 +35,7 @@ all: $(illustration_name).json $(MAKE) \ RENDER_PROV="$(RENDER_PROV)" \ + RENDER_RELATIONSHIPS="$(RENDER_RELATIONSHIPS)" \ --file ../src/illustration-nosrc.mk check: @@ -46,6 +48,7 @@ check: check $(MAKE) \ RENDER_PROV="$(RENDER_PROV)" \ + RENDER_RELATIONSHIPS="$(RENDER_RELATIONSHIPS)" \ --file ../src/illustration-nosrc.mk \ check diff \ diff --git a/examples/illustrations/src/illustration-nosrc.mk b/examples/illustrations/src/illustration-nosrc.mk index edbcdc42..4b7f0b2f 100644 --- a/examples/illustrations/src/illustration-nosrc.mk +++ b/examples/illustrations/src/illustration-nosrc.mk @@ -56,9 +56,18 @@ else prov_svgs := endif +RENDER_RELATIONSHIPS ?= +ifeq ($(RENDER_RELATIONSHIPS),yes) +relationship_svgs := \ + figures/$(example_name)-relationships.svg +else +relationship_svgs := +endif + all: \ $(example_name)_validation.ttl \ $(prov_svgs) \ + $(relationship_svgs) \ $(example_name)_validation-develop.ttl \ $(example_name)_validation-develop-2.0.0.ttl \ $(example_name)_validation-unstable.ttl \ @@ -479,3 +488,22 @@ figures/$(example_name)-prov-time-entities.dot: \ $(example_name)-prov.ttl \ $(example_name).json mv $@_ $@ + +figures/$(example_name)-relationships.dot: \ + $(example_name).json \ + $(top_srcdir)/.venv.done.log \ + $(top_srcdir)/src/case_relationships_dot.py + mkdir -p figures + source $(top_srcdir)/venv/bin/activate \ + && python3 $(top_srcdir)/src/case_relationships_dot.py \ + $@_ \ + $< + mv $@_ $@ + +figures/$(example_name)-relationships.svg: \ + figures/$(example_name)-relationships.dot + neato \ + -T svg \ + -o $@_ \ + $< + mv $@_ $@ diff --git a/src/case_relationships_dot.py b/src/case_relationships_dot.py new file mode 100644 index 00000000..85e89424 --- /dev/null +++ b/src/case_relationships_dot.py @@ -0,0 +1,138 @@ +#!/usr/bin/env python3 + +# Portions of this file contributed by NIST are governed by the +# following statement: +# +# This software was developed at the National Institute of Standards +# and Technology by employees of the Federal Government in the course +# of their official duties. Pursuant to Title 17 Section 105 of the +# United States Code, this software is not subject to copyright +# protection within the United States. NIST assumes no responsibility +# whatsoever for its use by other parties, and makes no guarantees, +# expressed or implied, about its quality, reliability, or any other +# characteristic. +# +# We would appreciate acknowledgement if the software is used. + +__version__ = "0.1.0" + +import argparse +from typing import Dict, List, Set, Tuple + +import pydot +import rdflib +from case_prov.case_prov_dot import iri_to_gv_node_id, qname +from case_utils.namespace import NS_UCO_CORE +from rdflib import Literal, URIRef +from rdflib.query import ResultRow + + +def main() -> None: + parser = argparse.ArgumentParser() + parser.add_argument("out_dot") + parser.add_argument("in_rdf", nargs="+") + args = parser.parse_args() + + in_graph = rdflib.Graph() + out_graph = pydot.Dot( + "CASE render of directional relationships", + graph_type="digraph", + overlap="false", + ) + + for in_rdf in args.in_rdf: + in_graph.parse(in_rdf) + + n_things_to_display: Set[URIRef] = set() + query = """\ +PREFIX uco-core: +SELECT ?nSource ?nTarget +WHERE { + ?nRelationship + uco-core:kindOfRelationship ?lKind ; + uco-core:source ?nSource ; + uco-core:target ?nTarget ; + . +} +""" + for result in in_graph.query(query): + assert isinstance(result, ResultRow) + assert isinstance(result[0], URIRef) + assert isinstance(result[1], URIRef) + n_things_to_display.add(result[0]) + n_things_to_display.add(result[1]) + + edges_to_display: Set[Tuple[URIRef, URIRef, str]] = set() + query = """\ +PREFIX uco-core: +SELECT ?nSource ?nTarget ?lIsDirectional ?lKind +WHERE { + ?nRelationship + uco-core:isDirectional ?lIsDirectional ; + uco-core:kindOfRelationship ?lKind ; + uco-core:source ?nSource ; + uco-core:target ?nTarget ; + . +} +""" + for result in in_graph.query(query): + assert isinstance(result, ResultRow) + assert isinstance(result[0], URIRef) + assert isinstance(result[1], URIRef) + assert isinstance(result[2], Literal) + assert isinstance(result[3], Literal) + edges_to_display.add( + (result[0], result[1], result[2].toPython(), str(result[3])) + ) + + for n_thing in sorted(n_things_to_display): + label_parts: List[str] = ["ID - " + qname(in_graph, n_thing)] + for l_name in in_graph.objects(n_thing, NS_UCO_CORE.name): + assert isinstance(l_name, Literal) + label_parts.append(l_name) + for l_description in in_graph.objects(n_thing, NS_UCO_CORE.description): + assert isinstance(l_description, Literal) + label_parts.append(l_description) + dot_node = pydot.Node( + iri_to_gv_node_id(n_thing), + label="\n\n".join(label_parts), + tooltip=str(n_thing), + ) + out_graph.add_node(dot_node) + + # Represent the Relationship object as a "hinge" node to keep the + # edge label from overlapping with nodes. + for edge_to_display in sorted(edges_to_display): + dot_edge_hinge = pydot.Node( + iri_to_gv_node_id( + str(edge_to_display[0]) + str(edge_to_display[1]) + edge_to_display[3] + ), + label=edge_to_display[3], + shape="none", + tooltip="", + ) + + # Work around 'dir' for arrowhead directionality being a reserved word in Python. + # https://www.graphviz.org/docs/attrs/dir/ + edge_attributes: Dict[str, str] = { + "dir": "forward" if edge_to_display[2] else "none" + } + dot_edge_0 = pydot.Edge( + iri_to_gv_node_id(edge_to_display[0]), + dot_edge_hinge, + **edge_attributes, + ) + dot_edge_1 = pydot.Edge( + dot_edge_hinge, + iri_to_gv_node_id(edge_to_display[1]), + **edge_attributes, + ) + out_graph.add_node(dot_edge_hinge) + out_graph.add_edge(dot_edge_0) + out_graph.add_edge(dot_edge_1) + + out_graph.write_raw(args.out_dot) + + +if __name__ == "__main__": + main() From 49e0b544e569ade41e2f7df65883c100f076615f Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Mon, 25 Sep 2023 22:28:22 -0400 Subject: [PATCH 3/4] Regenerate Make-managed files Signed-off-by: Alex Nelson --- .../figures/Oresteia-relationships.svg | 465 ++++++++++++++++++ .../figures/accounts-relationships.svg | 134 +++++ ..._extractor_forensic_path-relationships.svg | 178 +++++++ .../figures/cell_site-relationships.svg | 136 +++++ .../database_records-relationships.svg | 122 +++++ .../file/figures/file-relationships.svg | 256 ++++++++++ .../forensic_lifecycle-relationships.svg | 205 ++++++++ .../message/figures/message-relationships.svg | 100 ++++ ...bile_device_and_sim_card-relationships.svg | 74 +++ .../figures/multipart_file-relationships.svg | 160 ++++++ .../network_connection-relationships.svg | 74 +++ .../figures/raw_data-relationships.svg | 48 ++ .../reconstructed_file-relationships.svg | 160 ++++++ .../sms_and_contacts-relationships.svg | 100 ++++ .../figures/spear_phishing-relationships.svg | 209 ++++++++ 15 files changed, 2421 insertions(+) create mode 100644 examples/illustrations/Oresteia/figures/Oresteia-relationships.svg create mode 100644 examples/illustrations/accounts/figures/accounts-relationships.svg create mode 100644 examples/illustrations/bulk_extractor_forensic_path/figures/bulk_extractor_forensic_path-relationships.svg create mode 100644 examples/illustrations/cell_site/figures/cell_site-relationships.svg create mode 100644 examples/illustrations/database_records/figures/database_records-relationships.svg create mode 100644 examples/illustrations/file/figures/file-relationships.svg create mode 100644 examples/illustrations/forensic_lifecycle/figures/forensic_lifecycle-relationships.svg create mode 100644 examples/illustrations/message/figures/message-relationships.svg create mode 100644 examples/illustrations/mobile_device_and_sim_card/figures/mobile_device_and_sim_card-relationships.svg create mode 100644 examples/illustrations/multipart_file/figures/multipart_file-relationships.svg create mode 100644 examples/illustrations/network_connection/figures/network_connection-relationships.svg create mode 100644 examples/illustrations/raw_data/figures/raw_data-relationships.svg create mode 100644 examples/illustrations/reconstructed_file/figures/reconstructed_file-relationships.svg create mode 100644 examples/illustrations/sms_and_contacts/figures/sms_and_contacts-relationships.svg create mode 100644 examples/illustrations/spear_phishing/figures/spear_phishing-relationships.svg diff --git a/examples/illustrations/Oresteia/figures/Oresteia-relationships.svg b/examples/illustrations/Oresteia/figures/Oresteia-relationships.svg new file mode 100644 index 00000000..3a9d6ff4 --- /dev/null +++ b/examples/illustrations/Oresteia/figures/Oresteia-relationships.svg @@ -0,0 +1,465 @@ + + + + + + +CASE render of directional relationships + + + +_9e4cde24c30ce07bf4b9078546ff9ba2d16afcea1003f475930915476ca37d74 + + +ID - kb:aeschylus-1ab8a80e-39fb-4209-9781-b10bdbc5d0c2 + + + + + +_b90dd04faefadfddef4ef2cbda0e12d87ee59eeb0f6fa741cee8917765793ca1 +Has_Role + + + +_9e4cde24c30ce07bf4b9078546ff9ba2d16afcea1003f475930915476ca37d74->_b90dd04faefadfddef4ef2cbda0e12d87ee59eeb0f6fa741cee8917765793ca1 + + + + + +_c0208b102f427ade898c90309434942d4fef5528bc1affd8343be35da6b29783 + + +ID - kb:argos-palace-d9633e60-a44c-40f5-a0f0-c5225f3ef90e + + + + + +_ef8a81f9a607cbdba82858107d0711b4cdfba47eb35796b743993c33e3bd6ed1 + + +ID - kb:attachment_file-ad07f4fb-ef85-4a74-ad88-68341a1e9606 + + + + + +_45637bcbb853f0203c92731b8a39b72a71721b1b34c873dd98b1a00959d54ac7 +Attachment_Of + + + +_ef8a81f9a607cbdba82858107d0711b4cdfba47eb35796b743993c33e3bd6ed1->_45637bcbb853f0203c92731b8a39b72a71721b1b34c873dd98b1a00959d54ac7 + + + + + +_615b47f56ce2df0f9f8f1660f3458349d6870f49d88531323814f159fbe9b568 + + +ID - kb:cassandra-1b38d28a-f88f-471f-8f83-16877dedacc0 + + + + + +_b72b429aee37083b515cf2763b002db33b90a0ab7cf2c2c75bdfb682659db8f0 +Has_Role + + + +_615b47f56ce2df0f9f8f1660f3458349d6870f49d88531323814f159fbe9b568->_b72b429aee37083b515cf2763b002db33b90a0ab7cf2c2c75bdfb682659db8f0 + + + + + +_68d3376d994fc5710c5e2d65f80584e045aee886122a698a96317b1676fb4133 + + +ID - kb:cassandra-device-d2ac1471-2d0f-4032-8cca-53d317600cba + + + + + +_e8f51c6422e762af5ec372aba2edfa5b17d330bc67991d5ebafb3c6b40164746 +Located_At + + + +_68d3376d994fc5710c5e2d65f80584e045aee886122a698a96317b1676fb4133->_e8f51c6422e762af5ec372aba2edfa5b17d330bc67991d5ebafb3c6b40164746 + + + + + +_effb0da279d756f5e11392dee18c5ab2266928ea70446ec913743bdb6a6ffa69 +Has_Account + + + +_68d3376d994fc5710c5e2d65f80584e045aee886122a698a96317b1676fb4133->_effb0da279d756f5e11392dee18c5ab2266928ea70446ec913743bdb6a6ffa69 + + + + + +_7c066daf439529fc747722aa836cb5e248df6c031a66e8036d5e43642050fa1f + + +ID - kb:cassandra-image-partition-64c9eeab-7e98-4256-a4f2-c3bb92ae0ef1 + + + + + +_08a39a7e9142231beadbf7367b243d11529455b39638d3d3bc35e7a5078fd9ad +Contained_Within + + + +_7c066daf439529fc747722aa836cb5e248df6c031a66e8036d5e43642050fa1f->_08a39a7e9142231beadbf7367b243d11529455b39638d3d3bc35e7a5078fd9ad + + + + + +_fcd62ae023e4f6f176fd22fb70180871b922a7cc6cc8757239698b2993372d3e + + +ID - kb:cassandra-mobileaccount-ddd1303c-a85e-4307-b79e-b800a2420842 + + + + + +_f9d7b1029b1d231369ac701e88d0cbdb6e7a953e1d7a76837c2426317209ef58 + + +ID - kb:cassandra-mobiledevice-forensicduplicate-95d5a618-8265-4cb8-8140-ac8ea281c536 + + + + + +_a885f418a772eeaeaec18751cbaf879740913db395d1586cbcfcbb5a5744e989 + + +ID - kb:cassandra-mobiledevice-mmssms-1ab55cb8-581d-4ebc-99e4-4db8d4261535 + + + + + +_77817a9cd9fc7de81e8fcb3f336ddd4c04a10c727c428334d51d96b203c7ecbd +Contained_Within + + + +_a885f418a772eeaeaec18751cbaf879740913db395d1586cbcfcbb5a5744e989->_77817a9cd9fc7de81e8fcb3f336ddd4c04a10c727c428334d51d96b203c7ecbd + + + + + +_fc6e8bc0fd80eb2d94f8b312afabf61e0429ddbb0206a09363d0d4bd5e092030 + + +ID - kb:clytemnestra-device-3a61cb3a-422d-4953-af70-25a860456e50 + + + + + +_a47882c823ef7d983a6c6aa904a934ad519098079c9ac83564c363254e175e91 +Has_Account + + + +_fc6e8bc0fd80eb2d94f8b312afabf61e0429ddbb0206a09363d0d4bd5e092030->_a47882c823ef7d983a6c6aa904a934ad519098079c9ac83564c363254e175e91 + + + + + +_8c0fc46bcf8294478d6c252feab732f605e8699c2c0730c0397b8b29d29c9537 + + +ID - kb:clytemnestra-mobileaccount-363dd368-94bd-4dbb-af1d-f53d0085791e + + + + + +_1b75697124e69347e0e37861741e3f89c7177b85faa74d99437fb21c757963f6 + + +ID - kb:electra-a960648e-c88e-4728-9853-7b7f06de8caa + + + + + +_eb0dcdbc715f5dfd30a76b666abcf6bbc244ec55962a5c1676db17c2c88c2391 +Has_Account + + + +_1b75697124e69347e0e37861741e3f89c7177b85faa74d99437fb21c757963f6->_eb0dcdbc715f5dfd30a76b666abcf6bbc244ec55962a5c1676db17c2c88c2391 + + + + + +_99f217e251b6e8f0c829cdde2a3f4851e6be7599d57e33a6bd2a6713c494eec8 + + +ID - kb:electra-emailaccount-1a58cfc9-d50a-4861-bd0c-6638250eb0db + + + + + +_6c7a2319969674c8d7a95a587ba3981c2af5c6dde7af5720a93d4869353f43dd + + +ID - kb:euripides-3696c710-161f-47af-9ae8-61b178611773 + + + + + +_266d33e5bec2d876ef4a9d5135c3b2b273daf5bbe95278eec601f48ba75be030 +Has_Role + + + +_6c7a2319969674c8d7a95a587ba3981c2af5c6dde7af5720a93d4869353f43dd->_266d33e5bec2d876ef4a9d5135c3b2b273daf5bbe95278eec601f48ba75be030 + + + + + +_07100fc0a937adfc2edc1067370f367eb155d9bef13801fe0ed9423948113a1e + + +ID - kb:investigative-action-49e0d70c-f1bc-40a4-8866-45ddb8ad4e89 +parsed + + + + + +_bd40f374d8f2e85d5f211f446a5ea1078f32550ed896c666dc8ea9790dc0093b + + +ID - kb:investigative-action-b8fd94b9-ceae-4c2f-aa38-8cfaa98804fe +extracted + + + + + +_3a71d01d822c7504c9197e43dbdc76fafa4a7426b8d844ec73859767642c6c43 +Initiated + + + +_bd40f374d8f2e85d5f211f446a5ea1078f32550ed896c666dc8ea9790dc0093b->_3a71d01d822c7504c9197e43dbdc76fafa4a7426b8d844ec73859767642c6c43 + + + + + +_becc3c40125141cf7a29d5f51b989a313e6be9887b9af5139829b1c44fc36125 + + +ID - kb:investigator-6f465841-07f4-40a6-b9ac-7b069a7cf196 +Investigator + + + + + +_f49372e9cffc6109da5e21920d5959ba21cdd104e44aaa036a58d1b4f54e9ff7 + + +ID - kb:investigator-72986b46-69f5-4767-878c-d4894be9069e +Investigator + + + + + +_c62581d0046ddd7f9286f5690ed5e5da6109510e51d833d04549a92b8f9de7e7 + + +ID - kb:offender-46a9ed63-122d-40bc-a80d-cf7e047821a6 +Offender + + + + + +_b16bb4425c7624055199415466c7ab100c5ba20fb7cac77a2357a87b404039a6 + + +ID - kb:orestes-facebookmsg-f7c67008-efe1-441c-8e52-2ec189dd6e56 + + + + + +_10c65ed8b92b2983766f24d048458224f9001233d2ea8e635f06816e9a83cc7a + + +ID - kb:thyestes-b9111c63-19a8-4bf4-8287-b14485f01b45 + + + + + +_2b7c4405a2fd518dd40adfa80128e4f34a3fc11d1c7755a8addac2077b9e3c56 +Has_Role + + + +_10c65ed8b92b2983766f24d048458224f9001233d2ea8e635f06816e9a83cc7a->_2b7c4405a2fd518dd40adfa80128e4f34a3fc11d1c7755a8addac2077b9e3c56 + + + + + +_b6c83d2e5bcfd567122fc38eaabbb4d22827bf1d1e94c4ac36bc7d90b31825e3 +Has_Role + + + +_10c65ed8b92b2983766f24d048458224f9001233d2ea8e635f06816e9a83cc7a->_b6c83d2e5bcfd567122fc38eaabbb4d22827bf1d1e94c4ac36bc7d90b31825e3 + + + + + +_92c39ed2a3925e1e01a9afb18c80fcf5a26286a89904b627642a8f427618327b + + +ID - kb:victim-a0306ec1-d6ef-4db6-96d2-785304d489f4 +Victim + + + + + +_457579b8377eb59d733f4db121bb03ddbcaf80d935708334381b82dc45158f5b +Has_Device + + + +_92c39ed2a3925e1e01a9afb18c80fcf5a26286a89904b627642a8f427618327b->_457579b8377eb59d733f4db121bb03ddbcaf80d935708334381b82dc45158f5b + + + + + +_2e8fc3ef7ee58ad866ea33d544ee7d3cbbd2ad11c1600a74070262dcc05e20d4 + + +ID - kb:victim-bbb4d46f-099e-4bf8-828e-7befd2a5f535 +Victim + + + + + +_b90dd04faefadfddef4ef2cbda0e12d87ee59eeb0f6fa741cee8917765793ca1->_f49372e9cffc6109da5e21920d5959ba21cdd104e44aaa036a58d1b4f54e9ff7 + + + + + +_45637bcbb853f0203c92731b8a39b72a71721b1b34c873dd98b1a00959d54ac7->_b16bb4425c7624055199415466c7ab100c5ba20fb7cac77a2357a87b404039a6 + + + + + +_b72b429aee37083b515cf2763b002db33b90a0ab7cf2c2c75bdfb682659db8f0->_92c39ed2a3925e1e01a9afb18c80fcf5a26286a89904b627642a8f427618327b + + + + + +_e8f51c6422e762af5ec372aba2edfa5b17d330bc67991d5ebafb3c6b40164746->_c0208b102f427ade898c90309434942d4fef5528bc1affd8343be35da6b29783 + + + + + +_effb0da279d756f5e11392dee18c5ab2266928ea70446ec913743bdb6a6ffa69->_fcd62ae023e4f6f176fd22fb70180871b922a7cc6cc8757239698b2993372d3e + + + + + +_08a39a7e9142231beadbf7367b243d11529455b39638d3d3bc35e7a5078fd9ad->_f9d7b1029b1d231369ac701e88d0cbdb6e7a953e1d7a76837c2426317209ef58 + + + + + +_77817a9cd9fc7de81e8fcb3f336ddd4c04a10c727c428334d51d96b203c7ecbd->_7c066daf439529fc747722aa836cb5e248df6c031a66e8036d5e43642050fa1f + + + + + +_a47882c823ef7d983a6c6aa904a934ad519098079c9ac83564c363254e175e91->_8c0fc46bcf8294478d6c252feab732f605e8699c2c0730c0397b8b29d29c9537 + + + + + +_eb0dcdbc715f5dfd30a76b666abcf6bbc244ec55962a5c1676db17c2c88c2391->_99f217e251b6e8f0c829cdde2a3f4851e6be7599d57e33a6bd2a6713c494eec8 + + + + + +_266d33e5bec2d876ef4a9d5135c3b2b273daf5bbe95278eec601f48ba75be030->_becc3c40125141cf7a29d5f51b989a313e6be9887b9af5139829b1c44fc36125 + + + + + +_3a71d01d822c7504c9197e43dbdc76fafa4a7426b8d844ec73859767642c6c43->_07100fc0a937adfc2edc1067370f367eb155d9bef13801fe0ed9423948113a1e + + + + + +_2b7c4405a2fd518dd40adfa80128e4f34a3fc11d1c7755a8addac2077b9e3c56->_c62581d0046ddd7f9286f5690ed5e5da6109510e51d833d04549a92b8f9de7e7 + + + + + +_b6c83d2e5bcfd567122fc38eaabbb4d22827bf1d1e94c4ac36bc7d90b31825e3->_2e8fc3ef7ee58ad866ea33d544ee7d3cbbd2ad11c1600a74070262dcc05e20d4 + + + + + +_457579b8377eb59d733f4db121bb03ddbcaf80d935708334381b82dc45158f5b->_68d3376d994fc5710c5e2d65f80584e045aee886122a698a96317b1676fb4133 + + + + + diff --git a/examples/illustrations/accounts/figures/accounts-relationships.svg b/examples/illustrations/accounts/figures/accounts-relationships.svg new file mode 100644 index 00000000..a378c9e6 --- /dev/null +++ b/examples/illustrations/accounts/figures/accounts-relationships.svg @@ -0,0 +1,134 @@ + + + + + + +CASE render of directional relationships + + + +_8ec9b5c9d0f1425fd266a1c71562a5337c6e5852b85d6e86b41861236a457e53 + + +ID - kb:actor-0058fc60-4b1b-4ad4-ba7e-231d00d40973 + + + + + +_e7821ee0701abc0f54e31be11f6cd226b72e07ebff8d8034cbb70d4238e02e2c +Has_Account + + + +_8ec9b5c9d0f1425fd266a1c71562a5337c6e5852b85d6e86b41861236a457e53->_e7821ee0701abc0f54e31be11f6cd226b72e07ebff8d8034cbb70d4238e02e2c + + + + + +_4b62a5fababc201f245ed71bda323489142cf0ed36d75706bf189ec97908bdf5 +Has_Account + + + +_8ec9b5c9d0f1425fd266a1c71562a5337c6e5852b85d6e86b41861236a457e53->_4b62a5fababc201f245ed71bda323489142cf0ed36d75706bf189ec97908bdf5 + + + + + +_90515ba1d59b46de7ab30af05987fb9d6a3eb120197397c9aa30947c3fa5d71f +Has_Account + + + +_8ec9b5c9d0f1425fd266a1c71562a5337c6e5852b85d6e86b41861236a457e53->_90515ba1d59b46de7ab30af05987fb9d6a3eb120197397c9aa30947c3fa5d71f + + + + + +_58b83304411284e05979aa9b54b619da927314d8ed9917a6144e66b33b5c7323 + + +ID - kb:email_account-e798e18c-0bef-4883-83df-e2710c4bc7e4 + + + + + +_cdb3833185e043e0692ceb3836e8b7e0c365c9f0ab2e5b306ac6907761e80e61 + + +ID - kb:facebook_account-c188af2d-9651-44a8-8d4c-07a1f5f1aa20 + + + + + +_15dc3b17bda34d6db7901b81e9feffcaa94155f80ff5a0ebd8726c8aac4dd169 +Associated_Account + + + +_cdb3833185e043e0692ceb3836e8b7e0c365c9f0ab2e5b306ac6907761e80e61->_15dc3b17bda34d6db7901b81e9feffcaa94155f80ff5a0ebd8726c8aac4dd169 + + + + + +_b5cb458a7011a311f42c2fe5c56168b89dcf80c7567b3ceeeec64d49d495731f + + +ID - kb:google_account-f514a133-bca6-488c-a0a3-44c40f9ac766 + + + + + +_4e104a9b600f9042aa1df33358e357a8095e7e9cea9d4d31734a8439af04b5b3 +Associated_Account + + + +_b5cb458a7011a311f42c2fe5c56168b89dcf80c7567b3ceeeec64d49d495731f->_4e104a9b600f9042aa1df33358e357a8095e7e9cea9d4d31734a8439af04b5b3 + + + + + +_e7821ee0701abc0f54e31be11f6cd226b72e07ebff8d8034cbb70d4238e02e2c->_58b83304411284e05979aa9b54b619da927314d8ed9917a6144e66b33b5c7323 + + + + + +_4b62a5fababc201f245ed71bda323489142cf0ed36d75706bf189ec97908bdf5->_cdb3833185e043e0692ceb3836e8b7e0c365c9f0ab2e5b306ac6907761e80e61 + + + + + +_90515ba1d59b46de7ab30af05987fb9d6a3eb120197397c9aa30947c3fa5d71f->_b5cb458a7011a311f42c2fe5c56168b89dcf80c7567b3ceeeec64d49d495731f + + + + + +_15dc3b17bda34d6db7901b81e9feffcaa94155f80ff5a0ebd8726c8aac4dd169->_58b83304411284e05979aa9b54b619da927314d8ed9917a6144e66b33b5c7323 + + + + + +_4e104a9b600f9042aa1df33358e357a8095e7e9cea9d4d31734a8439af04b5b3->_58b83304411284e05979aa9b54b619da927314d8ed9917a6144e66b33b5c7323 + + + + + diff --git a/examples/illustrations/bulk_extractor_forensic_path/figures/bulk_extractor_forensic_path-relationships.svg b/examples/illustrations/bulk_extractor_forensic_path/figures/bulk_extractor_forensic_path-relationships.svg new file mode 100644 index 00000000..0734725c --- /dev/null +++ b/examples/illustrations/bulk_extractor_forensic_path/figures/bulk_extractor_forensic_path-relationships.svg @@ -0,0 +1,178 @@ + + + + + + +CASE render of directional relationships + + + +_23cb5140fd9df69b3ffad4dfa729568b084017fcd6c4f2aeb87c1fc1b446503c + + +ID - kb:compressed_gzip-56ce1a82-7965-4a50-8feb-7524e03fba04 + + + + + +_f049aa68136e7c44632c44224f7e73861380896b7c7114cbfe16b111fe69e832 +Contained_Within + + + +_23cb5140fd9df69b3ffad4dfa729568b084017fcd6c4f2aeb87c1fc1b446503c->_f049aa68136e7c44632c44224f7e73861380896b7c7114cbfe16b111fe69e832 + + + + + +_60f6b3c2065606dd5e46b6e26dd94221dd5b25d6d1580124641265356da0045b + + +ID - kb:compressed_gzip-e17babc0-dabb-45d1-8202-0f02518c2a89 + + + + + +_28bb52ddc27e572969550e833b3b2fdbe2b2e6c811d23e1149bbdd02ab03ad7d +Contained_Within + + + +_60f6b3c2065606dd5e46b6e26dd94221dd5b25d6d1580124641265356da0045b->_28bb52ddc27e572969550e833b3b2fdbe2b2e6c811d23e1149bbdd02ab03ad7d + + + + + +_64f0ba75a1f761a6ce06ec0847550eaf15d9f8c1ad96b5719ef9ab57cec4755e + + +ID - kb:decompressed_gzip-93aef5ce-40a5-4bd4-8a4f-56f885d27695 + + + + + +_346254fbb1cc7d2bf307f282d67cd66e4b8469393f7cdf71b064d3b73bcbf7ed +Decompressed_From + + + +_64f0ba75a1f761a6ce06ec0847550eaf15d9f8c1ad96b5719ef9ab57cec4755e->_346254fbb1cc7d2bf307f282d67cd66e4b8469393f7cdf71b064d3b73bcbf7ed + + + + + +_dfe70649fcf990a0b7429038ec9909c4dac4613a4f2f3ab4cecf5a9fdbbdd310 + + +ID - kb:decompressed_gzip-95bfe9c0-1473-41e0-a2b4-22dd2d28bd8b + + + + + +_a9eeff3a3f0d1fe6c5805f7c65166e6e929bb1a90f31abafe9f26fa6355818d0 +Decompressed_From + + + +_dfe70649fcf990a0b7429038ec9909c4dac4613a4f2f3ab4cecf5a9fdbbdd310->_a9eeff3a3f0d1fe6c5805f7c65166e6e929bb1a90f31abafe9f26fa6355818d0 + + + + + +_795d378a3f7ad8df7e746ba68270ee42db45882275433647d3e05e3293aca843 + + +ID - kb:disk_image-f654431a-ee73-4c9f-8ebb-e689df534f6c + + + + + +_4ab977879547b92aac4d6d95c538615419c6842883d0c6b860808acd4a765f7f + + +ID - kb:extracted_email_address-416ecb32-ecb1-4e23-a5b4-836c07a1de4e + + + + + +_68cdcf7113a390e64bc019d3483013273dec92b6f7b7c8dc9642c1c677390786 +Contained_Within + + + +_4ab977879547b92aac4d6d95c538615419c6842883d0c6b860808acd4a765f7f->_68cdcf7113a390e64bc019d3483013273dec92b6f7b7c8dc9642c1c677390786 + + + + + +_627e76fb89ab0349e4a4110617417882e6d5f9dbc4a77bd9af13cca8b7cfe5ca + + +ID - kb:extracted_email_address-8a042a47-e34b-46e3-b5a2-0fac4fd66aa7 + + + + + +_35ce37aac5b4e54e9f4d6803924bc5e99d6100d12ba240c3bbfe049480263c5f +Contained_Within + + + +_627e76fb89ab0349e4a4110617417882e6d5f9dbc4a77bd9af13cca8b7cfe5ca->_35ce37aac5b4e54e9f4d6803924bc5e99d6100d12ba240c3bbfe049480263c5f + + + + + +_f049aa68136e7c44632c44224f7e73861380896b7c7114cbfe16b111fe69e832->_64f0ba75a1f761a6ce06ec0847550eaf15d9f8c1ad96b5719ef9ab57cec4755e + + + + + +_28bb52ddc27e572969550e833b3b2fdbe2b2e6c811d23e1149bbdd02ab03ad7d->_795d378a3f7ad8df7e746ba68270ee42db45882275433647d3e05e3293aca843 + + + + + +_346254fbb1cc7d2bf307f282d67cd66e4b8469393f7cdf71b064d3b73bcbf7ed->_60f6b3c2065606dd5e46b6e26dd94221dd5b25d6d1580124641265356da0045b + + + + + +_a9eeff3a3f0d1fe6c5805f7c65166e6e929bb1a90f31abafe9f26fa6355818d0->_23cb5140fd9df69b3ffad4dfa729568b084017fcd6c4f2aeb87c1fc1b446503c + + + + + +_68cdcf7113a390e64bc019d3483013273dec92b6f7b7c8dc9642c1c677390786->_dfe70649fcf990a0b7429038ec9909c4dac4613a4f2f3ab4cecf5a9fdbbdd310 + + + + + +_35ce37aac5b4e54e9f4d6803924bc5e99d6100d12ba240c3bbfe049480263c5f->_dfe70649fcf990a0b7429038ec9909c4dac4613a4f2f3ab4cecf5a9fdbbdd310 + + + + + diff --git a/examples/illustrations/cell_site/figures/cell_site-relationships.svg b/examples/illustrations/cell_site/figures/cell_site-relationships.svg new file mode 100644 index 00000000..bc95d51b --- /dev/null +++ b/examples/illustrations/cell_site/figures/cell_site-relationships.svg @@ -0,0 +1,136 @@ + + + + + + +CASE render of directional relationships + + + +_a3e52ac9864426a7b675869b9d662696b20d1de9e5f90fef254a846eec03b108 + + +ID - kb:3fef85a7-3fb4-4170-ba4d-fc69e2de4789 + + + + + +_45e16a44aba45f0dca90bcf93d690a75aa5bf531d0bc9c8b387b3b2d69aeb107 +Connected_To + + + +_a3e52ac9864426a7b675869b9d662696b20d1de9e5f90fef254a846eec03b108->_45e16a44aba45f0dca90bcf93d690a75aa5bf531d0bc9c8b387b3b2d69aeb107 + + + + + +_cf5884b6460e5276e058c5b58c79537aeb206331673210438fb3355f5da5be0c + + +ID - kb:6e2c8413-f681-4bc6-a66e-b70a7ecd9d3a + + + + + +_51e60013d2768884bde9b62c547b08fde110a43de1cdcb4601ae43787f89bd73 +Contained_Within + + + +_cf5884b6460e5276e058c5b58c79537aeb206331673210438fb3355f5da5be0c->_51e60013d2768884bde9b62c547b08fde110a43de1cdcb4601ae43787f89bd73 + + + + + +_419c93120fe67a8c1c73be0b79ac39b3251be12e9895554536755e66ce902512 + + +ID - kb:dc9b8413-f681-4bc6-a66e-b70a7ecde4d4 + + + + + +_4f1e8a0cd4fe9b4bdb213ca71502b5596300e9b9d74880e38124e3323e7961c7 +Located_At + + + +_419c93120fe67a8c1c73be0b79ac39b3251be12e9895554536755e66ce902512->_4f1e8a0cd4fe9b4bdb213ca71502b5596300e9b9d74880e38124e3323e7961c7 + + + + + +_c9f86698cdf6534d3c9ecdeea7035d61483db33644ddc61066994ced6fde34dd + + +ID - kb:f2e90997-16c9-4822-be30-fa4f36553768 + + + + + +_1a5e6e99feb963d9b01affbfc0fe4c294aa3ea93a79b6146c31e80eaa6756a3c + + +ID - kb:location-403d0147-f7ff-4f3e-aa43-19a988e8a3ee +Location of cell site, denoted by opencellid.org + + + + + +_74356f2298a366cc671d43a8c926590b61663edd883ac9cd981e16924b476e95 + + +ID - ns1:cell-cite-204-16-1014-13399 + + + + + +_2bcb4c559e04db723d7cfc8027cf90fe76f7e7deea1b15145f0b0145cf52116a +Located_At + + + +_74356f2298a366cc671d43a8c926590b61663edd883ac9cd981e16924b476e95->_2bcb4c559e04db723d7cfc8027cf90fe76f7e7deea1b15145f0b0145cf52116a + + + + + +_45e16a44aba45f0dca90bcf93d690a75aa5bf531d0bc9c8b387b3b2d69aeb107->_419c93120fe67a8c1c73be0b79ac39b3251be12e9895554536755e66ce902512 + + + + + +_51e60013d2768884bde9b62c547b08fde110a43de1cdcb4601ae43787f89bd73->_a3e52ac9864426a7b675869b9d662696b20d1de9e5f90fef254a846eec03b108 + + + + + +_4f1e8a0cd4fe9b4bdb213ca71502b5596300e9b9d74880e38124e3323e7961c7->_c9f86698cdf6534d3c9ecdeea7035d61483db33644ddc61066994ced6fde34dd + + + + + +_2bcb4c559e04db723d7cfc8027cf90fe76f7e7deea1b15145f0b0145cf52116a->_1a5e6e99feb963d9b01affbfc0fe4c294aa3ea93a79b6146c31e80eaa6756a3c + + + + + diff --git a/examples/illustrations/database_records/figures/database_records-relationships.svg b/examples/illustrations/database_records/figures/database_records-relationships.svg new file mode 100644 index 00000000..a2fa39bb --- /dev/null +++ b/examples/illustrations/database_records/figures/database_records-relationships.svg @@ -0,0 +1,122 @@ + + + + + + +CASE render of directional relationships + + + +_ebba2a43e915131860cdcfa0310991c3afb3c1d16d3cac1099c714313962f632 + + +ID - kb:message-1505f33f-9946-4280-89cd-2e72bdff900e + + + + + +_d334a2b191fc2a5c711ac7c9f223b82ceeb01f83cf3550edb49f69a3d25866ad +Derived_From + + + +_ebba2a43e915131860cdcfa0310991c3afb3c1d16d3cac1099c714313962f632->_d334a2b191fc2a5c711ac7c9f223b82ceeb01f83cf3550edb49f69a3d25866ad + + + + + +_21aaf0ae5003618825625c5e8081acf5c6722035796b05859dd3348d8612377b + + +ID - kb:sqlite-file-3237feb2-1be5-465b-8da2-4e6c3fb737bb + + + + + +_a5a325d2f9684d99bd5245ed7377633a7b8b338c5f1b1db8ffd5979bd8359c99 + + +ID - kb:sqlite-journal-file-2d52c6fe-1346-4460-9693-b3ea86e721a5 + + + + + +_a07dce55d20795de9a5ea5270a6d21d31d44e60daf435e63fe2fbe4dfe083bce +Related_To + + + +_a5a325d2f9684d99bd5245ed7377633a7b8b338c5f1b1db8ffd5979bd8359c99->_a07dce55d20795de9a5ea5270a6d21d31d44e60daf435e63fe2fbe4dfe083bce + + + + +_a10957dcde3c62a82ccb4e089aac982caadf3cfa29f279c38ab910f52393459c + + +ID - kb:sqlite-record-fc21b376-98b0-4c07-b802-f855dcdd95b2 + + + + + +_79764ca8ad1ec9a52f3eb945e6b0a4604ca4c6c4bd00eed1589009456d575c46 +Contained_Within + + + +_a10957dcde3c62a82ccb4e089aac982caadf3cfa29f279c38ab910f52393459c->_79764ca8ad1ec9a52f3eb945e6b0a4604ca4c6c4bd00eed1589009456d575c46 + + + + + +_760a6180ff547bb5bcd81e8658d03c43d6d5596ef3ef76129c1c962ac5bd938b + + +ID - kb:sqlite-wal-file-e5598c4e-9d1a-4b14-9142-49900dd6b8e9 + + + + + +_ae5928df952b460652b9b556833ed6d2aca9a5d97f894f74fded44c447069e72 +Related_To + + + +_760a6180ff547bb5bcd81e8658d03c43d6d5596ef3ef76129c1c962ac5bd938b->_ae5928df952b460652b9b556833ed6d2aca9a5d97f894f74fded44c447069e72 + + + + +_d334a2b191fc2a5c711ac7c9f223b82ceeb01f83cf3550edb49f69a3d25866ad->_a10957dcde3c62a82ccb4e089aac982caadf3cfa29f279c38ab910f52393459c + + + + + +_a07dce55d20795de9a5ea5270a6d21d31d44e60daf435e63fe2fbe4dfe083bce->_21aaf0ae5003618825625c5e8081acf5c6722035796b05859dd3348d8612377b + + + + +_79764ca8ad1ec9a52f3eb945e6b0a4604ca4c6c4bd00eed1589009456d575c46->_21aaf0ae5003618825625c5e8081acf5c6722035796b05859dd3348d8612377b + + + + + +_ae5928df952b460652b9b556833ed6d2aca9a5d97f894f74fded44c447069e72->_21aaf0ae5003618825625c5e8081acf5c6722035796b05859dd3348d8612377b + + + + diff --git a/examples/illustrations/file/figures/file-relationships.svg b/examples/illustrations/file/figures/file-relationships.svg new file mode 100644 index 00000000..e3b12b34 --- /dev/null +++ b/examples/illustrations/file/figures/file-relationships.svg @@ -0,0 +1,256 @@ + + + + + + +CASE render of directional relationships + + + +_731e9b52c123809ee3a713aba4b34934fe7f3d8f01b400172f54b698c3524ec7 + + +ID - kb:android_device-814c2229-d163-47af-87be-6437b205dde4 + + + + + +_1d1eb954dee8e388adaf711d50b3d7bf2c8f89891ee861bfe1aa13d17cd743aa + + +ID - kb:android_image-e1837dd8-2275-436e-8694-1bc8124fc4c9 + + + + + +_13b791c5c97222d619965a4065ab3e1defc1d056e2ba80c155333b91a50acf4d +Forensic_Image_Of + + + +_1d1eb954dee8e388adaf711d50b3d7bf2c8f89891ee861bfe1aa13d17cd743aa->_13b791c5c97222d619965a4065ab3e1defc1d056e2ba80c155333b91a50acf4d + + + + + +_23be556c82cfc653336b65a978dfe7d07e0a6e0f919ed1b0854f1090b2d929d5 +Stored_On + + + +_1d1eb954dee8e388adaf711d50b3d7bf2c8f89891ee861bfe1aa13d17cd743aa->_23be556c82cfc653336b65a978dfe7d07e0a6e0f919ed1b0854f1090b2d929d5 + + + + + +_d5b0c1420ac6a8d4799dd9e15039d479d8c63e5fe557c6ed0004c33c8223390f + + +ID - kb:chunk_of_data-4456c025-6e96-43b3-a2d1-e7b3952a1731 + + + + + +_c7e551c3c24d077cd6a87fd67d7ff22b3741624a153be0cf1dce5ccc9186f2c2 +Contained_Within + + + +_d5b0c1420ac6a8d4799dd9e15039d479d8c63e5fe557c6ed0004c33c8223390f->_c7e551c3c24d077cd6a87fd67d7ff22b3741624a153be0cf1dce5ccc9186f2c2 + + + + + +_a706bf780b833d79f80f4086c4d587acb31cbcc08fcfc2e38e4f4eaae01ab2a9 + + +ID - kb:decoded_attachment-b7589f93-79b0-483b-b17d-46f5d9774704 + + + + + +_e45cea7e349979901d800748109fa989cce8f1fd81a3d60500ff5d719ea59470 +Decoded_From + + + +_a706bf780b833d79f80f4086c4d587acb31cbcc08fcfc2e38e4f4eaae01ab2a9->_e45cea7e349979901d800748109fa989cce8f1fd81a3d60500ff5d719ea59470 + + + + + +_c824ec3979b2849b7db53a7731f00a724abb14980b69f04e655d41348941ef68 + + +ID - kb:decrypted_blob-cac885bc-f2f3-405d-907a-8b591aeeaf69 + + + + + +_1e277c6eb6cb69d42fbdae364f7d5b18f5bae93e9d3b8ac43d4cd811c0a393e6 +Decrypted_From + + + +_c824ec3979b2849b7db53a7731f00a724abb14980b69f04e655d41348941ef68->_1e277c6eb6cb69d42fbdae364f7d5b18f5bae93e9d3b8ac43d4cd811c0a393e6 + + + + + +_fb50929ae6b13ea9d39213b87d8a29c181f50a13ebd3bb9ef8b9929affb0850a + + +ID - kb:forensic_lab_computer-89c30df0-5e7f-4076-8f74-3271e730a013 + + + + + +_c9b3f00b997bf483b04e194a5b3abaf0785c8e427f23764a4d2a520955518c61 + + +ID - kb:image_partition-5a804a74-d146-4ab0-87f8-de09fc041a5e + + + + + +_3a8185904f6f61fb444cce4c9a20fc52ff07e604a4a7b995753423321d7d1151 +Contained_Within + + + +_c9b3f00b997bf483b04e194a5b3abaf0785c8e427f23764a4d2a520955518c61->_3a8185904f6f61fb444cce4c9a20fc52ff07e604a4a7b995753423321d7d1151 + + + + + +_3692e07621224964ce63f78ff0bd1b4a45d76a78d3c59b2be2dc646d54fc8b02 + + +ID - kb:sqlite_blob-ef2be7d6-f4d0-48e4-bfc9-2e4432cc08a1 + + + + + +_30ffa5066fc852dc151a972c0542a9600ba27938408256128cbe8cd0d0e9839f +Contained_Within + + + +_3692e07621224964ce63f78ff0bd1b4a45d76a78d3c59b2be2dc646d54fc8b02->_30ffa5066fc852dc151a972c0542a9600ba27938408256128cbe8cd0d0e9839f + + + + + +_3bc719bfb3b8e44f94d0c36e6bfd46d7c47911d9ca45f6537a25ba5688ceb07a + + +ID - kb:sqlite_database-0ec9db0f-7dfc-4531-8def-f71505326884 + + + + + +_04428edf92fc95f1f6b8f7229f4f85f0e75fb8bcaed82105660cfceca6fd03ad +Contained_Within + + + +_3bc719bfb3b8e44f94d0c36e6bfd46d7c47911d9ca45f6537a25ba5688ceb07a->_04428edf92fc95f1f6b8f7229f4f85f0e75fb8bcaed82105660cfceca6fd03ad + + + + + +_3618a8847aaea7959d7539abf30b6fb61155c76912d2b2b8d75f40170f693724 + + +ID - kb:tar_archive_file-2857804a-91d7-4cfb-8929-8448d92bb8de + + + + + +_093ac51c48f9e2d95de1856316a4bb8927676648c5ba61775c9e91772147b392 +Contained_Within + + + +_3618a8847aaea7959d7539abf30b6fb61155c76912d2b2b8d75f40170f693724->_093ac51c48f9e2d95de1856316a4bb8927676648c5ba61775c9e91772147b392 + + + + + +_13b791c5c97222d619965a4065ab3e1defc1d056e2ba80c155333b91a50acf4d->_731e9b52c123809ee3a713aba4b34934fe7f3d8f01b400172f54b698c3524ec7 + + + + + +_23be556c82cfc653336b65a978dfe7d07e0a6e0f919ed1b0854f1090b2d929d5->_fb50929ae6b13ea9d39213b87d8a29c181f50a13ebd3bb9ef8b9929affb0850a + + + + + +_c7e551c3c24d077cd6a87fd67d7ff22b3741624a153be0cf1dce5ccc9186f2c2->_a706bf780b833d79f80f4086c4d587acb31cbcc08fcfc2e38e4f4eaae01ab2a9 + + + + + +_e45cea7e349979901d800748109fa989cce8f1fd81a3d60500ff5d719ea59470->_3618a8847aaea7959d7539abf30b6fb61155c76912d2b2b8d75f40170f693724 + + + + + +_1e277c6eb6cb69d42fbdae364f7d5b18f5bae93e9d3b8ac43d4cd811c0a393e6->_3692e07621224964ce63f78ff0bd1b4a45d76a78d3c59b2be2dc646d54fc8b02 + + + + + +_3a8185904f6f61fb444cce4c9a20fc52ff07e604a4a7b995753423321d7d1151->_1d1eb954dee8e388adaf711d50b3d7bf2c8f89891ee861bfe1aa13d17cd743aa + + + + + +_30ffa5066fc852dc151a972c0542a9600ba27938408256128cbe8cd0d0e9839f->_3bc719bfb3b8e44f94d0c36e6bfd46d7c47911d9ca45f6537a25ba5688ceb07a + + + + + +_04428edf92fc95f1f6b8f7229f4f85f0e75fb8bcaed82105660cfceca6fd03ad->_c9b3f00b997bf483b04e194a5b3abaf0785c8e427f23764a4d2a520955518c61 + + + + + +_093ac51c48f9e2d95de1856316a4bb8927676648c5ba61775c9e91772147b392->_c824ec3979b2849b7db53a7731f00a724abb14980b69f04e655d41348941ef68 + + + + + diff --git a/examples/illustrations/forensic_lifecycle/figures/forensic_lifecycle-relationships.svg b/examples/illustrations/forensic_lifecycle/figures/forensic_lifecycle-relationships.svg new file mode 100644 index 00000000..0cb5ad9a --- /dev/null +++ b/examples/illustrations/forensic_lifecycle/figures/forensic_lifecycle-relationships.svg @@ -0,0 +1,205 @@ + + + + + + +CASE render of directional relationships + + + +_3432b44efc15156975134ad5db3621e90d799ea9dea4f0a026340b14cdd0abb7 + + +ID - kb:forensic_action-1123b9f7-07d3-40e6-836c-87fa6b3a8889 +executed + + + + + +_ed1a7267b3e853ba0885f1c817bc382e76c05c5a20907048e46b039c8125caad + + +ID - kb:forensic_action-636d8a19-6863-4995-a3ce-d5508f90e138 +imaged + + + + + +_d7b592efb7dea6a0025234873f35541083e9feb3beea1ef6a257b7448524b692 +Mapped_Into + + + +_ed1a7267b3e853ba0885f1c817bc382e76c05c5a20907048e46b039c8125caad->_d7b592efb7dea6a0025234873f35541083e9feb3beea1ef6a257b7448524b692 + + + + + +_3e2c2387cd519872f43462b670693cd86d15eb010add6ade86f6a80ed48498e0 + + +ID - kb:forensic_action-7c0cf2d0-f447-4b11-bc77-2e85e2362d44 +parsed + + + + + +_35a129115170810308ffe9c3171eaa08c822aa95b27013feeb57aa5398150db7 +Initiated + + + +_3e2c2387cd519872f43462b670693cd86d15eb010add6ade86f6a80ed48498e0->_35a129115170810308ffe9c3171eaa08c822aa95b27013feeb57aa5398150db7 + + + + + +_81d914f2ea9acd4a42cea6250075ecaeaad4c771ce94ec7ca522515089f322c1 +Mapped_Into + + + +_3e2c2387cd519872f43462b670693cd86d15eb010add6ade86f6a80ed48498e0->_81d914f2ea9acd4a42cea6250075ecaeaad4c771ce94ec7ca522515089f322c1 + + + + + +_ff1b8c5c700fb0d4ee3905fbca7f225843c1d42cae64bedce7ddcce1bd3068ba + + +ID - kb:forensic_action-9c7cbad0-bbb4-4975-b095-96b32c13fe44 +imaged + + + + + +_a039efcfa459b381c7fc34f6a7abc6cc71d35ebd9bf6a140a0e398d9539da68d +Mapped_Into + + + +_ff1b8c5c700fb0d4ee3905fbca7f225843c1d42cae64bedce7ddcce1bd3068ba->_a039efcfa459b381c7fc34f6a7abc6cc71d35ebd9bf6a140a0e398d9539da68d + + + + + +_9899ac416672858baf68793db2046dcad26ee951813511e50515245a79ec2b5a + + +ID - kb:forensic_action-cca47fae-305c-402d-a094-2b7acd61ed40 +custody-receive + + + + + +_2710610423adc47c3a95c9b4e6bbb5f0c1c487e97200bfd3bd4c54646fb1ee65 +Mapped_Into + + + +_9899ac416672858baf68793db2046dcad26ee951813511e50515245a79ec2b5a->_2710610423adc47c3a95c9b4e6bbb5f0c1c487e97200bfd3bd4c54646fb1ee65 + + + + + +_0729463b909eb204a10e386129d7d4d5179a33834a3d37319a677648c541c45a + + +ID - kb:forensic_action-e482197e-50d4-4ce6-8240-9ada303e65c0 +seized + + + + + +_660a307f345b0cfe6c6df0adaf0013412aac52aae6a45969dab0719fa5459120 +Mapped_Into + + + +_0729463b909eb204a10e386129d7d4d5179a33834a3d37319a677648c541c45a->_660a307f345b0cfe6c6df0adaf0013412aac52aae6a45969dab0719fa5459120 + + + + + +_39cc32ee1d377eed19f645d01fbba2aef617286df7e53d563844e93ab5af7f9c + + +ID - kb:phase-23d8e393-b6d4-4446-aee5-3ff3c94cd4ed +Preservation + + + + + +_b511f703306d8ab5b028aeb2a393731128b53c90e0e32ffa55a64641ece0f5de + + +ID - kb:phase-42cf3a99-f609-443a-9ed1-c71a81335f76 +Survey + + + + + +_e137dbce1eca8f68de2391cf181a857d6c4e05604adf94d1609022a424cad6b2 + + +ID - kb:phase-fa076a4f-2fd6-4832-9caa-72d6c3a55333 +Examination + + + + + +_d7b592efb7dea6a0025234873f35541083e9feb3beea1ef6a257b7448524b692->_39cc32ee1d377eed19f645d01fbba2aef617286df7e53d563844e93ab5af7f9c + + + + + +_35a129115170810308ffe9c3171eaa08c822aa95b27013feeb57aa5398150db7->_3432b44efc15156975134ad5db3621e90d799ea9dea4f0a026340b14cdd0abb7 + + + + + +_81d914f2ea9acd4a42cea6250075ecaeaad4c771ce94ec7ca522515089f322c1->_e137dbce1eca8f68de2391cf181a857d6c4e05604adf94d1609022a424cad6b2 + + + + + +_a039efcfa459b381c7fc34f6a7abc6cc71d35ebd9bf6a140a0e398d9539da68d->_39cc32ee1d377eed19f645d01fbba2aef617286df7e53d563844e93ab5af7f9c + + + + + +_2710610423adc47c3a95c9b4e6bbb5f0c1c487e97200bfd3bd4c54646fb1ee65->_39cc32ee1d377eed19f645d01fbba2aef617286df7e53d563844e93ab5af7f9c + + + + + +_660a307f345b0cfe6c6df0adaf0013412aac52aae6a45969dab0719fa5459120->_b511f703306d8ab5b028aeb2a393731128b53c90e0e32ffa55a64641ece0f5de + + + + + diff --git a/examples/illustrations/message/figures/message-relationships.svg b/examples/illustrations/message/figures/message-relationships.svg new file mode 100644 index 00000000..7e53f54c --- /dev/null +++ b/examples/illustrations/message/figures/message-relationships.svg @@ -0,0 +1,100 @@ + + + + + + +CASE render of directional relationships + + + +_f2121646a228cd69c2f45ff0a681256f7dfdceeea0a448cd278d1a1289a37646 + + +ID - kb:attachment_file-95a7973d-403d-4a52-9e79-e68630a79e93 + + + + + +_03cfdf9440c45fcf10a1d27f9d97318fc1dfde46ca26a936ab11df01a3389353 +Attachment_Of + + + +_f2121646a228cd69c2f45ff0a681256f7dfdceeea0a448cd278d1a1289a37646->_03cfdf9440c45fcf10a1d27f9d97318fc1dfde46ca26a936ab11df01a3389353 + + + + + +_5d312251a31e4e79207ad83caac8c36c6a739e65013d78d58821f8716ff28fc6 + + +ID - kb:attachment_file-eff14a6a-40e6-46b7-9958-4cbb72f3873c + + + + + +_93ea7bb7d21a85c6d47e451d9526487cafe5e76d5b46b566a87e1d6a07326656 +Attachment_Of + + + +_5d312251a31e4e79207ad83caac8c36c6a739e65013d78d58821f8716ff28fc6->_93ea7bb7d21a85c6d47e451d9526487cafe5e76d5b46b566a87e1d6a07326656 + + + + + +_53cc61c0b310c7d15179906a001fd04b9ac0b53ac7f4a900f45ce5032d5091f3 + + +ID - kb:attachment_file-f822bc08-7bf5-4a5d-9e20-02572db4b40b + + + + + +_625a96e536bf899ccebdf732685b4f7d2c6722a556bbad04af3bf37783ca4472 +Attachment_Of + + + +_53cc61c0b310c7d15179906a001fd04b9ac0b53ac7f4a900f45ce5032d5091f3->_625a96e536bf899ccebdf732685b4f7d2c6722a556bbad04af3bf37783ca4472 + + + + + +_0a983b7f28a57328dc0b44b951694b4372aba59743d043df03b4545f596ff22c + + +ID - kb:message-d8330d5a-b8de-4425-9cd8-a37b038afe81 + + + + + +_03cfdf9440c45fcf10a1d27f9d97318fc1dfde46ca26a936ab11df01a3389353->_0a983b7f28a57328dc0b44b951694b4372aba59743d043df03b4545f596ff22c + + + + + +_93ea7bb7d21a85c6d47e451d9526487cafe5e76d5b46b566a87e1d6a07326656->_0a983b7f28a57328dc0b44b951694b4372aba59743d043df03b4545f596ff22c + + + + + +_625a96e536bf899ccebdf732685b4f7d2c6722a556bbad04af3bf37783ca4472->_0a983b7f28a57328dc0b44b951694b4372aba59743d043df03b4545f596ff22c + + + + + diff --git a/examples/illustrations/mobile_device_and_sim_card/figures/mobile_device_and_sim_card-relationships.svg b/examples/illustrations/mobile_device_and_sim_card/figures/mobile_device_and_sim_card-relationships.svg new file mode 100644 index 00000000..7340579f --- /dev/null +++ b/examples/illustrations/mobile_device_and_sim_card/figures/mobile_device_and_sim_card-relationships.svg @@ -0,0 +1,74 @@ + + + + + + +CASE render of directional relationships + + + +_030b2b3d292a0e96e5d9b266598b846b68003ce02e335bb9640c20f30046f16c + + +ID - kb:mobile-account-09da8ec2-8d6c-41e3-8bd9-bfd06a550141 + + + + + +_24a9a37485728687fca54e74d00ad17835c29b778f6dfdb7b6a4f0951486d4e8 + + +ID - kb:mobile-device-d5143a67-8b61-491b-a5e9-863b606e296a + + + + + +_b0bb7a1295b5f952386de6fae9cd972d2f64a81cdcc9738e08495ea02d8ecc61 +Has_Account + + + +_24a9a37485728687fca54e74d00ad17835c29b778f6dfdb7b6a4f0951486d4e8->_b0bb7a1295b5f952386de6fae9cd972d2f64a81cdcc9738e08495ea02d8ecc61 + + + + + +_5a7f6e874d92a227db7468aa56df2d7d1dcdde8950dbe12f95afb6ab1527c540 + + +ID - kb:sim-card-8b2024b5-1e73-405c-b89f-6e4be86692ef + + + + + +_cfc073381201585455119f64da5c6a84f7513fffa7e5fe64468812f2ae9c1215 +Contained_Within + + + +_5a7f6e874d92a227db7468aa56df2d7d1dcdde8950dbe12f95afb6ab1527c540->_cfc073381201585455119f64da5c6a84f7513fffa7e5fe64468812f2ae9c1215 + + + + + +_b0bb7a1295b5f952386de6fae9cd972d2f64a81cdcc9738e08495ea02d8ecc61->_030b2b3d292a0e96e5d9b266598b846b68003ce02e335bb9640c20f30046f16c + + + + + +_cfc073381201585455119f64da5c6a84f7513fffa7e5fe64468812f2ae9c1215->_24a9a37485728687fca54e74d00ad17835c29b778f6dfdb7b6a4f0951486d4e8 + + + + + diff --git a/examples/illustrations/multipart_file/figures/multipart_file-relationships.svg b/examples/illustrations/multipart_file/figures/multipart_file-relationships.svg new file mode 100644 index 00000000..14211cac --- /dev/null +++ b/examples/illustrations/multipart_file/figures/multipart_file-relationships.svg @@ -0,0 +1,160 @@ + + + + + + +CASE render of directional relationships + + + +_750813d4ec92875a921aebfe3d46041794ed5d9fc1c13b50d0e467463e20b6c8 + + +ID - kb:android_image-f4bc6a0e-c782-4a7e-b6cd-a6aa67a7cff7 + + + + + +_fd50dea238345c70782ddf9fe77d3eccae14485fdef11a27e1c47e15f0c7ee48 + + +ID - kb:data_piece-b236d1f7-b9c6-4bbe-a7bc-38c9fb2e5a6d + + + + + +_f5d2fc296ab04ef0bb894b0e2d91182d7cdae4535f90fb67543fb0bed1c8105f +Contained_Within + + + +_fd50dea238345c70782ddf9fe77d3eccae14485fdef11a27e1c47e15f0c7ee48->_f5d2fc296ab04ef0bb894b0e2d91182d7cdae4535f90fb67543fb0bed1c8105f + + + + + +_032f42cb01b6b03ffb9236a664201e5678a752f3bca48c0727925229c6a1ba7a + + +ID - kb:data_piece-dc4a6e16-10cc-4bc6-b04d-798a49a06f47 + + + + + +_0a57a02ab510298bb5e411671667ff0db64b2042eb19532cf4b266627db8fac5 +Contained_Within + + + +_032f42cb01b6b03ffb9236a664201e5678a752f3bca48c0727925229c6a1ba7a->_0a57a02ab510298bb5e411671667ff0db64b2042eb19532cf4b266627db8fac5 + + + + + +_49a6011e0a36863f73482a173a6b280961df8528eec08df2b01073b333cf336c + + +ID - kb:data_piece-e43f5b78-99ab-4130-8fec-7510a01ffd14 + + + + + +_6b5ab5e19fe1aeeebf714213d6d6b7c0850b9caafe6731d9095d21882803d0e5 +Contained_Within + + + +_49a6011e0a36863f73482a173a6b280961df8528eec08df2b01073b333cf336c->_6b5ab5e19fe1aeeebf714213d6d6b7c0850b9caafe6731d9095d21882803d0e5 + + + + + +_d8809095351cee4b4bcbd471f7ebc890d5ef52e323da49b59e3a0faedcf17357 + + +ID - kb:multipart_file-60dd6b9e-bb3b-4b37-8a2a-6256f86c8bfb + + + + + +_45a6220fe2ca427081fddcaf111f2658a7f17cfce7aa26dab0e501da0e9f7d9e +Has_Fragment + + + +_d8809095351cee4b4bcbd471f7ebc890d5ef52e323da49b59e3a0faedcf17357->_45a6220fe2ca427081fddcaf111f2658a7f17cfce7aa26dab0e501da0e9f7d9e + + + + + +_ef0879d4cfc9800edc1f513b19b81fbadf3d4f12f84f52133992ede37d0f307d +Has_Fragment + + + +_d8809095351cee4b4bcbd471f7ebc890d5ef52e323da49b59e3a0faedcf17357->_ef0879d4cfc9800edc1f513b19b81fbadf3d4f12f84f52133992ede37d0f307d + + + + + +_0864995819632c6a286dc7066776ae5c98404408f57e3b191a67ecb76437b8ae +Has_Fragment + + + +_d8809095351cee4b4bcbd471f7ebc890d5ef52e323da49b59e3a0faedcf17357->_0864995819632c6a286dc7066776ae5c98404408f57e3b191a67ecb76437b8ae + + + + + +_f5d2fc296ab04ef0bb894b0e2d91182d7cdae4535f90fb67543fb0bed1c8105f->_750813d4ec92875a921aebfe3d46041794ed5d9fc1c13b50d0e467463e20b6c8 + + + + + +_0a57a02ab510298bb5e411671667ff0db64b2042eb19532cf4b266627db8fac5->_750813d4ec92875a921aebfe3d46041794ed5d9fc1c13b50d0e467463e20b6c8 + + + + + +_6b5ab5e19fe1aeeebf714213d6d6b7c0850b9caafe6731d9095d21882803d0e5->_750813d4ec92875a921aebfe3d46041794ed5d9fc1c13b50d0e467463e20b6c8 + + + + + +_45a6220fe2ca427081fddcaf111f2658a7f17cfce7aa26dab0e501da0e9f7d9e->_fd50dea238345c70782ddf9fe77d3eccae14485fdef11a27e1c47e15f0c7ee48 + + + + + +_ef0879d4cfc9800edc1f513b19b81fbadf3d4f12f84f52133992ede37d0f307d->_032f42cb01b6b03ffb9236a664201e5678a752f3bca48c0727925229c6a1ba7a + + + + + +_0864995819632c6a286dc7066776ae5c98404408f57e3b191a67ecb76437b8ae->_49a6011e0a36863f73482a173a6b280961df8528eec08df2b01073b333cf336c + + + + + diff --git a/examples/illustrations/network_connection/figures/network_connection-relationships.svg b/examples/illustrations/network_connection/figures/network_connection-relationships.svg new file mode 100644 index 00000000..12f52f5e --- /dev/null +++ b/examples/illustrations/network_connection/figures/network_connection-relationships.svg @@ -0,0 +1,74 @@ + + + + + + +CASE render of directional relationships + + + +_b5fce4ae7eb25f9ead8e8e1cc912a753e4a71938122a1f922a3fbbb8063d6dee + + +ID - kb:network-connection-676b4464-05d2-4cc5-bdd9-13bb8c79ff18 + + + + + +_1cb2dd4304d5a1897a31d2501d051e06bb50051a123d9f89d733ec766e12552f +Contained_Within + + + +_b5fce4ae7eb25f9ead8e8e1cc912a753e4a71938122a1f922a3fbbb8063d6dee->_1cb2dd4304d5a1897a31d2501d051e06bb50051a123d9f89d733ec766e12552f + + + + + +_44e0332016b4ffabe313861a67b1457a780bfc04f5210bb664db60ddaa1404a0 + + +ID - kb:network-connection-6e4d3336-ce04-4c29-bf52-8afd00051e60 + + + + + +_bbfe5f7feef179a264bbdcf60115d852220ffefc89b38c5e5fcd72c7574dddc3 +Contained_Within + + + +_44e0332016b4ffabe313861a67b1457a780bfc04f5210bb664db60ddaa1404a0->_bbfe5f7feef179a264bbdcf60115d852220ffefc89b38c5e5fcd72c7574dddc3 + + + + + +_3bb95154301def961cea8d469abaeee9fc2cae945fbe848a4c367f81c3edbe71 + + +ID - kb:pcap-file-2200b4e1-3974-4e37-961b-d817079bc9e1 + + + + + +_1cb2dd4304d5a1897a31d2501d051e06bb50051a123d9f89d733ec766e12552f->_3bb95154301def961cea8d469abaeee9fc2cae945fbe848a4c367f81c3edbe71 + + + + + +_bbfe5f7feef179a264bbdcf60115d852220ffefc89b38c5e5fcd72c7574dddc3->_3bb95154301def961cea8d469abaeee9fc2cae945fbe848a4c367f81c3edbe71 + + + + + diff --git a/examples/illustrations/raw_data/figures/raw_data-relationships.svg b/examples/illustrations/raw_data/figures/raw_data-relationships.svg new file mode 100644 index 00000000..4fa4ac84 --- /dev/null +++ b/examples/illustrations/raw_data/figures/raw_data-relationships.svg @@ -0,0 +1,48 @@ + + + + + + +CASE render of directional relationships + + + +_3ea19c768cf36e3b04916334c16b252aed8d6cb40a8e615d10c71117a6d5c04c + + +ID - kb:digital_photograph-fb36765f-2bd6-4763-9a3a-be32731162ce + + + + + +_6522cfba7efc1e49186d82ca9af5ed53d1244f815aa8918fdcde0d0f5e8091d0 + + +ID - kb:digital_photograph_thumbnail-a4e05bbf-f533-43a5-abaf-e8907afdc7a0 + + + + + +_d560a2472a69e46cadbd9422ff6bddb7e22b68f5b86aad38c8e5cbf13b8ca5f4 +Contained_Within + + + +_6522cfba7efc1e49186d82ca9af5ed53d1244f815aa8918fdcde0d0f5e8091d0->_d560a2472a69e46cadbd9422ff6bddb7e22b68f5b86aad38c8e5cbf13b8ca5f4 + + + + + +_d560a2472a69e46cadbd9422ff6bddb7e22b68f5b86aad38c8e5cbf13b8ca5f4->_3ea19c768cf36e3b04916334c16b252aed8d6cb40a8e615d10c71117a6d5c04c + + + + + diff --git a/examples/illustrations/reconstructed_file/figures/reconstructed_file-relationships.svg b/examples/illustrations/reconstructed_file/figures/reconstructed_file-relationships.svg new file mode 100644 index 00000000..23453b43 --- /dev/null +++ b/examples/illustrations/reconstructed_file/figures/reconstructed_file-relationships.svg @@ -0,0 +1,160 @@ + + + + + + +CASE render of directional relationships + + + +_8e5901b9cb88a4313ee845f4ee4214163a3d25a639577b4f55a4a434dd98be5c + + +ID - kb:file-5c53068f-0843-4f51-8a2c-0a81a8ff86f8 + + + + + +_7ed8811ad11c42d58fb60d5d84a6247004625b4380e944d1145e9902aa21bca9 +Has_Fragment + + + +_8e5901b9cb88a4313ee845f4ee4214163a3d25a639577b4f55a4a434dd98be5c->_7ed8811ad11c42d58fb60d5d84a6247004625b4380e944d1145e9902aa21bca9 + + + + + +_411134d07b450f56acd842e1b11955093a6c7f1d54b447310140368627152955 +Has_Fragment + + + +_8e5901b9cb88a4313ee845f4ee4214163a3d25a639577b4f55a4a434dd98be5c->_411134d07b450f56acd842e1b11955093a6c7f1d54b447310140368627152955 + + + + + +_cd7e9cb4c1617dc40d473c85806882fd6e4f650c4a517bf7b579ef48979a9684 +Has_Fragment + + + +_8e5901b9cb88a4313ee845f4ee4214163a3d25a639577b4f55a4a434dd98be5c->_cd7e9cb4c1617dc40d473c85806882fd6e4f650c4a517bf7b579ef48979a9684 + + + + + +_6ee7ec2a90dafcb5b833da697176fb2673e6a26244b134572076d66a60a91852 + + +ID - kb:fragment0-b0606dc6-b89b-440e-8344-41cf6bc54f15 + + + + + +_7fbe8cdbd09ccd05aebee2032d1a6cb276730fc703f642b7c5f269913b0ba77b +Contained_Within + + + +_6ee7ec2a90dafcb5b833da697176fb2673e6a26244b134572076d66a60a91852->_7fbe8cdbd09ccd05aebee2032d1a6cb276730fc703f642b7c5f269913b0ba77b + + + + + +_9ced2ee91f69740484ae2fb055a9f4dd888eaa55078268a14ce8537ca68516fa + + +ID - kb:fragment1-8428b15f-f61f-47f8-9659-98b37f3507ad + + + + + +_c95a438b0fe22493875ecde036daf97468fb8067ff006e714c5b63e054edcf6d +Contained_Within + + + +_9ced2ee91f69740484ae2fb055a9f4dd888eaa55078268a14ce8537ca68516fa->_c95a438b0fe22493875ecde036daf97468fb8067ff006e714c5b63e054edcf6d + + + + + +_bb5378c22ba609397cb7867076059a5b9cce84655e14ca52dceae4feb1c36298 + + +ID - kb:fragment2-08eee8f2-5ee8-4140-8ebd-1a7638adb9f8 + + + + + +_633ce2b9f4d50f8692b448b4aa4729f4f5e98382ece14bea9b84641874e45253 +Contained_Within + + + +_bb5378c22ba609397cb7867076059a5b9cce84655e14ca52dceae4feb1c36298->_633ce2b9f4d50f8692b448b4aa4729f4f5e98382ece14bea9b84641874e45253 + + + + + +_f55bd01d78656daa8444e5a192fbb82fdb1a1d568647434d7d77b43130c46fdc + + +ID - kb:nistimage-05a9a342-6748-4e8b-97e2-6f4ec97e1eac + + + + + +_7ed8811ad11c42d58fb60d5d84a6247004625b4380e944d1145e9902aa21bca9->_6ee7ec2a90dafcb5b833da697176fb2673e6a26244b134572076d66a60a91852 + + + + + +_411134d07b450f56acd842e1b11955093a6c7f1d54b447310140368627152955->_9ced2ee91f69740484ae2fb055a9f4dd888eaa55078268a14ce8537ca68516fa + + + + + +_cd7e9cb4c1617dc40d473c85806882fd6e4f650c4a517bf7b579ef48979a9684->_bb5378c22ba609397cb7867076059a5b9cce84655e14ca52dceae4feb1c36298 + + + + + +_7fbe8cdbd09ccd05aebee2032d1a6cb276730fc703f642b7c5f269913b0ba77b->_f55bd01d78656daa8444e5a192fbb82fdb1a1d568647434d7d77b43130c46fdc + + + + + +_c95a438b0fe22493875ecde036daf97468fb8067ff006e714c5b63e054edcf6d->_f55bd01d78656daa8444e5a192fbb82fdb1a1d568647434d7d77b43130c46fdc + + + + + +_633ce2b9f4d50f8692b448b4aa4729f4f5e98382ece14bea9b84641874e45253->_f55bd01d78656daa8444e5a192fbb82fdb1a1d568647434d7d77b43130c46fdc + + + + + diff --git a/examples/illustrations/sms_and_contacts/figures/sms_and_contacts-relationships.svg b/examples/illustrations/sms_and_contacts/figures/sms_and_contacts-relationships.svg new file mode 100644 index 00000000..ddb096de --- /dev/null +++ b/examples/illustrations/sms_and_contacts/figures/sms_and_contacts-relationships.svg @@ -0,0 +1,100 @@ + + + + + + +CASE render of directional relationships + + + +_d184c75911dd62a3ed7b7cb732de1f11765e82d9f5774f3b3bffeb05c43a751f + + +ID - kb:contact-5d61dcc2-fb19-4e49-92a6-d6815bcfe436 + + + + + +_f4f8a2f794408b6e23c4c7390adec0f9752928106b208bb08c9b2271f553b68c +Has_Account + + + +_d184c75911dd62a3ed7b7cb732de1f11765e82d9f5774f3b3bffeb05c43a751f->_f4f8a2f794408b6e23c4c7390adec0f9752928106b208bb08c9b2271f553b68c + + + + + +_12eec1a60e781cbbfc0d4a827df7cfa4734dbe7d34641e809a840b3c3f42e50b +Has_Account + + + +_d184c75911dd62a3ed7b7cb732de1f11765e82d9f5774f3b3bffeb05c43a751f->_12eec1a60e781cbbfc0d4a827df7cfa4734dbe7d34641e809a840b3c3f42e50b + + + + + +_91349ed49b3cfa3f516b7e1333494829ce39f873064eda45be4eded64d8b1d75 +Has_Account + + + +_d184c75911dd62a3ed7b7cb732de1f11765e82d9f5774f3b3bffeb05c43a751f->_91349ed49b3cfa3f516b7e1333494829ce39f873064eda45be4eded64d8b1d75 + + + + + +_d0875ade2b2a1629e981be48c3890517e4a513acaf13ef4476d3a0fbec6e3a2b + + +ID - kb:email_account-4ddeff5a-dde2-4979-bacc-012e8a33a07c + + + + + +_2d75dd1531aea72ca112df1dfe5715507e2aa5ec13a9d54c07158ab61d1d66f4 + + +ID - kb:phone_account-78aa6c61-0264-4223-9139-a354d0141341 + + + + + +_c4c3c0969bbeca74c6c114f028030d798d174895f9f395fccfb58bb1b23884a8 + + +ID - kb:phone_account-d0cbccc8-7b89-4a63-95ff-22a3df977b8b + + + + + +_f4f8a2f794408b6e23c4c7390adec0f9752928106b208bb08c9b2271f553b68c->_d0875ade2b2a1629e981be48c3890517e4a513acaf13ef4476d3a0fbec6e3a2b + + + + + +_12eec1a60e781cbbfc0d4a827df7cfa4734dbe7d34641e809a840b3c3f42e50b->_2d75dd1531aea72ca112df1dfe5715507e2aa5ec13a9d54c07158ab61d1d66f4 + + + + + +_91349ed49b3cfa3f516b7e1333494829ce39f873064eda45be4eded64d8b1d75->_c4c3c0969bbeca74c6c114f028030d798d174895f9f395fccfb58bb1b23884a8 + + + + + diff --git a/examples/illustrations/spear_phishing/figures/spear_phishing-relationships.svg b/examples/illustrations/spear_phishing/figures/spear_phishing-relationships.svg new file mode 100644 index 00000000..57718ac1 --- /dev/null +++ b/examples/illustrations/spear_phishing/figures/spear_phishing-relationships.svg @@ -0,0 +1,209 @@ + + + + + + +CASE render of directional relationships + + + +_e2eb6e5b472788f8a9e02add2b093edd26a294a1f61d76d9393e232f9cc98ca5 + + +ID - kb:Agent01 + + + + + +_4239dae2f86543c454b0eb8660918e800951aae272870413bed773caa508ced4 +Has_Role + + + +_e2eb6e5b472788f8a9e02add2b093edd26a294a1f61d76d9393e232f9cc98ca5->_4239dae2f86543c454b0eb8660918e800951aae272870413bed773caa508ced4 + + + + + +_ca78d43bbc4ac63d25a3216bc3130b1d5ec98c65328db7a64101494613d97739 +Employee_Of + + + +_e2eb6e5b472788f8a9e02add2b093edd26a294a1f61d76d9393e232f9cc98ca5->_ca78d43bbc4ac63d25a3216bc3130b1d5ec98c65328db7a64101494613d97739 + + + + + +_db15b703c070543593e03e5129c22ea5dd457367417cc6bc9f7182cf7e80422e +Member_Of + + + +_e2eb6e5b472788f8a9e02add2b093edd26a294a1f61d76d9393e232f9cc98ca5->_db15b703c070543593e03e5129c22ea5dd457367417cc6bc9f7182cf7e80422e + + + + + +_75cd59089e94560bb56aa79734eab4272de8ef6149ccf4f1bc1f0104de3d72a4 + + +ID - kb:ComputingDevice01 + + + + + +_27568d116893c10b96405e647b471bf99d5321efdc044c2adfc96fe5264af5fb +Used + + + +_75cd59089e94560bb56aa79734eab4272de8ef6149ccf4f1bc1f0104de3d72a4->_27568d116893c10b96405e647b471bf99d5321efdc044c2adfc96fe5264af5fb + + + + + +_f77d4f145e77d33427b170783c9ca19604ef64d4dee346ca0a17b57c9b552b6d + + +ID - kb:EmailMessage01 + + + + + +_897d178f174df282783bb2b2a738b4202190ce263ae64410fffb2024ed25c26d + + +ID - kb:ManagerRole01 + + + + + +_5078ca12d2f9d0c37c0c14df8c42d736e0d4e40b69a6380a785458bf5c9831b7 + + +ID - kb:URL01 + + + + + +_0be20049a257b9acc030cf62271aacfc66ebbb2c9687dc828f86df13b939b4f9 +Contained_Within + + + +_5078ca12d2f9d0c37c0c14df8c42d736e0d4e40b69a6380a785458bf5c9831b7->_0be20049a257b9acc030cf62271aacfc66ebbb2c9687dc828f86df13b939b4f9 + + + + + +_3d103e56d5889c50da00f51778521e23a9bb2ff02619f497fcd47951c86d6448 + + +ID - kb:company-73fe8030-289b-45d3-8637-6078773f914e +Initech + + + + + +_70298a388309594c2cb271f99aaa13965864667e0217de6d20a87a57d948a771 + + +ID - kb:department-2827b0f3-46db-48c2-ae84-01f28225b0d3 +Software Engineering Department + + + + + +_95e4f2abe6189caa4039ea9dcf12a84baa3ab3bf405402bd14f457d1fc055189 + + +ID - kb:event-log-68df51be-89d1-443c-bfc7-428bdf89db12 +Network traffic audit log file + + + + + +_e90d7cfe0428866891281dcc01d241c7cab4e170f620d626b57497b192df5538 + + +ID - kb:operating-system-900c35f2-f000-4bc5-92ae-16b96152b0d6 +Windows 10 Enterprise Evaluation + + + + + +_1d036342a651124491d383983a706388137e4bb80b57b2771ed03dbf05402cce + + +ID - kb:url-a9b1bdec-8228-4356-a18c-a5357eee613d + + + + + +_bf018418b02c62498aa978d6635344ec403b34044e415200e2fee96163882c07 +Contained_Within + + + +_1d036342a651124491d383983a706388137e4bb80b57b2771ed03dbf05402cce->_bf018418b02c62498aa978d6635344ec403b34044e415200e2fee96163882c07 + + + + + +_4239dae2f86543c454b0eb8660918e800951aae272870413bed773caa508ced4->_897d178f174df282783bb2b2a738b4202190ce263ae64410fffb2024ed25c26d + + + + + +_ca78d43bbc4ac63d25a3216bc3130b1d5ec98c65328db7a64101494613d97739->_3d103e56d5889c50da00f51778521e23a9bb2ff02619f497fcd47951c86d6448 + + + + + +_db15b703c070543593e03e5129c22ea5dd457367417cc6bc9f7182cf7e80422e->_70298a388309594c2cb271f99aaa13965864667e0217de6d20a87a57d948a771 + + + + + +_27568d116893c10b96405e647b471bf99d5321efdc044c2adfc96fe5264af5fb->_e90d7cfe0428866891281dcc01d241c7cab4e170f620d626b57497b192df5538 + + + + + +_0be20049a257b9acc030cf62271aacfc66ebbb2c9687dc828f86df13b939b4f9->_f77d4f145e77d33427b170783c9ca19604ef64d4dee346ca0a17b57c9b552b6d + + + + + +_bf018418b02c62498aa978d6635344ec403b34044e415200e2fee96163882c07->_95e4f2abe6189caa4039ea9dcf12a84baa3ab3bf405402bd14f457d1fc055189 + + + + + From 9f212758a502a0029a5baa2e9591f429c3bb6a1e Mon Sep 17 00:00:00 2001 From: Alex Nelson Date: Mon, 25 Sep 2023 22:34:45 -0400 Subject: [PATCH 4/4] Add example missing from front index Signed-off-by: Alex Nelson --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 3b7995c1..ea5ae18c 100644 --- a/README.md +++ b/README.md @@ -15,6 +15,7 @@ Mapping notes & respective JSON-LD output: - [Call Log](examples/illustrations/call_log/call_log.json) - [Cell Site](examples/illustrations/cell_site/cell_site.json) ([*info*](examples/illustrations/cell_site/)) - [Configured Tool](examples/illustrations/configured_tool/configured_tool.json) +- [Database records](examples/illustrations/database_records/database_records.json) ([*info*](examples/illustrations/database_records/)) - [Device](examples/illustrations/device/device.json) - [EXIF Data](examples/illustrations/exif_data/exif_data.json) - [Event](examples/illustrations/event/event.json)