-
Notifications
You must be signed in to change notification settings - Fork 16
/
recoverability.json
228 lines (228 loc) · 10.1 KB
/
recoverability.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
{
"@context": {
"kb": "http://example.org/kb/",
"uco-core": "https://ontology.unifiedcyberontology.org/uco/core/",
"uco-observable": "https://ontology.unifiedcyberontology.org/uco/observable/",
"uco-vocabulary": "https://ontology.unifiedcyberontology.org/uco/vocabulary/",
"xsd": "http://www.w3.org/2001/XMLSchema#"
},
"@graph": [
{
"@id": "kb:4026fabd-924d-4138-a6ba-73df2eb37bcb",
"@type": [
"uco-observable:RecoveredObject",
"uco-observable:File"
],
"uco-core:hasFacet": [
{
"@id": "kb:file-facet-8ce65705-90ab-4934-abb3-67d9c84d81a0",
"@type": "uco-observable:FileFacet",
"uco-observable:extension": "jpg",
"uco-observable:fileName": "IMG-20181120-WA0000",
"uco-observable:filePath": "/storage/emulated/0/WhatsApp/Media/WhatsApp Images/Sent/IMG-20181120-WA0000.jpg",
"uco-observable:isDirectory": false,
"uco-observable:observableCreatedTime": {
"@type": "xsd:dateTime",
"@value": "2018-11-19T00:29:15Z"
},
"uco-observable:sizeInBytes": 1389601
},
{
"@id": "kb:recovered-object-facet-95c7b098-ab46-4867-b050-6b095a7bd1b8",
"@type": "uco-observable:RecoveredObjectFacet",
"uco-observable:contentRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "unknown"
},
"uco-observable:metadataRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
},
"uco-observable:nameRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
}
}
]
},
{
"@id": "kb:665d63be-93e6-4d3e-8e75-3112be091e93",
"@type": [
"uco-observable:RecoveredObject",
"uco-observable:File"
],
"uco-core:hasFacet": [
{
"@id": "kb:file-facet-4783de40-fcad-4e9b-9090-5c5cb4871a93",
"@type": "uco-observable:FileFacet",
"uco-observable:accessedTime": {
"@type": "xsd:dateTime",
"@value": "2018-11-18T22:53:09.595Z"
},
"uco-observable:extension": "",
"uco-observable:fileName": "Thebatplan",
"uco-observable:filePath": "D:\\Thebatplan",
"uco-observable:isDirectory": false,
"uco-observable:modifiedTime": {
"@type": "xsd:dateTime",
"@value": "2018-11-18T20:10:48.00Z"
},
"uco-observable:observableCreatedTime": {
"@type": "xsd:dateTime",
"@value": "2018-11-19T00:29:15Z"
},
"uco-observable:sizeInBytes": 1389601
},
{
"@id": "kb:recovered-object-facet-65fd4337-734a-4350-ab0c-18d8098b8b0e",
"@type": "uco-observable:RecoveredObjectFacet",
"uco-observable:contentRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "unknown"
},
"uco-observable:metadataRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
},
"uco-observable:nameRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
}
}
]
},
{
"@id": "kb:bd64bdd9-3dcd-4828-a25b-a72c06e472cd",
"@type": [
"uco-observable:RecoveredObject",
"uco-observable:File"
],
"uco-core:hasFacet": [
{
"@id": "kb:file-facet-ebb15653-ea33-43f4-995e-b8ab9a1e6378",
"@type": "uco-observable:FileFacet",
"uco-observable:accessedTime": null,
"uco-observable:extension": "tmp",
"uco-observable:fileName": "[email protected]",
"uco-observable:filePath": "/Users/Harley Quinn/AppData/Local/Microsoft/Outlook/[email protected]",
"uco-observable:isDirectory": false,
"uco-observable:modifiedTime": null,
"uco-observable:observableCreatedTime": null,
"uco-observable:sizeInBytes": null
},
{
"@id": "kb:recovered-object-facet-b95a915a-d4f4-4dd7-8367-b11dce27c9cc",
"@type": "uco-observable:RecoveredObjectFacet",
"uco-observable:contentRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "unknown"
},
"uco-observable:metadataRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "unknown"
},
"uco-observable:nameRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
}
}
]
},
{
"@id": "kb:c01e67f9-adb5-48bd-b09d-e7326fa8d592",
"@type": [
"uco-observable:RecoveredObject",
"uco-observable:Message"
],
"uco-core:hasFacet": [
{
"@id": "kb:message-facet-1cd126fc-e556-4460-9c1e-37c2ed553367",
"@type": "uco-observable:MessageFacet",
"uco-observable:from": {
"@id": "kb:e1e34d20-e77c-4087-a87d-d169d7155b8d"
},
"uco-observable:messageText": "Diana sent a location.",
"uco-observable:sentTime": {
"@type": "xsd:dateTime",
"@value": "2018-12-04T07:52:47Z"
},
"uco-observable:to": [
{
"@id": "kb:f96cfe21-1149-4a46-acb9-7299152c776b"
}
]
},
{
"@id": "kb:recovered-object-facet-1dc5e3f4-4951-44ff-b9f3-14bd63684b29",
"@type": "uco-observable:RecoveredObjectFacet",
"uco-observable:contentRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "partially recovered"
},
"uco-observable:metadataRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
},
"uco-observable:nameRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
}
}
]
},
{
"@id": "kb:cb0354f5-2dbd-4c02-8a6c-011b77125ee2",
"@type": [
"uco-observable:RecoveredObject",
"uco-observable:File"
],
"uco-core:hasFacet": [
{
"@id": "kb:file-facet-41e9483b-8b13-42d6-a05b-431b78906a05",
"@type": "uco-observable:FileFacet",
"uco-observable:accessedTime": {
"@type": "xsd:dateTime",
"@value": "1999-01-02T05:00Z"
},
"uco-observable:extension": "txt",
"uco-observable:fileName": "_BEID.txt",
"uco-observable:filePath": "/img_dfr-01-fat.dd/vol_vol2/_BEID.txt",
"uco-observable:isDirectory": false,
"uco-observable:modifiedTime": {
"@type": "xsd:dateTime",
"@value": "2000-02-29T19:11Z"
},
"uco-observable:observableCreatedTime": {
"@type": "xsd:dateTime",
"@value": "2011-12-25T19:02:22Z"
},
"uco-observable:sizeInBytes": 712
},
{
"@id": "kb:recovered-object-facet-cdb678d8-f75c-4997-a975-59966d8c5530",
"@type": "uco-observable:RecoveredObjectFacet",
"uco-observable:contentRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
},
"uco-observable:metadataRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
},
"uco-observable:nameRecoveredStatus": {
"@type": "uco-vocabulary:RecoveredObjectStatusVocab",
"@value": "recovered"
}
}
]
},
{
"@id": "kb:e1e34d20-e77c-4087-a87d-d169d7155b8d",
"@type": "uco-observable:ObservableObject"
},
{
"@id": "kb:f96cfe21-1149-4a46-acb9-7299152c776b",
"@type": "uco-observable:ObservableObject"
}
]
}