2018-09-04 13:31:13 +02:00
|
|
|
{
|
|
|
|
|
"required": [
|
2018-09-04 13:46:00 +02:00
|
|
|
"case-number",
|
|
|
|
|
"evidence-number"
|
2018-09-04 13:31:13 +02:00
|
|
|
],
|
|
|
|
|
"attributes": {
|
2018-09-04 15:18:30 +02:00
|
|
|
"case-number": {
|
|
|
|
|
"description": "A unique number assigned to the case for unique identification.",
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "text"
|
|
|
|
|
},
|
|
|
|
|
"evidence-number": {
|
|
|
|
|
"description": "A unique number assigned to the evidence for unique identification.",
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "text"
|
|
|
|
|
},
|
|
|
|
|
"type": {
|
|
|
|
|
"description": "Evidence type.",
|
|
|
|
|
"multiple": true,
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "text",
|
|
|
|
|
"sane_default": [
|
|
|
|
|
"Computer",
|
|
|
|
|
"Network",
|
|
|
|
|
"Mobile Device",
|
|
|
|
|
"Multimedia",
|
|
|
|
|
"Cloud",
|
|
|
|
|
"IoT",
|
|
|
|
|
"Other"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"name": {
|
|
|
|
|
"description": "Name",
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "text"
|
|
|
|
|
},
|
|
|
|
|
"acquisition-method": {
|
|
|
|
|
"description": "Method used for acquisition of the evidence.",
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "text",
|
|
|
|
|
"sane_default": [
|
|
|
|
|
"Live acquisition",
|
|
|
|
|
"Dead/Offline acquisition",
|
|
|
|
|
"Physical collection",
|
|
|
|
|
"Logical collection",
|
|
|
|
|
"File system extraction",
|
|
|
|
|
"Chip-off",
|
|
|
|
|
"Other"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"acquisition-tools": {
|
|
|
|
|
"description": "Tools used for acquisition of the evidence.",
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "text",
|
|
|
|
|
"multiple" : true,
|
|
|
|
|
"sane_default": [
|
|
|
|
|
"DCFldd",
|
|
|
|
|
"EnCase",
|
|
|
|
|
"FTK Imager",
|
|
|
|
|
"FDAS",
|
|
|
|
|
"TrueBack",
|
|
|
|
|
"Guymager",
|
|
|
|
|
"IXimager",
|
|
|
|
|
"Other"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"references": {
|
|
|
|
|
"description": "External references",
|
|
|
|
|
"multiple": true,
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "link"
|
|
|
|
|
},
|
|
|
|
|
"additional-comments": {
|
|
|
|
|
"description": "Comments.",
|
|
|
|
|
"ui-priority": 0,
|
|
|
|
|
"misp-attribute": "text"
|
|
|
|
|
}
|
2018-09-04 13:31:13 +02:00
|
|
|
},
|
|
|
|
|
"version": 1,
|
|
|
|
|
"description": "An object template to describe a digital forensic evidence.",
|
|
|
|
|
"meta-category": "misc",
|
|
|
|
|
"uuid": "fe44c648-63ef-43fc-b3de-af71a2e023e4",
|
|
|
|
|
"name": "forensic-evidence"
|
|
|
|
|
}
|
