update: Forensic-evidence object

objects/forensic-evidence/definition.json

@@ -27,30 +27,42 @@
 			"Cloud",
 			"IoT",
 			"Other"
-	  ],
-	"disable_correlation": true
+		  ]
 	  },
 	  "name": {
 		"description": "Name",
 		"ui-priority": 0,
 		"misp-attribute": "text"
 	  },
-  "acquisition-hash-type": {
-	"description": "Hashing algorithm used on the evidence",
-	"multiple": true,
+	  "acquisition-method": {
+		"description": "Method used for acquisition of the evidence.",
 		"ui-priority": 0,
 		"misp-attribute": "text",
 		"sane_default": [
-		"MD5",
-		"SHA-1",
+			"Live acquisition",
+			"Dead/Offline acquisition",
+			"Physical collection",
+			"Logical collection",
+			"File system extraction",
+			"Chip-off",
 			"Other"
-	],
-	"disable_correlation": true
+		  ]
 	  },
-  "acquisition-hash": {
-	"description": "Acquisition hash of the evidence",
+	  "acquisition-tools": {
+		"description": "Tools used for acquisition of the evidence.",
 		"ui-priority": 0,
-	"misp-attribute": "text"
+		"misp-attribute": "text",
+		"multiple" : true,
+		"sane_default": [
+			"DCFldd",
+			"EnCase",
+			"FTK Imager",
+			"FDAS",
+			"TrueBack",
+			"Guymager",
+			"IXimager",
+			"Other"
+		  ]
 	  },
 	  "references": {
 		"description": "External references",
@@ -62,12 +74,6 @@
 		"description": "Comments.",
 		"ui-priority": 0,
 		"misp-attribute": "text"
-  },
-  "file-upload": {
-	"description": "Upload any file pertaining to the evidence.",
-	"ui-priority": 0,
-	"misp-attribute": "attachment",
-	"multiple": true
 	  }
   },
   "version": 1,