https://unifiedcyberontology.org/ontology/uco/observable#MftRecordFacet
Instances of observable:MftRecordFacet can have the following properties:
PROPERTY |
MIN COUNT |
MAX COUNT |
VALUE CONSTRAINTS |
TYPE |
---|---|---|---|---|
observable:MftRecordFacet | ||||
observable:mftFileID | 0 | 1 |
|
xsd:integer
|
observable:mftFileNameAccessedTime | 0 | 1 |
|
xsd:dateTime
|
observable:mftFileNameCreatedTime | 0 | 1 |
|
xsd:dateTime
|
observable:mftFileNameLength | 0 | 1 |
|
xsd:integer
|
observable:mftFileNameModifiedTime | 0 | 1 |
|
xsd:dateTime
|
observable:mftFileNameRecordChangeTime | 0 | 1 |
|
xsd:dateTime
|
observable:mftFlags | 0 | 1 |
|
xsd:integer
|
observable:mftParentID | 0 | 1 |
|
xsd:integer
|
observable:mftRecordChangeTime | 0 | 1 |
|
xsd:dateTime
|
observable:ntfsHardLinkCount | 0 | 1 |
|
xsd:integer
|
observable:ntfsOwnerID | 0 | 1 |
|
xsd:string
|
observable:ntfsOwnerSID | 0 | 1 |
|
xsd:string
|
@prefix core: <https://unifiedcyberontology.org/ontology/uco/core#> .
@prefix observable: <https://unifiedcyberontology.org/ontology/uco/observable#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
observable:MftRecordFacet a owl:Class,
sh:NodeShape ;
rdfs:label "MftRecordFacet"@en ;
rdfs:comment "An MFT record facet is a grouping of characteristics unique to the details of a single file as managed in an NTFS (new technology filesystem) master file table (which is a collection of information about all files on an NTFS filesystem). [based on https://docs.microsoft.com/en-us/windows/win32/devnotes/master-file-table]"@en ;
rdfs:subClassOf core:Facet ;
sh:property [ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameAccessedTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameCreatedTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameModifiedTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameRecordChangeTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftRecordChangeTime ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileID ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameLength ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFlags ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftParentID ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:ntfsHardLinkCount ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:ntfsOwnerID ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:ntfsOwnerSID ] ;
sh:targetClass observable:MftRecordFacet .