https://ontology.unifiedcyberontology.org/uco/observable/MftRecordFacet
An MFT record facet is a grouping of characteristics unique to the details of a single file as managed in an NTFS (new technology filesystem) master file table (which is a collection of information about all files on an NTFS filesystem). [based on https://docs.microsoft.com/en-us/windows/win32/devnotes/master-file-table]
Instances of observable:MftRecordFacet can have the following properties:
PROPERTY |
MIN COUNT |
MAX COUNT |
TYPE |
|
|---|---|---|---|---|
| observable:MftRecordFacet | ||||
| observable:mftFileID | 1 |
xsd:integer
|
||
| observable:mftFileNameAccessedTime | 1 |
xsd:dateTime
|
||
| observable:mftFileNameCreatedTime | 1 |
xsd:dateTime
|
||
| observable:mftFileNameLength | 1 |
xsd:integer
|
||
| observable:mftFileNameModifiedTime | 1 |
xsd:dateTime
|
||
| observable:mftFileNameRecordChangeTime | 1 |
xsd:dateTime
|
||
| observable:mftFlags | 1 |
xsd:integer
|
||
| observable:mftParentID | 1 |
xsd:integer
|
||
| observable:mftRecordChangeTime | 1 |
xsd:dateTime
|
||
| observable:ntfsHardLinkCount | 1 |
xsd:integer
|
||
| observable:ntfsOwnerID | 1 |
xsd:string
|
||
| observable:ntfsOwnerSID | 1 |
xsd:string
|
||
@prefix core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
observable:MftRecordFacet a owl:Class,
sh:NodeShape ;
rdfs:label "MftRecordFacet"@en ;
rdfs:comment "An MFT record facet is a grouping of characteristics unique to the details of a single file as managed in an NTFS (new technology filesystem) master file table (which is a collection of information about all files on an NTFS filesystem). [based on https://docs.microsoft.com/en-us/windows/win32/devnotes/master-file-table]"@en ;
rdfs:subClassOf core:Facet ;
sh:property [ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameAccessedTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameCreatedTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameModifiedTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameRecordChangeTime ],
[ sh:datatype xsd:dateTime ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftRecordChangeTime ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileID ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFileNameLength ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftFlags ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:mftParentID ],
[ sh:datatype xsd:integer ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:ntfsHardLinkCount ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:ntfsOwnerID ],
[ sh:datatype xsd:string ;
sh:maxCount 1 ;
sh:nodeKind sh:Literal ;
sh:path observable:ntfsOwnerSID ] ;
sh:targetClass observable:MftRecordFacet .