Chris Hargreaves

Notation in SOLVE-IT for CASE classes that do not yet exist

13

I know there is not tight integration between these projects at the moment, but there are increasing numbers of output entities that are identified through populating SOLVE-IT techniques, that are...

What is the correct representation for a message recipient?

2

I'm currently modelling output from chat applications: There seems to be: observable:sender but there isn't observable:recipient or any synonyms as far as I can tell? (I'm searching Entities A-Z btw)...

Add representation for KeywordSearchResult and potentially KeywordIndex

9

# Background Keyword searching is an important technique in digital forensics. It is indexed in SOLVE-IT in: T1049: Keyword searching Also has sub techniques: T1125:Keyword search (live) T1126:Keyword search (live)...

What is the correct representation for a timestamp?

2

I cannot find a representation for a timestamp? I can find: [core:startTime](https://ontology.caseontology.org/documentation/prop-corestarttime.html) [core:endTime](https://ontology.caseontology.org/documentation/prop-coreendtime.html) and then a load of very specific ones: [observable:timeDateStamp](https://ontology.caseontology.org/documentation/prop-observabletimedatestamp.html) [observable:mftFileNameAccessedTime](https://ontology.caseontology.org/documentation/prop-observablemftfilenameaccessedtime.html) .... but what is the representation for...

# Background Keyword searching is proposed in #179. It also discusses KeywordIndex, which was requested to be broken out into a separate request (https://github.com/casework/CASE/issues/179#issuecomment-3201676650). This has evolved into a more...