CASE Examples

This repository holds example data illustrating usage of the Cyber-investigation Analysis Standard Expression (CASE) language.

Further illustration can be found at the CASE narratives gallery.

Illustrations in this repository

Mapping notes & respective JSON-LD output:

• Accounts
• Bulk Extractor Forensic Path (info)
• Call Log
• Configured Tool
• Device
• EXIF Data
• Files (info)
• Forensic Lifecycle
• Location
• Message
• Mobile device and SIM card
• Multipart File (info)
• Network connection
• Oresteia (info)
• Raw Data
• Reconstructed File (info)
• Recoverability (info)
• SMS and Contacts

This project uses the pre-commit tool for linting the JSON files and ensuring consistent formatting. It can be installed with pip:

pip install pre-commit
pre-commit --version

The pre-commit tool hooks into Git's commit machinery to run a set of linters and static analyzers over each change. To install pre-commit into Git's hooks, run:

pre-commit install

To uninstall pre-commit, run either pre-commit uninstall or rm .git/hooks/pre-commit.