Skip to content

Commit 34ec2fa

Browse files
vulnmastervulnmaster
committed
Add investigation:Technician role class
Adds investigation:Technician as a new role class to the CASE investigation ontology, addressing Issue #184. A technician is a forensics role focused on technical tasks during investigations, such as evidence collection, preservation, processing, initial analysis, and repair. Changes: - Added investigation:Technician class definition to investigation.ttl - Created comprehensive test example (technician_role_PASS.json) demonstrating Identity-role-performer pattern with temporal tracking - Updated test suite (Makefile and test_validation.py) - Updated ChangeLog The implementation follows the established pattern used by other role classes (Attorney, Examiner, Investigator, Subject) and maintains backward compatibility. Tests demonstrate: - Technician role instances with appointment dates (startTime) - Identity linked to Technician role via uco-core:role - Technician role as performer of InvestigativeAction - Integration with Investigation, File, and ProvenanceRecord All SHACL validation tests pass. Closes #184
1 parent e21d2a6 commit 34ec2fa

5 files changed

Lines changed: 89 additions & 2 deletions

File tree

‎ChangeLog‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
2025-10-22
2+
* Issue 184: Add investigation:Technician role class
3+
14
2025-03-18
25
* (7ecdaf4) UCO Issue 629: Revise vocabulary pattern
36

‎ontology/investigation/investigation.ttl‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,17 @@ investigation:SubjectActionLifecycle
235235
sh:targetClass investigation:SubjectActionLifecycle ;
236236
.
237237

238+
investigation:Technician
239+
a
240+
owl:Class ,
241+
sh:NodeShape
242+
;
243+
rdfs:subClassOf uco-role:Role ;
244+
rdfs:label "Technician"@en ;
245+
rdfs:comment "Technician is a role involved in performing technical tasks during investigations, such as evidence collection, preservation, processing, initial analysis, and repair."@en ;
246+
sh:targetClass investigation:Technician ;
247+
.
248+
238249
investigation:VictimActionLifecycle
239250
a
240251
owl:Class ,

‎tests/examples/Makefile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ tests_srcdir := $(top_srcdir)/tests
2222

2323
all: \
2424
investigative_action_PASS_validation.ttl \
25-
investigative_action_XFAIL_validation.ttl
25+
investigative_action_XFAIL_validation.ttl \
26+
technician_role_PASS_validation.ttl
2627

2728
.PRECIOUS: \
2829
%_validation.ttl
@@ -63,7 +64,8 @@ all: \
6364

6465
check: \
6566
investigative_action_PASS_validation.ttl \
66-
investigative_action_XFAIL_validation.ttl
67+
investigative_action_XFAIL_validation.ttl \
68+
technician_role_PASS_validation.ttl
6769
source $(top_srcdir)/venv/bin/activate \
6870
&& pytest \
6971
--log-level=DEBUG

‎tests/examples/technician_role_PASS.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"@context": {
3+
"kb": "http://example.org/kb/",
4+
"case-investigation": "https://ontology.caseontology.org/case/investigation/",
5+
"uco-action": "https://ontology.unifiedcyberontology.org/uco/action/",
6+
"uco-core": "https://ontology.unifiedcyberontology.org/uco/core/",
7+
"uco-observable": "https://ontology.unifiedcyberontology.org/uco/observable/",
8+
"xsd": "http://www.w3.org/2001/XMLSchema#"
9+
},
10+
"@graph": [
11+
{
12+
"@id": "kb:technician-identity-9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d",
13+
"@type": "uco-core:Identity",
14+
"uco-core:name": "Forensic Technician Williams",
15+
"uco-core:role": {
16+
"@id": "kb:technician-role-c8d9f2e1-a4b7-4c3e-8f5d-6a1e9b2c7f4a"
17+
}
18+
},
19+
{
20+
"@id": "kb:technician-role-c8d9f2e1-a4b7-4c3e-8f5d-6a1e9b2c7f4a",
21+
"@type": "case-investigation:Technician",
22+
"uco-core:startTime": {
23+
"@type": "xsd:dateTime",
24+
"@value": "2024-01-15T09:00:00Z"
25+
}
26+
},
27+
{
28+
"@id": "kb:disk-image-3f8a2c7d-b1e9-4d3c-a5f7-1b2e4a9c8d6f",
29+
"@type": "uco-observable:File",
30+
"uco-core:description": "Forensic disk image of evidence laptop",
31+
"uco-core:hasFacet": {
32+
"@id": "kb:disk-image-facet-a3c9f7e1-d5b2-4a8e-9c3f-7e1a5d9b2c4f",
33+
"@type": "uco-observable:FileFacet",
34+
"uco-observable:fileName": "evidence-laptop-001.dd",
35+
"uco-observable:sizeInBytes": 512000000000
36+
}
37+
},
38+
{
39+
"@id": "kb:disk-imaging-action-5d7a3e9f-c2b4-4f8a-9e3d-6c1b5a8f7e2d",
40+
"@type": "case-investigation:InvestigativeAction",
41+
"uco-core:name": "Disk imaging of evidence laptop",
42+
"uco-action:performer": {
43+
"@id": "kb:technician-role-c8d9f2e1-a4b7-4c3e-8f5d-6a1e9b2c7f4a"
44+
},
45+
"uco-action:result": [
46+
{
47+
"@id": "kb:disk-image-3f8a2c7d-b1e9-4d3c-a5f7-1b2e4a9c8d6f"
48+
},
49+
{
50+
"@id": "kb:provenance-record-e9f5c1a7-d4b8-4a6e-9c2f-3e5d7a9b1c4f"
51+
}
52+
]
53+
},
54+
{
55+
"@id": "kb:provenance-record-e9f5c1a7-d4b8-4a6e-9c2f-3e5d7a9b1c4f",
56+
"@type": "case-investigation:ProvenanceRecord",
57+
"case-investigation:exhibitNumber": "2024-001-E1",
58+
"case-investigation:rootExhibitNumber": "2024-001-E1",
59+
"uco-core:object": {
60+
"@id": "kb:disk-image-3f8a2c7d-b1e9-4d3c-a5f7-1b2e4a9c8d6f"
61+
}
62+
}
63+
]
64+
}

‎tests/examples/test_validation.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,3 +128,10 @@ def test_investigative_action_XFAIL_validation() -> None:
128128
str(NS_CASE_INVESTIGATION.rootExhibitNumber)
129129
}
130130
)
131+
132+
def test_technician_role_PASS_validation() -> None:
133+
"""
134+
Confirm the Technician role PASS instance data passes validation.
135+
"""
136+
g = load_validation_graph("technician_role_PASS_validation.ttl", True)
137+
assert isinstance(g, rdflib.Graph)

0 commit comments

Comments
 (0)