{
    "@context": {
        "@vocab": "http://example.org/ontology/local#",
        "case-investigation": "https://ontology.caseontology.org/case/investigation/",
        "drafting": "http://example.org/ontology/drafting/",
        "rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
        "rdfs": "http://www.w3.org/2000/01/rdf-schema#",
        "kb": "http://example.org/kb/",
        "uco-action": "https://ontology.unifiedcyberontology.org/uco/action/",
        "uco-configuration": "https://ontology.unifiedcyberontology.org/uco/configuration/",
        "uco-core": "https://ontology.unifiedcyberontology.org/uco/core/",
        "uco-identity": "https://ontology.unifiedcyberontology.org/uco/identity/",
        "uco-location": "https://ontology.unifiedcyberontology.org/uco/location/",
        "uco-observable": "https://ontology.unifiedcyberontology.org/uco/observable/",
        "uco-role": "https://ontology.unifiedcyberontology.org/uco/role/",
        "uco-tool": "https://ontology.unifiedcyberontology.org/uco/tool/",
        "uco-types": "https://ontology.unifiedcyberontology.org/uco/types/",
        "uco-vocabulary": "https://ontology.unifiedcyberontology.org/uco/vocabulary/",
        "xsd": "http://www.w3.org/2001/XMLSchema#"
    },
    "@graph": [
        {
            "@id": "kb:Bundle-feb83c4b-9d88-41ac-b8d8-82d317b40a53",
            "@type": "uco-core:Bundle",
            "uco-core:description": "Evidence in bank robbery",
            "uco-core:object": [
                {
                    "@id": "kb:Investigation1-85c7b8d1-54e0-4023-847a-20e0f55dd48e",
                    "@type": "case-investigation:Investigation",
                    "uco-core:name": "CROSSOVER_2018_11191001",
                    "case-investigation:focus": "Bank Robbery (UBS Lausanne)",
                    "uco-core:description": "Forensic treatment of storage media recovered from getaway car and suspects apartment during investigation of bank robbery.",
                    "rdfs:comment": "TODO - uco-core:object is to have a more complete list of IRIs.",
                    "uco-core:object": [
                        {
                            "@id": "kb:Disk-6dbe5066-dfb8-4551-9bda-39aab2ae3db1"
                        }
                    ]
                }
            ]
        },
        {
            "@id": "kb:Identity-cbfbd171-e56c-4f59-a01b-4404a1e5eb28",
            "@type": "uco-identity:Organization",
            "uco-core:name": "ESC"
        },
        {
            "@id": "kb:Role-870e2626-5ffd-4a80-83c2-8ee429709c81",
            "@type": "uco-role:Role",
            "uco-core:name": "Forensic Expert"
        },
        {
            "@id": "kb:Relationship-ec126575-d6a4-4590-9690-f2571a48b8ac",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:Identity-cbfbd171-e56c-4f59-a01b-4404a1e5eb28"
            },
            "uco-core:target": {
                "@id": "kb:Role-870e2626-5ffd-4a80-83c2-8ee429709c81"
            },
            "uco-core:kindOfRelationship": "Has_Role",
            "uco-core:isDirectional": true
        },
        {
            "@id": "kb:ConfiguredTool-22cb1ad6-7910-4a71-8654-5e93280111a3",
            "@type": "uco-tool:ConfiguredTool",
            "uco-core:name": "Tableau TD2u",
            "uco-tool:toolType": "acquisition/duplication",
            "uco-tool:creator": {
                "@id": "kb:organization-cf3010bb-7716-473d-98ee-25e4917e7b80"
            },
            "uco-tool:version": "1.2.1 (build 5241-814712f)",
            "drafting:toolIdentifier": "000eccd2007540a6",
            "uco-configuration:usesConfiguration": {
                "@id": "kb:Configuration-d9f82a71-1074-409f-a481-28f1fbc7ee28",
                "@type": "uco-configuration:Configuration",
                "uco-configuration:configurationEntry": [
                    {
                        "@id": "kb:configuration-entry-3345eee3-7d8d-4378-95f2-30b8ca631e30",
                        "@type": "uco-configuration:ConfigurationEntry",
                        "uco-configuration:itemName": "Mode",
                        "uco-configuration:itemValue": "DriveToFile"
                    },
                    {
                        "@id": "kb:configuration-entry-43c509fc-8755-410a-97e7-a6001d3a3f61",
                        "@type": "uco-configuration:ConfigurationEntry",
                        "uco-configuration:itemName": "Method",
                        "uco-configuration:itemValue": "E01Capture"
                    },
                    {
                        "@id": "kb:configuration-entry-7bcf9625-cdf4-4cd9-8fc5-b70987abb20c",
                        "@type": "uco-configuration:ConfigurationEntry",
                        "uco-configuration:itemName": "Hash",
                        "uco-configuration:itemValue": "SHA-1+MD5"
                    }
                ]
            }
        },
        {
            "@id": "kb:organization-cf3010bb-7716-473d-98ee-25e4917e7b80",
            "@type": "uco-identity:Identity",
            "uco-core:name": "Opentext"
        },
        {
            "@id": "kb:InvestigativeAction-e019ed92-af10-4a9f-a914-7a9ba539807c",
            "@type": "case-investigation:InvestigativeAction",
            "uco-core:name": "disk image",
            "uco-core:description": "Acquisition of Kingston DataTraveler 2.0",
            "uco-action:startTime": {
                "@type": "xsd:dateTime",
                "@value": "2018-11-19T15:51:10.00Z"
            },
            "uco-action:endTime": {
                "@type": "xsd:dateTime",
                "@value": "2018-11-19T15:58:38.00Z"
            },
            "uco-action:instrument": {
                "@id": "kb:ConfiguredTool-22cb1ad6-7910-4a71-8654-5e93280111a3"
            },
            "drafting:notProvidedByReport": {
                "@id": "uco-action:location"
            },
            "uco-action:performer": {
                "@id": "kb:Role-870e2626-5ffd-4a80-83c2-8ee429709c81"
            },
            "uco-action:object": [
                {
                    "@id": "kb:Disk-6dbe5066-dfb8-4551-9bda-39aab2ae3db1"
                },
                {
                    "@id": "kb:ProvenanceRecord-53d614ea-d7cd-4491-a100-2f0b88299e89"
                }
            ],
            "uco-action:result": [
                {
                    "@id": "kb:usb-b2dbb227-06ec-432d-9f63-058e8ab73944"
                },
                {
                    "@id": "kb:ProvenanceRecord-0ff68932-2abc-433c-91b0-5af1ca34b470"
                }
            ]
        },
        {
            "@id": "kb:Disk-6dbe5066-dfb8-4551-9bda-39aab2ae3db1",
            "@type": "uco-observable:Disk",
            "uco-core:hasFacet": [
                {
                    "@id": "kb:disk-facet-c9fa6408-85f8-4e0b-bf8f-f653f5bc97c3",
                    "@type": "uco-observable:DiskFacet",
                    "uco-observable:model": "Kingston DataTraveler 2.0",
                    "drafting:USBSerialNumber": "001D7D06CF09ED91D97F1B1B",
                    "uco-observable:serialNumber": "0E0D19D17DD9",
                    "uco-observable:storageCapacityInBytes": 7803174912
                },
                {
                    "@id": "kb:content-data-facet-25069e03-040a-421b-9bfa-25d532ec23b8",
                    "@type": "uco-observable:ContentDataFacet",
                    "uco-observable:hash": [
                        {
                            "@id": "kb:hash-12a9f855-c237-51d8-8239-0bb130374fde",
                            "@type": "uco-types:Hash",
                            "uco-types:hashMethod": {
                                "@type": "uco-vocabulary:HashNameVocab",
                                "@value": "MD5"
                            },
                            "uco-types:hashValue": {
                                "@type": "xsd:hexBinary",
                                "@value": "058f03317c1612eadd624342b7fde511"
                            }
                        },
                        {
                            "@id": "kb:hash-128996fc-3823-54a5-9ca4-cf6e21fca62f"
                        }
                    ]
                }
            ]
        },
        {
            "@id": "kb:ProvenanceRecord-53d614ea-d7cd-4491-a100-2f0b88299e89",
            "@type": "case-investigation:ProvenanceRecord",
            "uco-observable:observableCreatedTime": {
                "@type": "xsd:dateTime",
                "@value": "2018-10-26T13:12:48.00Z"
            },
            "uco-core:description": "Kingston DataTraveler 2.0",
            "case-investigation:exhibitNumber": "20181119-001-001",
            "uco-core:object": {
                "@id": "kb:Disk-6dbe5066-dfb8-4551-9bda-39aab2ae3db1"
            }
        },
        {
            "@id": "kb:usb-b2dbb227-06ec-432d-9f63-058e8ab73944",
            "@type": [
                "uco-observable:File",
                "uco-observable:Image"
            ],
            "uco-core:hasFacet": [
                {
                    "@id": "kb:file-facet-71922639-1d8f-4494-a399-a8b3282bf55b",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:fileName": "image.E01",
                    "uco-observable:filePath": "2018-11-19_15-50-58/image.E01",
                    "uco-observable:extension": "E01",
                    "uco-observable:fileSystemType": "ntfs",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 2147483648,
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T15:50:58.00Z"
                    }
                },
                {
                    "@id": "kb:content-data-facet-17661dfc-7b8a-46c0-8b0e-0f7b1eac3096",
                    "@type": "uco-observable:ContentDataFacet",
                    "uco-observable:hash": {
                        "@id": "kb:hash-128996fc-3823-54a5-9ca4-cf6e21fca62f"
                    }
                }
            ]
        },
        {
            "@id": "kb:ProvenanceRecord-0ff68932-2abc-433c-91b0-5af1ca34b470",
            "@type": "case-investigation:ProvenanceRecord",
            "uco-core:description": "Forensic image with E01Capture",
            "uco-observable:observableCreatedTime": {
                "@type": "xsd:dateTime",
                "@value": "2018-11-19T15:50:58.00Z"
            },
            "case-investigation:exhibitNumber": "20181119-001-001-01",
            "uco-core:object": {
                "@id": "kb:usb-b2dbb227-06ec-432d-9f63-058e8ab73944"
            }
        },
        {
            "@id": "kb:EmailAddress-d2bc0936-e1c5-4b55-8a1b-af2b3a2b145c",
            "@type": "uco-observable:EmailAddress",
            "uco-core:hasFacet": {
                "@id": "kb:email-address-facet-20454f34-043e-48fc-bb66-dcf91aa11a5c",
                "@type": "uco-observable:EmailAddressFacet",
                "uco-observable:addressValue": "aresthewerewolf@gmail.com <aresthewerewolf>"
            }
        },
        {
            "@id": "kb:EmailAccount-ca4bc5e3-33a7-4457-b106-d0213e248979",
            "@type": "uco-observable:EmailAccount",
            "uco-core:hasFacet": {
                "@id": "kb:email-address-facet-9e20866a-4533-4d02-9aa5-cc563299315f",
                "@type": "uco-observable:EmailAddressFacet",
                "uco-observable:emailAddress": {
                    "@id": "kb:EmailAddress-5f63c12b-115a-474f-b1b2-15ebdb2fce31"
                }
            }
        },
        {
            "@id": "kb:EmailAddress-5f63c12b-115a-474f-b1b2-15ebdb2fce31",
            "@type": "uco-observable:EmailAddress",
            "uco-core:hasFacet": {
                "@id": "kb:email-address-facet-f0081a6a-3c18-47d5-87bf-6367d30d2c8c",
                "@type": "uco-observable:EmailAddressFacet",
                "uco-observable:addressValue": "badquinn3@gmail.com"
            }
        },
        {
            "@id": "kb:EmailMessage-c5efd42c-d771-43aa-afe5-6b30740348e3",
            "@type": "uco-observable:EmailMessage",
            "uco-core:hasFacet": [
                {
                    "@id": "kb:email-message-facet-f57e953c-95af-437d-b115-94585eb0ac13",
                    "@type": "uco-observable:EmailMessageFacet",
                    "uco-observable:body": "",
                    "uco-observable:from": {
                        "@id": "kb:EmailAddress-d2bc0936-e1c5-4b55-8a1b-af2b3a2b145c"
                    },
                    "uco-observable:isRead": true,
                    "uco-observable:messageID": "2320dc68-65a3-4f05-8884-945992231a1e",
                    "uco-observable:sender": {
                        "@id": "kb:EmailAddress-d2bc0936-e1c5-4b55-8a1b-af2b3a2b145c"
                    },
                    "uco-observable:sentTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-20T00:00:30+00:00"
                    },
                    "uco-observable:subject": "Bank transfer ?",
                    "uco-observable:to": {
                        "@id": "kb:EmailAccount-ca4bc5e3-33a7-4457-b106-d0213e248979"
                    }
                }
            ]
        },
        {
            "@id": "kb:harddrive-partition2-e3f25b0b-37bf-4111-bae3-d355aff3c8a2",
            "@type": "uco-observable:DiskPartition"
        },
        {
            "@id": "kb:hash-128996fc-3823-54a5-9ca4-cf6e21fca62f",
            "@type": "uco-types:Hash",
            "uco-types:hashMethod": {
                "@type": "uco-vocabulary:HashNameVocab",
                "@value": "SHA1"
            },
            "uco-types:hashValue": {
                "@type": "xsd:hexBinary",
                "@value": "a1ecc7523855f23f3f9a96e3ec0f53ece109cd7d"
            }
        },
        {
            "@id": "kb:lnkfile-487b236d-e75d-467e-9c6d-dad2d12cf94e",
            "@type": "uco-observable:File",
            "uco-core:hasFacet": [
                {
                    "uco-observable:accessedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:29:15Z"
                    },
                    "uco-observable:extension": "lnk",
                    "uco-observable:fileName": "Thebatplan.lnk",
                    "uco-observable:filePath": "/img_image.E01/vol_vol3/Users/Harley Quinn/AppData/Roaming/Microsoft/Windows/Recent/Thebatplan.lnk",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 508,
                    "@id": "kb:file-facet-b221fe82-47e7-4a49-81a3-7ba6d3b438a8",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:29:15Z"
                    },
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:29:15Z"
                    }
                }
            ]
        },
        {
            "@id": "kb:Relationship-f0505f2a-5de0-4651-9486-16746758f6c8",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:lnkfile-487b236d-e75d-467e-9c6d-dad2d12cf94e"
            },
            "uco-core:target": {
                "@id": "kb:harddrive-partition2-e3f25b0b-37bf-4111-bae3-d355aff3c8a2"
            },
            "uco-core:kindOfRelationship": "Contained-Within",
            "uco-core:isDirectional": true
        },
        {
            "uco-core:hasFacet": [
                {
                    "uco-observable:accessedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:23:50Z"
                    },
                    "uco-observable:extension": "lnk",
                    "uco-observable:fileName": "thebatletter.lnk",
                    "uco-observable:filePath": "/img_image.E01/vol_vol3/Users/Harley Quinn/AppData/Roaming/Microsoft/Windows/Recent/thebatletter.lnk",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 535,
                    "@id": "kb:file-facet-16b6a9f9-0b3d-4b7a-9c61-6859e7ca7e45",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:23:50Z"
                    },
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:23:50Z"
                    }
                }
            ],
            "@id": "kb:lnkfile-f3c23080-0236-4ee7-83e7-cccc5fa06ee0",
            "@type": "uco-observable:File"
        },
        {
            "@id": "kb:Relationship-e29bbd14-396d-48d4-abbf-acdfd346ca64",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:lnkfile-f3c23080-0236-4ee7-83e7-cccc5fa06ee0"
            },
            "uco-core:target": {
                "@id": "kb:harddrive-partition2-e3f25b0b-37bf-4111-bae3-d355aff3c8a2"
            },
            "uco-core:kindOfRelationship": "contained-within",
            "uco-core:isDirectional": true
        },
        {
            "uco-core:hasFacet": [
                {
                    "uco-observable:accessedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:27:14Z"
                    },
                    "uco-observable:extension": "lnk",
                    "uco-observable:fileName": "wow.lnk",
                    "uco-observable:filePath": "/img_image.E01/vol_vol3/Users/Harley Quinn/AppData/Roaming/Microsoft/Windows/Recent/wow.lnk",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 495,
                    "@id": "kb:file-facet-763c6961-c335-40b6-a8b3-36b6f5f15ecb",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:27:14Z"
                    },
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:27:14Z"
                    }
                }
            ],
            "@id": "kb:File-31c06b79-ad9f-446a-859a-62b848e2e1f8",
            "@type": "uco-observable:File"
        },
        {
            "@id": "kb:df9f6a42-fbb6-4e7e-bf60-6518680241dd",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:File-31c06b79-ad9f-446a-859a-62b848e2e1f8"
            },
            "uco-core:target": {
                "@id": "kb:harddrive-partition2-e3f25b0b-37bf-4111-bae3-d355aff3c8a2"
            },
            "uco-core:kindOfRelationship": "Contained-Within",
            "uco-core:isDirectional": true
        },
        {
            "uco-core:hasFacet": [
                {
                    "uco-observable:accessedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:28:41Z"
                    },
                    "uco-observable:extension": "lnk",
                    "uco-observable:fileName": "wow (2).lnk",
                    "uco-observable:filePath": "/img_image.E01/vol_vol3/Users/Harley Quinn/AppData/Roaming/Microsoft/Windows/Recent/wow (2).lnk",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 457,
                    "@id": "kb:file-facet-fa661a0f-1b8d-4552-870e-daf7b93404be",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:28:28Z"
                    },
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-19T00:28:41Z"
                    }
                }
            ],
            "@id": "kb:File-26adfe08-e545-4d24-872b-84f95bd01284",
            "@type": "uco-observable:File"
        },
        {
            "uco-core:source": {
                "@id": "kb:File-26adfe08-e545-4d24-872b-84f95bd01284"
            },
            "uco-core:target": {
                "@id": "kb:harddrive-partition2-e3f25b0b-37bf-4111-bae3-d355aff3c8a2"
            },
            "uco-core:kindOfRelationship": "contained-within",
            "uco-core:isDirectional": true,
            "@id": "kb:Relationship-d70472d2-42a7-4ea1-9f3f-4fd7637bd4ff",
            "@type": "uco-observable:ObservableRelationship"
        },
        {
            "uco-core:hasFacet": [
                {
                    "@id": "kb:file-facet-929bcdfd-ca54-4df7-989a-6b7206b8661e",
                    "uco-observable:accessedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T22:53:09Z"
                    },
                    "uco-observable:extension": "docx",
                    "uco-observable:fileName": "thebatletter.docx",
                    "uco-observable:filePath": "/thebatletter.docx",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 11633,
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T22:53:09Z"
                    },
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T21:30:48Z"
                    }
                }
            ],
            "@id": "kb:File-ed7c30a2-e233-4732-adee-8514955b6dfb",
            "@type": "uco-observable:File"
        },
        {
            "@id": "kb:b3a202b4-ee2b-4f26-9a31-6d10801524e7",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:File-ed7c30a2-e233-4732-adee-8514955b6dfb"
            },
            "uco-core:target": {
                "@id": "kb:usb-b2dbb227-06ec-432d-9f63-058e8ab73944"
            },
            "uco-core:kindOfRelationship": "contained-within",
            "uco-core:isDirectional": true
        },
        {
            "@id": "kb:content-2ea73bc6-801a-47ff-a8fa-837c226bfa14",
            "@type": [
                "uco-observable:ContentData",
                "uco-observable:RecoveredObject"
            ],
            "uco-core:hasFacet": [
                {
                    "@id": "kb:recovered-object-facet-0a916246-a9a0-43ad-a158-ae76cc2c1bb7",
                    "@type": "uco-observable:RecoveredObjectFacet",
                    "uco-observable:contentRecoveredStatus": {
                        "@type": "uco-vocabulary:RecoveredObjectStatusVocab",
                        "@value": "recovered"
                    },
                    "uco-observable:metadataRecoveredStatus": {
                        "@type": "uco-vocabulary:RecoveredObjectStatusVocab",
                        "@value": "recovered"
                    },
                    "uco-observable:nameRecoveredStatus": {
                        "@type": "uco-vocabulary:RecoveredObjectStatusVocab",
                        "@value": "recovered"
                    }
                },
                {
                    "@id": "kb:content-data-facet-17d9f5ea-d00b-4130-866f-e7399332ae5e",
                    "@type": "uco-observable:ContentDataFacet",
                    "uco-observable:byteOrder": {
                        "@type": "uco-vocabulary:EndiannessTypeVocab",
                        "@value": "Big-endian"
                    },
                    "uco-observable:sizeInBytes": 11633,
                    "uco-observable:mimeType": "application/application/vnd.openxmlformats-officedocument.wordprocessingml.document",
                    "uco-observable:hash": [
                        {
                            "@id": "kb:hash-adece2a7-0017-5e25-be76-f6b78386186b",
                            "@type": "uco-types:Hash",
                            "rdfs:comment": "TODO: From the hash length, the algorithm appears to be MD5, not SHA2-256.",
                            "uco-types:hashMethod": {
                                "@type": "uco-vocabulary:HashNameVocab",
                                "@value": "SHA256"
                            },
                            "uco-types:hashValue": {
                                "@type": "xsd:hexBinary",
                                "@value": "701ad15009b0e79af524336f7d069ed1"
                            }
                        }
                    ]
                }
            ]
        },
        {
            "@id": "kb:Relationship-e4b416ed-4e02-4ecd-bd4d-d57ec485a37e",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:content-2ea73bc6-801a-47ff-a8fa-837c226bfa14"
            },
            "uco-core:target": {
                "@id": "kb:usb-b2dbb227-06ec-432d-9f63-058e8ab73944"
            },
            "uco-core:kindOfRelationship": "Contained_Within",
            "uco-core:isDirectional": true,
            "uco-core:hasFacet": [
                {
                    "@id": "kb:data-range-facet-9bd1e773-0e69-4c21-b168-c05c834dd756",
                    "@type": "uco-observable:DataRangeFacet",
                    "uco-observable:rangeOffset": 9994240,
                    "uco-observable:rangeSize": 11633
                }
            ]
        },
        {
            "@id": "kb:Relationship-59a90c3f-12a9-4ed4-b175-2e56b75abd74",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:content-2ea73bc6-801a-47ff-a8fa-837c226bfa14"
            },
            "uco-core:target": {
                "@id": "kb:File-ed7c30a2-e233-4732-adee-8514955b6dfb"
            },
            "uco-core:kindOfRelationship": "Contained-Within",
            "uco-core:isDirectional": true
        },
        {
            "@id": "kb:lnk1-relationship-a1dbff0e-974b-4295-b035-e1bc3271945d",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:file-d87ecfcb-006c-46e6-a973-e756ee4d4f70"
            },
            "uco-core:target": {
                "@id": "kb:lnkfile-487b236d-e75d-467e-9c6d-dad2d12cf94e"
            },
            "uco-core:kindOfRelationship": "Referenced_Within",
            "uco-core:isDirectional": true
        },
        {
            "@id": "kb:file-d87ecfcb-006c-46e6-a973-e756ee4d4f70",
            "@type": "uco-observable:File",
            "uco-core:hasFacet": [
                {
                    "uco-observable:sizeInBytes": 1389601,
                    "uco-observable:mimeType": "image/jpeg",
                    "uco-observable:hash": [
                        {
                            "@id": "kb:hash-c5761f3a-a741-5d06-a668-91e308ef19ef",
                            "@type": "uco-types:Hash",
                            "uco-types:hashMethod": {
                                "@type": "uco-vocabulary:HashNameVocab",
                                "@value": "MD5"
                            },
                            "uco-types:hashValue": {
                                "@type": "xsd:hexBinary",
                                "@value": "2282dddf9378cd1dd0497a3484adf768"
                            }
                        }
                    ],
                    "@id": "kb:content-data-facet-33dee628-9332-4b77-8853-1dc5481c5460",
                    "@type": "uco-observable:ContentDataFacet"
                },
                {
                    "uco-observable:accessedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T22:53:09Z"
                    },
                    "uco-observable:extension": "",
                    "uco-observable:fileName": "Thebatplan",
                    "uco-observable:filePath": "/img_image.E01/Thebatplan",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 1389601,
                    "@id": "kb:file-facet-4fc6467e-dbc1-403b-876a-05a97efa7c81",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T22:53:09Z"
                    },
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T20:10:48Z"
                    }
                }
            ]
        },
        {
            "@id": "kb:Relationship-e6d52185-c570-409c-ae35-ceaf3e01080b",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:file-d87ecfcb-006c-46e6-a973-e756ee4d4f70"
            },
            "uco-core:target": {
                "@id": "kb:usb-b2dbb227-06ec-432d-9f63-058e8ab73944"
            },
            "uco-core:kindOfRelationship": "contained-within",
            "uco-core:isDirectional": true
        },
        {
            "uco-core:hasFacet": [
                {
                    "@id": "kb:content-data-facet-40ab2874-6f85-4623-8a17-5f105ed2042b",
                    "@type": "uco-observable:ContentDataFacet",
                    "uco-observable:sizeInBytes": 756969,
                    "uco-observable:mimeType": "image/jpeg"
                },
                {
                    "@id": "kb:file-facet-4afdcc08-f93f-472e-89db-ade60d84ca6f",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:accessedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T22:53:09Z"
                    },
                    "uco-observable:extension": "jpg",
                    "uco-observable:fileName": "wow.jpg",
                    "uco-observable:filePath": "/img_image.E01/wow.jpg",
                    "uco-observable:isDirectory": false,
                    "uco-observable:sizeInBytes": 756969,
                    "uco-observable:observableCreatedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T22:53:09Z"
                    },
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2018-11-18T20:28:58Z"
                    }
                }
            ],
            "@id": "kb:File-bbb4f0c4-ea2c-42fa-9ec0-11bc4678b7b8",
            "@type": "uco-observable:File"
        },
        {
            "uco-core:source": {
                "@id": "kb:File-bbb4f0c4-ea2c-42fa-9ec0-11bc4678b7b8"
            },
            "uco-core:target": {
                "@id": "kb:usb-b2dbb227-06ec-432d-9f63-058e8ab73944"
            },
            "uco-core:kindOfRelationship": "contained-within",
            "uco-core:isDirectional": true,
            "@id": "kb:Relationship-ce92625b-c5f0-4856-940b-692d82de602c",
            "@type": "uco-observable:ObservableRelationship"
        },
        {
            "@id": "kb:url-def4ae18-9181-4cce-8f5f-a9aba022b98b",
            "@type": "uco-observable:URL",
            "uco-core:hasFacet": [
                {
                    "@id": "kb:url-facet-37438f61-d440-429a-ab30-9fc9b2464274",
                    "@type": "uco-observable:URLFacet",
                    "uco-observable:fullValue": "file:///D:/wow.jpg"
                },
                {
                    "uco-observable:value": "",
                    "@id": "kb:domain-name-facet-b05e0e6b-deb0-4989-8214-d6d2b99ef1ea",
                    "@type": "uco-observable:DomainNameFacet"
                }
            ]
        },
        {
            "uco-core:source": {
                "@id": "kb:url-def4ae18-9181-4cce-8f5f-a9aba022b98b"
            },
            "uco-core:target": {
                "@id": "kb:file-webcache-12c51c62-e5e2-4018-ac45-e0e69e36573f"
            },
            "uco-core:kindOfRelationship": "contained-within",
            "uco-core:isDirectional": true,
            "@id": "kb:Relationship-47601a3c-d962-4e3a-b90d-fa2bad7a0be3",
            "@type": "uco-observable:ObservableRelationship"
        },
        {
            "@id": "kb:file-webcache-12c51c62-e5e2-4018-ac45-e0e69e36573f",
            "@type": "uco-observable:ObservableObject"
        },
        {
            "@id": "kb:ApplicationAccount-580d7253-5086-41a5-b788-69e3ceaa4bae",
            "@type": "uco-observable:ApplicationAccount",
            "uco-core:hasFacet": [
                {
                    "@id": "kb:application-account-facet-b26e6f07-0436-48ca-8d39-2e7dafd055ec",
                    "@type": "uco-observable:ApplicationAccountFacet",
                    "uco-observable:displayName": "Harley Quinn"
                }
            ]
        },
        {
            "@type": "uco-observable:Application",
            "@id": "kb:software-5d96df90-d9e1-423c-b8db-c2327812ab38",
            "uco-core:hasFacet": [
                {
                    "uco-observable:applicationIdentifier": "Microsoft Edge",
                    "@id": "kb:application-facet-ed282901-6700-419b-9a03-aa56d7252c8a",
                    "@type": "uco-observable:ApplicationFacet"
                }
            ]
        },
        {
            "@id": "kb:url-history-39ff4987-8ae5-47e3-8369-dbd0d5f79398",
            "@type": "uco-observable:URLHistoryFacet",
            "uco-core:hasFacet": [
                {
                    "@id": "kb:url-history-facet-728d325b-d3df-4e4b-97b2-dbf9c7c64da8",
                    "@type": "uco-observable:URLHistoryFacet",
                    "uco-observable:browserInformation": {
                        "@id": "kb:software-5d96df90-d9e1-423c-b8db-c2327812ab38"
                    },
                    "uco-observable:urlHistoryEntry": [
                        {
                            "@id": "kb:url-history-entry-b2e78940-dc49-44f5-ac7e-ef9b8a9bc976",
                            "@type": "uco-observable:URLHistoryEntry",
                            "uco-observable:firstVisit": {
                                "@type": "xsd:dateTime",
                                "@value": "2018-11-19T00:27:14.00Z"
                            },
                            "uco-observable:lastVisit": {
                                "@type": "xsd:dateTime",
                                "@value": "2018-11-19T00:27:14.00Z"
                            },
                            "uco-observable:expirationTime": null,
                            "rdfs:comment": "TODO - Was uco-observable:browserUserProfile intended to be an object property?",
                            "drafting:browserUserProfileAccount": {
                                "@id": "kb:ApplicationAccount-580d7253-5086-41a5-b788-69e3ceaa4bae"
                            },
                            "uco-observable:url": {
                                "@id": "kb:url-def4ae18-9181-4cce-8f5f-a9aba022b98b"
                            },
                            "uco-observable:referrerUrl": null,
                            "uco-observable:pageTitle": null,
                            "uco-observable:visitCount": 1,
                            "uco-observable:manuallyEnteredCount": {
                                "@type": "xsd:nonNegativeInteger",
                                "@value": "0"
                            },
                            "uco-observable:keywordSearchTerm": null
                        }
                    ]
                }
            ]
        },
        {
            "@id": "kb:File-61082f03-46ed-4bc7-a7c9-571754ffcb60",
            "@type": "uco-observable:File",
            "uco-core:hasFacet": [
                {
                    "@id": "kb:file-facet-5734cd54-aa04-4c70-a0b4-909032e408c1",
                    "@type": "uco-observable:FileFacet",
                    "uco-observable:fileName": "SYSTEM",
                    "uco-observable:filePath": "/Windows/system32/config/SYSTEM",
                    "uco-observable:isDirectory": false
                },
                {
                    "@id": "kb:windows-registry-hive-facet-34c54d87-0ddc-43d5-a185-062da9693e3e",
                    "@type": "uco-observable:WindowsRegistryHiveFacet",
                    "uco-observable:hiveType": "SYSTEM"
                }
            ]
        },
        {
            "@id": "kb:Relationship-d974c54f-60de-46af-b0fd-a19704543785",
            "@type": "uco-observable:ObservableRelationship",
            "uco-core:source": {
                "@id": "kb:WindowsRegistryKey-684af874-4c95-4be9-9c58-3eda29b94443"
            },
            "uco-core:target": {
                "@id": "kb:File-61082f03-46ed-4bc7-a7c9-571754ffcb60"
            },
            "uco-core:kindOfRelationship": "Contained_Within",
            "uco-core:isDirectional": true
        },
        {
            "@id": "kb:WindowsRegistryKey-684af874-4c95-4be9-9c58-3eda29b94443",
            "@type": "uco-observable:WindowsRegistryKey",
            "uco-core:hasFacet": [
                {
                    "@id": "kb:windows-registry-key-facet-840333f7-e6b8-415e-b08e-8b33cc7dcc90",
                    "@type": "uco-observable:WindowsRegistryKeyFacet",
                    "uco-observable:key": "SYSTEM/ControlSet001/Enum/USB/VID_0781&PID_5575/001D7D06CF09ED91D97F1B1B",
                    "uco-observable:modifiedTime": {
                        "@type": "xsd:dateTime",
                        "@value": "2017-02-02T22:38:09.00Z"
                    },
                    "uco-observable:numberOfSubkeys": 2
                }
            ]
        }
    ]
}