Media or Device Metadata: Data about the media or device source to include: connection
to collection data, item identity within context of collection, hardware serial number,
model number, image hash value. A physical media that may contain one or more files.
This attribute is only a placeholder so that all the ISM attributes are not shown
in the schemaGuide for every element. If you refer to the documentation of the
attribute group it will say what attributes should be here.
<xs:element name="mediaDetails"><xs:annotation><xs:documentation>Media or Device Metadata: Data about the media or device source to include: connection to collection data, item identity within context of collection, hardware serial number, model number, image hash value. A physical media that may contain one or more files.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element name="dataOwner" type="string100"><xs:annotation><xs:documentation>Organization that acquires, obtains, collects and/or provides media to national repositories</xs:documentation></xs:annotation></xs:element><xs:element name="personName" type="string300" minOccurs="0"><xs:annotation><xs:documentation>Person Name/Name associated with organization media owner</xs:documentation></xs:annotation></xs:element><xs:element name="phoneNumber" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Phone Number/Telephone number associated with organization media owner</xs:documentation></xs:annotation></xs:element><xs:element name="itemSerialNumber" type="string100"><xs:annotation><xs:documentation>Serial Number of media</xs:documentation></xs:annotation></xs:element><xs:element name="collectingDeviceDistinctName" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Name of device that collected information</xs:documentation></xs:annotation></xs:element><xs:element name="typeOfComponent" type="string256"><xs:annotation><xs:documentation>Derived data or original data (scan of paper versus image of hard drive)</xs:documentation></xs:annotation></xs:element><xs:element name="exploitationResultsClassification" type="ExploitationResultsClassificationType"><xs:annotation><xs:documentation>The cumulative classification that is evaluated and derived upon review by analysts.</xs:documentation></xs:annotation></xs:element><!-- artf14834 - Make deviceImage optional --><xs:element name="deviceImage" type="DeviceImageType" minOccurs="0"><xs:annotation><xs:documentation>An image or copy made of a media device</xs:documentation></xs:annotation></xs:element><xs:element name="dispositionOfOriginalSource" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location of the original media</xs:documentation></xs:annotation></xs:element><xs:element name="firmware" type="FirmwareType" minOccurs="0"><xs:annotation><xs:documentation>The firmware embedded in the media device.</xs:documentation></xs:annotation></xs:element><xs:element name="mediaSize" type="string50" minOccurs="0"><xs:annotation><xs:documentation>Media size as stated on device label, etc.</xs:documentation></xs:annotation></xs:element><xs:element name="manufacturer" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Device manufacturer</xs:documentation></xs:annotation></xs:element><xs:element name="modelNumber" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Device model number</xs:documentation></xs:annotation></xs:element><xs:element name="sourceManufacturer" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Media manufacturer</xs:documentation></xs:annotation></xs:element><xs:element name="machineSid" type="string100" minOccurs="0"><xs:annotation><xs:documentation>The Machine SID is used to identify a computer on a network under Windows operating system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5 - The identifier authority value 21-3623811015-3361044348-30300820 - domain or local computer value.</xs:documentation></xs:annotation></xs:element><xs:element name="volumeId" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Semi-unique number associated with a device when formatted.</xs:documentation></xs:annotation></xs:element><xs:element name="processingSite" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location where media was first imaged or forensically processed</xs:documentation></xs:annotation></xs:element><xs:element name="contactInformation" type="string400" minOccurs="0"><xs:annotation><xs:documentation>Contact information of who processed media</xs:documentation></xs:annotation></xs:element><xs:element name="toolsOrProcessesUsed" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Tools/processes used in processing media</xs:documentation></xs:annotation></xs:element><xs:element name="typeOfSystemForensicallyPureImageCreated" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Type of System where Forensically Pure Image was Created</xs:documentation></xs:annotation></xs:element><xs:element name="softwareUsedToProcessType" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Software used to process forensically pure image</xs:documentation></xs:annotation></xs:element><xs:element name="versioningOfSoftware" type="string50" minOccurs="0"><xs:annotation><xs:documentation>Versioning of software used to process forensically pure image</xs:documentation></xs:annotation></xs:element><xs:element name="explanationOfProcess" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Explanation of forensically pure image creation process</xs:documentation></xs:annotation></xs:element><xs:element name="isDamaged" type="xs:boolean" minOccurs="0"><xs:annotation><xs:documentation>A binary flag indicating that a device is damaged</xs:documentation></xs:annotation></xs:element><xs:element name="repairsPerformedBy" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Person Description of repairs performed on damaged device</xs:documentation></xs:annotation></xs:element><xs:element name="relationshipOfMultipleImagesToSingleDocument" type="string4000" minOccurs="0"><xs:annotation><xs:documentation>Relationship of multiple images to single document</xs:documentation></xs:annotation></xs:element><xs:element name="numberOfFiles" type="NumberOfFilesType" minOccurs="0" maxOccurs="3"><xs:annotation><xs:documentation>Number of videos/audio files/pictures on the device.</xs:documentation></xs:annotation></xs:element><xs:element name="cableReferenceMessageTrafficID" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Cable/Reference/Message Traffic ID</xs:documentation></xs:annotation></xs:element><!-- Change Request #889 - Add Activity / sub activity elements --><xs:element name="activity" type="ActivityType" minOccurs="0" maxOccurs="unbounded"><xs:annotation><xs:documentation>Supports the ability to perform collection, media, and document similarity classification.</xs:documentation></xs:annotation></xs:element><!-- End of Change Request #889 --><xs:element ref="subjectInformation" minOccurs="0" maxOccurs="unbounded"/><xs:element ref="file" minOccurs="0" maxOccurs="unbounded"/><!-- Change Request #529 - Add USB device info --><xs:element name="usbDeviceReference" type="UsbDeviceReferenceType" minOccurs="0" maxOccurs="unbounded"/></xs:sequence><xs:attributeGroup ref="ddms:SecurityAttributesGroup"/><xs:attribute name="uuid" type="UuidType" use="optional"/></xs:complexType></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="dataOwner" type="string100"><xs:annotation><xs:documentation>Organization that acquires, obtains, collects and/or provides media to national repositories</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="personName" type="string300" minOccurs="0"><xs:annotation><xs:documentation>Person Name/Name associated with organization media owner</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="phoneNumber" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Phone Number/Telephone number associated with organization media owner</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="itemSerialNumber" type="string100"><xs:annotation><xs:documentation>Serial Number of media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / collectingDeviceDistinctName
<xs:element name="collectingDeviceDistinctName" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Name of device that collected information</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="typeOfComponent" type="string256"><xs:annotation><xs:documentation>Derived data or original data (scan of paper versus image of hard drive)</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / exploitationResultsClassification
Namespace
urn:us:mil:ces:metadata:domex
Annotations
The cumulative classification that is evaluated and derived upon review by
analysts.
This attribute is only a placeholder so that all the ISM attributes are not shown
in the schemaGuide for every element. If you refer to the documentation of the
attribute group it will say what attributes should be here.
Source
<xs:element name="exploitationResultsClassification" type="ExploitationResultsClassificationType"><xs:annotation><xs:documentation>The cumulative classification that is evaluated and derived upon review by analysts.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
This attribute is only a placeholder so that all the ISM attributes are not shown
in the schemaGuide for every element. If you refer to the documentation of the
attribute group it will say what attributes should be here.
Source
<xs:element name="deviceImage" type="DeviceImageType" minOccurs="0"><xs:annotation><xs:documentation>An image or copy made of a media device</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / dispositionOfOriginalSource
<xs:element name="dispositionOfOriginalSource" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location of the original media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="firmware" type="FirmwareType" minOccurs="0"><xs:annotation><xs:documentation>The firmware embedded in the media device.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
The Machine SID is used to identify a computer on a network under Windows operating
system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account,
this key has two values F and V. The V value is a binary value that has the computer
SID embedded within it at the end of its data
(last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543
S - SID Label
1 - SID Version
5 - The identifier authority value
21-3623811015-3361044348-30300820 - domain or local computer value.
<xs:element name="machineSid" type="string100" minOccurs="0"><xs:annotation><xs:documentation>The Machine SID is used to identify a computer on a network under Windows operating system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5 - The identifier authority value 21-3623811015-3361044348-30300820 - domain or local computer value.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="volumeId" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Semi-unique number associated with a device when formatted.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="processingSite" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location where media was first imaged or forensically processed</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="contactInformation" type="string400" minOccurs="0"><xs:annotation><xs:documentation>Contact information of who processed media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="toolsOrProcessesUsed" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Tools/processes used in processing media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / typeOfSystemForensicallyPureImageCreated
Namespace
urn:us:mil:ces:metadata:domex
Annotations
Type of System where Forensically Pure Image was Created
<xs:element name="typeOfSystemForensicallyPureImageCreated" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Type of System where Forensically Pure Image was Created</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="softwareUsedToProcessType" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Software used to process forensically pure image</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="versioningOfSoftware" type="string50" minOccurs="0"><xs:annotation><xs:documentation>Versioning of software used to process forensically pure image</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="explanationOfProcess" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Explanation of forensically pure image creation process</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="isDamaged" type="xs:boolean" minOccurs="0"><xs:annotation><xs:documentation>A binary flag indicating that a device is damaged</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="repairsPerformedBy" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Person Description of repairs performed on damaged device</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / relationshipOfMultipleImagesToSingleDocument
Namespace
urn:us:mil:ces:metadata:domex
Annotations
Relationship of multiple images to single document
<xs:element name="relationshipOfMultipleImagesToSingleDocument" type="string4000" minOccurs="0"><xs:annotation><xs:documentation>Relationship of multiple images to single document</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="numberOfFiles" type="NumberOfFilesType" minOccurs="0" maxOccurs="3"><xs:annotation><xs:documentation>Number of videos/audio files/pictures on the device.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / cableReferenceMessageTrafficID
<xs:element name="activity" type="ActivityType" minOccurs="0" maxOccurs="unbounded"><xs:annotation><xs:documentation>Supports the ability to perform collection, media, and document similarity classification.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
This document has been approved for Public Release by the Office of the Director of National Intelligence. See Distribution Notice for details.
Click Here