Media or Device Metadata: Data about the media or device source to
include: connection to collection data, item identity within context of collection,
hardware serial number, model number, image hash value. A physical media that
may
contain one or more files.
The version number of the
specification. This attribute is intended for processing systems to determine
the appropriate versions of Schema, Schematron, and CVE values for validation
and interpretation of an instance document.
If there are multiple of
this attribute specified in an instance document, the first one in document
order is the one that will apply to the entire document. Document order is
defined in https://www.w3.org/TR/xpath-datamodel/#document-order
<xs:element name="mediaDetails"><xs:annotation><xs:documentation>Media or Device Metadata: Data about the media or device source to include: connection to collection data, item identity within context of collection, hardware serial number, model number, image hash value. A physical media that may contain one or more files.</xs:documentation></xs:annotation><xs:complexType><xs:sequence><xs:element name="dataOwner" type="string100"><xs:annotation><xs:documentation>Organization that acquires, obtains, collects and/or provides media to national repositories</xs:documentation></xs:annotation></xs:element><xs:element name="personName" type="string300" minOccurs="0"><xs:annotation><xs:documentation>Person Name/Name associated with organization media owner</xs:documentation></xs:annotation></xs:element><xs:element name="phoneNumber" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Phone Number/Telephone number associated with organization media owner</xs:documentation></xs:annotation></xs:element><xs:element name="itemSerialNumber" type="string100"><xs:annotation><xs:documentation>Serial Number of media</xs:documentation></xs:annotation></xs:element><xs:element name="collectingDeviceDistinctName" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Name of device that collected information</xs:documentation></xs:annotation></xs:element><xs:element name="typeOfComponent" type="string256"><xs:annotation><xs:documentation>Derived data or original data (scan of paper versus image of hard drive)</xs:documentation></xs:annotation></xs:element><xs:element name="exploitationResultsClassification" type="ExploitationResultsClassificationType"><xs:annotation><xs:documentation>The cumulative classification that is evaluated and derived upon review by analysts.</xs:documentation></xs:annotation></xs:element><!-- artf14834 - Make deviceImage optional --><xs:element name="deviceImage" type="DeviceImageType" minOccurs="0"><xs:annotation><xs:documentation>An image or copy made of a media device</xs:documentation></xs:annotation></xs:element><xs:element name="dispositionOfOriginalSource" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location of the original media</xs:documentation></xs:annotation></xs:element><xs:element name="firmware" type="FirmwareType" minOccurs="0"><xs:annotation><xs:documentation>The firmware embedded in the media device.</xs:documentation></xs:annotation></xs:element><xs:element name="mediaSize" type="string50" minOccurs="0"><xs:annotation><xs:documentation>Media size as stated on device label, etc.</xs:documentation></xs:annotation></xs:element><xs:element name="manufacturer" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Device manufacturer</xs:documentation></xs:annotation></xs:element><xs:element name="modelNumber" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Device model number</xs:documentation></xs:annotation></xs:element><xs:element name="sourceManufacturer" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Media manufacturer</xs:documentation></xs:annotation></xs:element><xs:element name="machineSid" type="string100" minOccurs="0"><xs:annotation><xs:documentation>The Machine SID is used to identify a computer on a network under Windows operating system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5 - The identifier authority value 21-3623811015-3361044348-30300820 - domain or local computer value.</xs:documentation></xs:annotation></xs:element><xs:element name="volumeId" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Semi-unique number associated with a device when formatted.</xs:documentation></xs:annotation></xs:element><xs:element name="processingSite" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location where media was first imaged or forensically processed</xs:documentation></xs:annotation></xs:element><xs:element name="contactInformation" type="string400" minOccurs="0"><xs:annotation><xs:documentation>Contact information of who processed media</xs:documentation></xs:annotation></xs:element><xs:element name="toolsOrProcessesUsed" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Tools/processes used in processing media</xs:documentation></xs:annotation></xs:element><xs:element name="typeOfSystemForensicallyPureImageCreated" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Type of System where Forensically Pure Image was Created</xs:documentation></xs:annotation></xs:element><xs:element name="softwareUsedToProcessType" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Software used to process forensically pure image</xs:documentation></xs:annotation></xs:element><xs:element name="versioningOfSoftware" type="string50" minOccurs="0"><xs:annotation><xs:documentation>Versioning of software used to process forensically pure image</xs:documentation></xs:annotation></xs:element><xs:element name="explanationOfProcess" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Explanation of forensically pure image creation process</xs:documentation></xs:annotation></xs:element><xs:element name="isDamaged" type="xs:boolean" minOccurs="0"><xs:annotation><xs:documentation>A binary flag indicating that a device is damaged</xs:documentation></xs:annotation></xs:element><xs:element name="repairsPerformedBy" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Person Description of repairs performed on damaged device</xs:documentation></xs:annotation></xs:element><xs:element name="relationshipOfMultipleImagesToSingleDocument" type="string4000" minOccurs="0"><xs:annotation><xs:documentation>Relationship of multiple images to single document</xs:documentation></xs:annotation></xs:element><xs:element name="numberOfFiles" type="NumberOfFilesType" minOccurs="0" maxOccurs="3"><xs:annotation><xs:documentation>Number of videos/audio files/pictures on the device.</xs:documentation></xs:annotation></xs:element><xs:element name="cableReferenceMessageTrafficID" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Cable/Reference/Message Traffic ID</xs:documentation></xs:annotation></xs:element><!-- Change Request #889 - Add Activity / sub activity elements --><xs:element name="activity" type="ActivityType" minOccurs="0" maxOccurs="unbounded"><xs:annotation><xs:documentation>Supports the ability to perform collection, media, and document similarity classification.</xs:documentation></xs:annotation></xs:element><!-- End of Change Request #889 --><xs:element ref="subjectInformation" minOccurs="0" maxOccurs="unbounded"/><xs:element ref="file" minOccurs="0" maxOccurs="unbounded"/><!-- Change Request #529 - Add USB device info --><xs:element name="usbDeviceReference" type="UsbDeviceReferenceType" minOccurs="0" maxOccurs="unbounded"/></xs:sequence><xs:attributeGroup ref="irm:SecurityAttributesGroup"/><xs:attribute name="uuid" type="UuidType" use="optional"/><xs:attribute ref="DESVersion" use="optional"/></xs:complexType></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="dataOwner" type="string100"><xs:annotation><xs:documentation>Organization that acquires, obtains, collects and/or provides media to national repositories</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="personName" type="string300" minOccurs="0"><xs:annotation><xs:documentation>Person Name/Name associated with organization media owner</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="phoneNumber" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Phone Number/Telephone number associated with organization media owner</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="itemSerialNumber" type="string100"><xs:annotation><xs:documentation>Serial Number of media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / collectingDeviceDistinctName
<xs:element name="collectingDeviceDistinctName" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Name of device that collected information</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="typeOfComponent" type="string256"><xs:annotation><xs:documentation>Derived data or original data (scan of paper versus image of hard drive)</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / exploitationResultsClassification
Namespace
urn:us:mil:ces:metadata:domex
Annotations
The cumulative classification that is evaluated and
derived upon review by analysts.
<xs:element name="exploitationResultsClassification" type="ExploitationResultsClassificationType"><xs:annotation><xs:documentation>The cumulative classification that is evaluated and derived upon review by analysts.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="deviceImage" type="DeviceImageType" minOccurs="0"><xs:annotation><xs:documentation>An image or copy made of a media device</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / dispositionOfOriginalSource
<xs:element name="dispositionOfOriginalSource" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location of the original media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="firmware" type="FirmwareType" minOccurs="0"><xs:annotation><xs:documentation>The firmware embedded in the media device.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
The Machine SID is used to identify a computer on a
network under Windows operating system. The machine SID is stored in the
SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key
has two values F and V. The V value is a binary value that has the
computer SID embedded within it at the end of its data (last 96 bits).
The format of these IDs are as follows: SID:
S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5
- The identifier authority value 21-3623811015-3361044348-30300820 -
domain or local computer value.
<xs:element name="machineSid" type="string100" minOccurs="0"><xs:annotation><xs:documentation>The Machine SID is used to identify a computer on a network under Windows operating system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5 - The identifier authority value 21-3623811015-3361044348-30300820 - domain or local computer value.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="volumeId" type="string100" minOccurs="0"><xs:annotation><xs:documentation>Semi-unique number associated with a device when formatted.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="processingSite" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Location where media was first imaged or forensically processed</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="contactInformation" type="string400" minOccurs="0"><xs:annotation><xs:documentation>Contact information of who processed media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="toolsOrProcessesUsed" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Tools/processes used in processing media</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / typeOfSystemForensicallyPureImageCreated
Namespace
urn:us:mil:ces:metadata:domex
Annotations
Type of System where Forensically Pure Image was Created
<xs:element name="typeOfSystemForensicallyPureImageCreated" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Type of System where Forensically Pure Image was Created</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="softwareUsedToProcessType" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Software used to process forensically pure image</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="versioningOfSoftware" type="string50" minOccurs="0"><xs:annotation><xs:documentation>Versioning of software used to process forensically pure image</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="explanationOfProcess" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Explanation of forensically pure image creation process</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="isDamaged" type="xs:boolean" minOccurs="0"><xs:annotation><xs:documentation>A binary flag indicating that a device is damaged</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="repairsPerformedBy" type="string256" minOccurs="0"><xs:annotation><xs:documentation>Person Description of repairs performed on damaged device</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / relationshipOfMultipleImagesToSingleDocument
Namespace
urn:us:mil:ces:metadata:domex
Annotations
Relationship of multiple images to single document
<xs:element name="relationshipOfMultipleImagesToSingleDocument" type="string4000" minOccurs="0"><xs:annotation><xs:documentation>Relationship of multiple images to single document</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
<xs:element name="numberOfFiles" type="NumberOfFilesType" minOccurs="0" maxOccurs="3"><xs:annotation><xs:documentation>Number of videos/audio files/pictures on the device.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
Element mediaDetails / cableReferenceMessageTrafficID
<xs:element name="activity" type="ActivityType" minOccurs="0" maxOccurs="unbounded"><xs:annotation><xs:documentation>Supports the ability to perform collection, media, and document similarity classification.</xs:documentation></xs:annotation></xs:element>
Schema location
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.
This document has been approved for Public Release by the Office of the Director of National Intelligence. See Distribution Notice for details.
Click Here