| ### Showing:
Annotations
Attributes
Diagrams
Facets
Instances
Model
Properties
Source
Used by

Element mediaDetails

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Media or Device Metadata: Data about the media or device source to include: connection to collection data, item identity within context of collection, hardware serial number, model number, image hash value. A physical media that may contain one or more files.
Diagram |
Properties |
content | complex
Used by |
Elements | acquisition , domex
Model | dataOwner , personName{0,1} , phoneNumber{0,1} , itemSerialNumber , collectingDeviceDistinctName{0,1} , typeOfComponent , exploitationResultsClassification , deviceImage{0,1} , dispositionOfOriginalSource{0,1} , firmware{0,1} , mediaSize{0,1} , manufacturer{0,1} , modelNumber{0,1} , sourceManufacturer{0,1} , machineSid{0,1} , volumeId{0,1} , processingSite{0,1} , contactInformation{0,1} , toolsOrProcessesUsed{0,1} , typeOfSystemForensicallyPureImageCreated{0,1} , softwareUsedToProcessType{0,1} , versioningOfSoftware{0,1} , explanationOfProcess{0,1} , isDamaged{0,1} , repairsPerformedBy{0,1} , relationshipOfMultipleImagesToSingleDocument{0,1} , numberOfFiles{0,3} , cableReferenceMessageTrafficID{0,1} , activity* , subjectInformation* , file* , usbDeviceReference*
Children | activity , cableReferenceMessageTrafficID , collectingDeviceDistinctName , contactInformation , dataOwner , deviceImage , dispositionOfOriginalSource , explanationOfProcess , exploitationResultsClassification , file , firmware , isDamaged , itemSerialNumber , machineSid , manufacturer , mediaSize , modelNumber , numberOfFiles , personName , phoneNumber , processingSite , relationshipOfMultipleImagesToSingleDocument , repairsPerformedBy , softwareUsedToProcessType , sourceManufacturer , subjectInformation , toolsOrProcessesUsed , typeOfComponent , typeOfSystemForensicallyPureImageCreated , usbDeviceReference , versioningOfSoftware , volumeId
Instance |
    <mediaDetails DESVersion="" SchemaguideSecurityAttributesGroup="" uuid="" xmlns="urn:us:mil:ces:metadata:domex">
      <dataOwner>{1,1}</dataOwner>
      <personName>{0,1}</personName>
      <phoneNumber>{0,1}</phoneNumber>
      <itemSerialNumber>{1,1}</itemSerialNumber>
      <collectingDeviceDistinctName>{0,1}</collectingDeviceDistinctName>
      <typeOfComponent>{1,1}</typeOfComponent>
      <exploitationResultsClassification SchemaguideSecurityAttributesGroup="">{1,1}</exploitationResultsClassification>
      <deviceImage SchemaguideSecurityAttributesGroup="">{0,1}</deviceImage>
      <dispositionOfOriginalSource>{0,1}</dispositionOfOriginalSource>
      <firmware>{0,1}</firmware>
      <mediaSize>{0,1}</mediaSize>
      <manufacturer>{0,1}</manufacturer>
      <modelNumber>{0,1}</modelNumber>
      <sourceManufacturer>{0,1}</sourceManufacturer>
      <machineSid>{0,1}</machineSid>
      <volumeId>{0,1}</volumeId>
      <processingSite>{0,1}</processingSite>
      <contactInformation>{0,1}</contactInformation>
      <toolsOrProcessesUsed>{0,1}</toolsOrProcessesUsed>
      <typeOfSystemForensicallyPureImageCreated>{0,1}</typeOfSystemForensicallyPureImageCreated>
      <softwareUsedToProcessType>{0,1}</softwareUsedToProcessType>
      <versioningOfSoftware>{0,1}</versioningOfSoftware>
      <explanationOfProcess>{0,1}</explanationOfProcess>
      <isDamaged>{0,1}</isDamaged>
      <repairsPerformedBy>{0,1}</repairsPerformedBy>
      <relationshipOfMultipleImagesToSingleDocument>{0,1}</relationshipOfMultipleImagesToSingleDocument>
      <numberOfFiles type="">{0,3}</numberOfFiles>
      <cableReferenceMessageTrafficID>{0,1}</cableReferenceMessageTrafficID>
      <activity>{0,unbounded}</activity>
      <subjectInformation DESVersion="" SchemaguideSecurityAttributesGroup="" uuid="">{0,unbounded}</subjectInformation>
      <file DESVersion="" SchemaguideSecurityAttributesGroup="" uuid="">{0,unbounded}</file>
      <usbDeviceReference foundIn="">{0,unbounded}</usbDeviceReference>
    </mediaDetails>
Attributes |
QName | Type | Use | Annotation
--- | --- | --- | ---
DESVersion | restriction of xs:string | optional | The version number of the specification. This attribute is intended for processing systems to determine the appropriate versions of Schema, Schematron, and CVE values for validation and interpretation of an instance document. If there are multiple of this attribute specified in an instance document, the first one in document order is the one that will apply to the entire document. Document order is defined in https://www.w3.org/TR/xpath-datamodel/#document-order
SchemaguideSecurityAttributesGroup | xsd:NMTOKEN | optional | This attribute is only a placeholder so that all the ISM attributes are not shown in the schemaGuide for every element. If you refer to the documentation of the attribute group it will say what attributes should be here.
uuid | UuidType | optional |
Source |
    <xs:element name="mediaDetails">
      <xs:annotation>
        <xs:documentation>Media or Device Metadata: Data about the media or device source to include: connection to collection data, item identity within context of collection, hardware serial number, model number, image hash value. A physical media that may contain one or more files.</xs:documentation>
      </xs:annotation>
      <xs:complexType>
        <xs:sequence>
          <xs:element name="dataOwner" type="string100">
            <xs:annotation>
              <xs:documentation>Organization that acquires, obtains, collects and/or provides media to national repositories</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="personName" type="string300" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Person Name/Name associated with organization media owner</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="phoneNumber" type="string100" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Phone Number/Telephone number associated with organization media owner</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="itemSerialNumber" type="string100">
            <xs:annotation>
              <xs:documentation>Serial Number of media</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="collectingDeviceDistinctName" type="string100" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Name of device that collected information</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="typeOfComponent" type="string256">
            <xs:annotation>
              <xs:documentation>Derived data or original data (scan of paper versus image of hard drive)</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="exploitationResultsClassification" type="ExploitationResultsClassificationType">
            <xs:annotation>
              <xs:documentation>The cumulative classification that is evaluated and derived upon review by analysts.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <!-- artf14834 - Make deviceImage optional -->
          <xs:element name="deviceImage" type="DeviceImageType" minOccurs="0">
            <xs:annotation>
              <xs:documentation>An image or copy made of a media device</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="dispositionOfOriginalSource" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Location of the original media</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="firmware" type="FirmwareType" minOccurs="0">
            <xs:annotation>
              <xs:documentation>The firmware embedded in the media device.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="mediaSize" type="string50" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Media size as stated on device label, etc.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="manufacturer" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Device manufacturer</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="modelNumber" type="string100" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Device model number</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="sourceManufacturer" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Media manufacturer</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="machineSid" type="string100" minOccurs="0">
            <xs:annotation>
              <xs:documentation>The Machine SID is used to identify a computer on a network under Windows operating system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5 - The identifier authority value 21-3623811015-3361044348-30300820 - domain or local computer value.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="volumeId" type="string100" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Semi-unique number associated with a device when formatted.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="processingSite" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Location where media was first imaged or forensically processed</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="contactInformation" type="string400" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Contact information of who processed media</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="toolsOrProcessesUsed" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Tools/processes used in processing media</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="typeOfSystemForensicallyPureImageCreated" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Type of System where Forensically Pure Image was Created</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="softwareUsedToProcessType" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Software used to process forensically pure image</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="versioningOfSoftware" type="string50" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Versioning of software used to process forensically pure image</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="explanationOfProcess" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Explanation of forensically pure image creation process</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="isDamaged" type="xs:boolean" minOccurs="0">
            <xs:annotation>
              <xs:documentation>A binary flag indicating that a device is damaged</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="repairsPerformedBy" type="string256" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Person Description of repairs performed on damaged device</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="relationshipOfMultipleImagesToSingleDocument" type="string4000" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Relationship of multiple images to single document</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="numberOfFiles" type="NumberOfFilesType" minOccurs="0" maxOccurs="3">
            <xs:annotation>
              <xs:documentation>Number of videos/audio files/pictures on the device.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <xs:element name="cableReferenceMessageTrafficID" type="string100" minOccurs="0">
            <xs:annotation>
              <xs:documentation>Cable/Reference/Message Traffic ID</xs:documentation>
            </xs:annotation>
          </xs:element>
          <!-- Change Request #889 - Add Activity / sub activity elements -->
          <xs:element name="activity" type="ActivityType" minOccurs="0" maxOccurs="unbounded">
            <xs:annotation>
              <xs:documentation>Supports the ability to perform collection, media, and document similarity classification.</xs:documentation>
            </xs:annotation>
          </xs:element>
          <!-- End of Change Request #889 -->
          <xs:element ref="subjectInformation" minOccurs="0" maxOccurs="unbounded"/>
          <xs:element ref="file" minOccurs="0" maxOccurs="unbounded"/>
          <!-- Change Request #529 - Add USB device info -->
          <xs:element name="usbDeviceReference" type="UsbDeviceReferenceType" minOccurs="0" maxOccurs="unbounded"/>
        </xs:sequence>
        <xs:attributeGroup ref="irm:SecurityAttributesGroup"/>
        <xs:attribute name="uuid" type="UuidType" use="optional"/>
        <xs:attribute ref="DESVersion" use="optional"/>
      </xs:complexType>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / dataOwner

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Organization that acquires, obtains, collects and/or provides media to national repositories
Diagram |
Type | string100
Properties |
content | simple
Facets |
maxLength | 100 |
Source |
    <xs:element name="dataOwner" type="string100">
      <xs:annotation>
        <xs:documentation>Organization that acquires, obtains, collects and/or provides media to national repositories</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / personName

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Person Name/Name associated with organization media owner
Diagram |
Type | string300
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 300 |
Source |
    <xs:element name="personName" type="string300" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Person Name/Name associated with organization media owner</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / phoneNumber

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Phone Number/Telephone number associated with organization media owner
Diagram |
Type | string100
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 100 |
Source |
    <xs:element name="phoneNumber" type="string100" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Phone Number/Telephone number associated with organization media owner</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / itemSerialNumber

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Serial Number of media
Diagram |
Type | string100
Properties |
content | simple
Facets |
maxLength | 100 |
Source |
    <xs:element name="itemSerialNumber" type="string100">
      <xs:annotation>
        <xs:documentation>Serial Number of media</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / collectingDeviceDistinctName

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Name of device that collected information
Diagram |
Type | string100
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 100 |
Source |
    <xs:element name="collectingDeviceDistinctName" type="string100" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Name of device that collected information</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / typeOfComponent

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Derived data or original data (scan of paper versus image of hard drive)
Diagram |
Type | string256
Properties |
content | simple
Facets |
maxLength | 256 |
Source |
    <xs:element name="typeOfComponent" type="string256">
      <xs:annotation>
        <xs:documentation>Derived data or original data (scan of paper versus image of hard drive)</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / exploitationResultsClassification

Namespace | urn:us:mil:ces:metadata:domex
Annotations | The cumulative classification that is evaluated and derived upon review by analysts.
Diagram |
Type | ExploitationResultsClassificationType
Properties |
content | complex
Attributes |
QName | Type | Use | Annotation
--- | --- | --- | ---
SchemaguideSecurityAttributesGroup | xsd:NMTOKEN | optional | This attribute is only a placeholder so that all the ISM attributes are not shown in the schemaGuide for every element. If you refer to the documentation of the attribute group it will say what attributes should be here.
Source |
    <xs:element name="exploitationResultsClassification" type="ExploitationResultsClassificationType">
      <xs:annotation>
        <xs:documentation>The cumulative classification that is evaluated and derived upon review by analysts.</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / deviceImage

Namespace | urn:us:mil:ces:metadata:domex
Annotations | An image or copy made of a media device
Diagram |
Type | DeviceImageType
Properties |
content | complex
minOccurs | 0
Model | nameOfDeviceImageFile , mediaType , collectionIDNumber , dateImaged , typeOfComponent , deviceImageResultsClassification , priorityOfComponent , imageHashDigest+ , sourceHashDigest+ , imageSize , imageType , isImageLocked
Children | collectionIDNumber , dateImaged , deviceImageResultsClassification , imageHashDigest , imageSize , imageType , isImageLocked , mediaType , nameOfDeviceImageFile , priorityOfComponent , sourceHashDigest , typeOfComponent
Instance |
    <deviceImage SchemaguideSecurityAttributesGroup="" xmlns="urn:us:mil:ces:metadata:domex">
      <nameOfDeviceImageFile>{1,1}</nameOfDeviceImageFile>
      <mediaType>{1,1}</mediaType>
      <collectionIDNumber>{1,1}</collectionIDNumber>
      <dateImaged>{1,1}</dateImaged>
      <typeOfComponent>{1,1}</typeOfComponent>
      <deviceImageResultsClassification SchemaguideSecurityAttributesGroup="">{1,1}</deviceImageResultsClassification>
      <priorityOfComponent>{1,1}</priorityOfComponent>
      <imageHashDigest type="">{1,unbounded}</imageHashDigest>
      <sourceHashDigest type="">{1,unbounded}</sourceHashDigest>
      <imageSize type="">{1,1}</imageSize>
      <imageType>{1,1}</imageType>
      <isImageLocked>{1,1}</isImageLocked>
    </deviceImage>
Attributes |
QName | Type | Use | Annotation
--- | --- | --- | ---
SchemaguideSecurityAttributesGroup | xsd:NMTOKEN | optional | This attribute is only a placeholder so that all the ISM attributes are not shown in the schemaGuide for every element. If you refer to the documentation of the attribute group it will say what attributes should be here.
Source |
    <xs:element name="deviceImage" type="DeviceImageType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>An image or copy made of a media device</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / dispositionOfOriginalSource

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Location of the original media
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="dispositionOfOriginalSource" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Location of the original media</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / firmware

Namespace | urn:us:mil:ces:metadata:domex
Annotations | The firmware embedded in the media device.
Diagram |
Type | FirmwareType
Properties |
content | complex
minOccurs | 0
Model | manufacturer{0,1} , partNumber{0,1} , versionOrRelease{0,1} , biosDateAndTime{0,1} , actualDateAndTime{0,1}
Children | actualDateAndTime , biosDateAndTime , manufacturer , partNumber , versionOrRelease
Instance |
    <firmware xmlns="urn:us:mil:ces:metadata:domex">
      <manufacturer>{0,1}</manufacturer>
      <partNumber>{0,1}</partNumber>
      <versionOrRelease>{0,1}</versionOrRelease>
      <biosDateAndTime>{0,1}</biosDateAndTime>
      <actualDateAndTime>{0,1}</actualDateAndTime>
    </firmware>
Source |
    <xs:element name="firmware" type="FirmwareType" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The firmware embedded in the media device.</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / mediaSize

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Media size as stated on device label, etc.
Diagram |
Type | string50
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 50 |
Source |
    <xs:element name="mediaSize" type="string50" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Media size as stated on device label, etc.</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / manufacturer

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Device manufacturer
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="manufacturer" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Device manufacturer</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / modelNumber

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Device model number
Diagram |
Type | string100
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 100 |
Source |
    <xs:element name="modelNumber" type="string100" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Device model number</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / sourceManufacturer

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Media manufacturer
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="sourceManufacturer" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Media manufacturer</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / machineSid

Namespace | urn:us:mil:ces:metadata:domex
Annotations | The Machine SID is used to identify a computer on a network under Windows operating system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5 - The identifier authority value 21-3623811015-3361044348-30300820 - domain or local computer value.
Diagram |
Type | string100
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 100 |
Source |
    <xs:element name="machineSid" type="string100" minOccurs="0">
      <xs:annotation>
        <xs:documentation>The Machine SID is used to identify a computer on a network under Windows operating system. The machine SID is stored in the SECURITY registry hive located at SECURITY\SAM\Domains\Account, this key has two values F and V. The V value is a binary value that has the computer SID embedded within it at the end of its data (last 96 bits). The format of these IDs are as follows: SID: S-1-5-21-108503121-1563985344-725345543 S - SID Label 1 - SID Version 5 - The identifier authority value 21-3623811015-3361044348-30300820 - domain or local computer value.</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / volumeId

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Semi-unique number associated with a device when formatted.
Diagram |
Type | string100
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 100 |
Source |
    <xs:element name="volumeId" type="string100" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Semi-unique number associated with a device when formatted.</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / processingSite

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Location where media was first imaged or forensically processed
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="processingSite" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Location where media was first imaged or forensically processed</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / contactInformation

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Contact information of who processed media
Diagram |
Type | string400
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 400 |
Source |
    <xs:element name="contactInformation" type="string400" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Contact information of who processed media</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / toolsOrProcessesUsed

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Tools/processes used in processing media
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="toolsOrProcessesUsed" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Tools/processes used in processing media</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / typeOfSystemForensicallyPureImageCreated

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Type of System where Forensically Pure Image was Created
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="typeOfSystemForensicallyPureImageCreated" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Type of System where Forensically Pure Image was Created</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / softwareUsedToProcessType

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Software used to process forensically pure image
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="softwareUsedToProcessType" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Software used to process forensically pure image</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / versioningOfSoftware

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Versioning of software used to process forensically pure image
Diagram |
Type | string50
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 50 |
Source |
    <xs:element name="versioningOfSoftware" type="string50" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Versioning of software used to process forensically pure image</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / explanationOfProcess

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Explanation of forensically pure image creation process
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="explanationOfProcess" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Explanation of forensically pure image creation process</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / isDamaged

Namespace | urn:us:mil:ces:metadata:domex
Annotations | A binary flag indicating that a device is damaged
Diagram |
Type | xs:boolean
Properties |
content | simple
minOccurs | 0
Source |
    <xs:element name="isDamaged" type="xs:boolean" minOccurs="0">
      <xs:annotation>
        <xs:documentation>A binary flag indicating that a device is damaged</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / repairsPerformedBy

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Person Description of repairs performed on damaged device
Diagram |
Type | string256
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 256 |
Source |
    <xs:element name="repairsPerformedBy" type="string256" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Person Description of repairs performed on damaged device</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / relationshipOfMultipleImagesToSingleDocument

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Relationship of multiple images to single document
Diagram |
Type | string4000
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 4000 |
Source |
    <xs:element name="relationshipOfMultipleImagesToSingleDocument" type="string4000" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Relationship of multiple images to single document</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / numberOfFiles

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Number of videos/audio files/pictures on the device.
Diagram |
Type | NumberOfFilesType
Properties |
content | complex
minOccurs | 0
maxOccurs | 3
Attributes |
QName | Type | Use |
--- | --- | --- | ---
type | CVEnumDOMEXNumberOfFilesTypeType | required |
Source |
    <xs:element name="numberOfFiles" type="NumberOfFilesType" minOccurs="0" maxOccurs="3">
      <xs:annotation>
        <xs:documentation>Number of videos/audio files/pictures on the device.</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / cableReferenceMessageTrafficID

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Cable/Reference/Message Traffic ID
Diagram |
Type | string100
Properties |
content | simple
minOccurs | 0
Facets |
maxLength | 100 |
Source |
    <xs:element name="cableReferenceMessageTrafficID" type="string100" minOccurs="0">
      <xs:annotation>
        <xs:documentation>Cable/Reference/Message Traffic ID</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / activity

Namespace | urn:us:mil:ces:metadata:domex
Annotations | Supports the ability to perform collection, media, and document similarity classification.
Diagram |
Type | ActivityType
Properties |
content | complex
minOccurs | 0
maxOccurs | unbounded
Model | primaryActivity , subActivity*
Children | primaryActivity , subActivity
Instance |
    <activity xmlns="urn:us:mil:ces:metadata:domex">
      <primaryActivity>{1,1}</primaryActivity>
      <subActivity>{0,unbounded}</subActivity>
    </activity>
Source |
    <xs:element name="activity" type="ActivityType" minOccurs="0" maxOccurs="unbounded">
      <xs:annotation>
        <xs:documentation>Supports the ability to perform collection, media, and document similarity classification.</xs:documentation>
      </xs:annotation>
    </xs:element>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Element mediaDetails / usbDeviceReference

Namespace | urn:us:mil:ces:metadata:domex
Diagram |
Type | UsbDeviceReferenceType
Properties |
content | complex
minOccurs | 0
maxOccurs | unbounded
Model | serialNumber , vendorId , vendorName , productId , productName , interfaceId{0,1} , interfaceName{0,1} , version , firstConnectTime , rebootConnectTime , lastConnectTime , volumeGuid , softwareVersion , driveLetter
Children | driveLetter , firstConnectTime , interfaceId , interfaceName , lastConnectTime , productId , productName , rebootConnectTime , serialNumber , softwareVersion , vendorId , vendorName , version , volumeGuid
Instance |
    <usbDeviceReference foundIn="" xmlns="urn:us:mil:ces:metadata:domex">
      <serialNumber>{1,1}</serialNumber>
      <vendorId>{1,1}</vendorId>
      <vendorName>{1,1}</vendorName>
      <productId>{1,1}</productId>
      <productName>{1,1}</productName>
      <interfaceId>{0,1}</interfaceId>
      <interfaceName>{0,1}</interfaceName>
      <version>{1,1}</version>
      <firstConnectTime>{1,1}</firstConnectTime>
      <rebootConnectTime>{1,1}</rebootConnectTime>
      <lastConnectTime>{1,1}</lastConnectTime>
      <volumeGuid>{1,1}</volumeGuid>
      <softwareVersion>{1,1}</softwareVersion>
      <driveLetter>{1,1}</driveLetter>
    </usbDeviceReference>
Attributes |
QName | Type | Use |
--- | --- | --- | ---
foundIn | xs:string | optional |
Source |
    <xs:element name="usbDeviceReference" type="UsbDeviceReferenceType" minOccurs="0" maxOccurs="unbounded"/>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

Attribute mediaDetails / @uuid

Namespace | urn:us:mil:ces:metadata:domex
Type | UuidType
Properties |
use | optional
Facets |
pattern | [0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{16} |
Used by |
Element | mediaDetails
Source |
    <xs:attribute name="uuid" type="UuidType" use="optional"/>
Schema location | DOMEX.xsd Copy and paste this link to your file browser, clicking the link MAY open in the browser. Opening in an XML aware editor is best.

## This document has been approved for Public Release by the Office of the Director of National Intelligence. See Distribution Notice for details. Click Here