Cyber-investigation Analysis Standard Expression (CASE) is a
community-developed evolving standard that provides a structured
(ontology-based) specification for representing information commonly
analyzed and exchanged by people and systems during investigations
involving digital evidence. The power of CASE is that it provides a
common language to support automated normalization, combination and
validation of varied information sources to facilitate analysis and
exploration of investigative questions (who, when, how long, where).
In addition to representing tool results, CASE ensures that analysis
results can be traced back to their source(s), keeping track of when,
where and who used which tools to perform investigative actions on
data sources.
The purpose of these online resources is to provide a foundation for
broader community involvement in defining what to represent and how.