Hardware Duplicator

Logicube Falcon Report Example

Forensic Duplication of Storage Media

This example represents the audit log output by a hardware duplicator (Logicube Falcon) used to create a forensic image of a hard drive. This data is from a fictitious multi-part investigation developed as part of the EVIDENCE2-eCODEX project.

The JSON-LD data on this page are available combined in the file [`hardware_duplicator.json`](hardware_duplicator.json).

CASE INVESTIGATION CONTEXT

The first part of representing information in CASE is to provide the context, including the header map (CASE/UCO IRIs), investigation details, those involved, and tool(s) used.

{
    "@context": {
        "kb": "http://example.org/kb/",
        "@vocab": "http://example.org/ontology/local#",
        "case-investigation": "https://ontology.caseontology.org/case/investigation/",
        "drafting": "http://example.org/ontology/drafting/",
        "rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
        "rdfs": "http://www.w3.org/2000/01/rdf-schema#",
        "uco-action": "https://ontology.unifiedcyberontology.org/uco/action/",
        "uco-configuration": "https://ontology.unifiedcyberontology.org/uco/configuration/",
        "uco-core": "https://ontology.unifiedcyberontology.org/uco/core/",
        "uco-identity": "https://ontology.unifiedcyberontology.org/uco/identity/",
        "uco-location": "https://ontology.unifiedcyberontology.org/uco/location/",
        "uco-observable": "https://ontology.unifiedcyberontology.org/uco/observable/",
        "uco-role": "https://ontology.unifiedcyberontology.org/uco/role/",
        "uco-tool": "https://ontology.unifiedcyberontology.org/uco/tool/",
        "uco-types": "https://ontology.unifiedcyberontology.org/uco/types/",
        "uco-vocabulary": "https://ontology.unifiedcyberontology.org/uco/vocabulary/",
        "xsd": "http://www.w3.org/2001/XMLSchema#"
    },
    "@graph": [
        {
            "@id": "kb:bundle-5db141fc-597b-4771-bea5-b9605292d2ed",
            "@type": "uco-core:Bundle",
            "uco-core:description": "HARD DISK DA 1TB CONTENUTO NEL PC MARCA ACER DENOMINATO R14_ACER",
            "uco-core:object": [
                {
                    "@id": "kb:investigation-e2c24473-63fa-4122-83ee-868325bdd5e8",
                    "@type": "case-investigation:Investigation",
                    "uco-core:name": "PP 1234_18_21",
                    "case-investigation:focus": "Child solicitation",
                    "uco-core:description": "Hard drive acquired as evidence.",
                    "rdfs:comment": "TODO - uco-core:object to get longer list of IRIs.",
                    "uco-core:object": [
                        {
                            "@id": "kb:disk-e598c1b3-f76d-4c27-b592-49bfdbf23d11"
                        }
                    ]
                },
                {
                    "@id": "kb:identity-c5bb09c3-3612-4bf2-b165-6f12d0e3c6af",
                    "@type": "uco-identity:Organization",
                    "uco-core:name": "REALITY NET"
                },
                {
                    "@id": "kb:role-856975ce-3c25-49c3-b6eb-28d1e929f915",
                    "@type": "uco-role:Role",
                    "uco-core:name": "Forensic Expert"
                },
                {
                    "@id": "kb:relationship-d5b4a1e1-0e25-4257-81f7-19febc86ded1",
                    "@type": "uco-core:Relationship",
                    "uco-core:source": {
                        "@id": "kb:identity-c5bb09c3-3612-4bf2-b165-6f12d0e3c6af"
                    },
                    "uco-core:target": {
                        "@id": "kb:role-856975ce-3c25-49c3-b6eb-28d1e929f915"
                    },
                    "uco-core:kindOfRelationship": "Has_Role",
                    "uco-core:isDirectional": true
                },
                {
                    "@id": "kb:organization-637dee9d-145d-45e7-b6f8-7ffdf0d4bf4f",
                    "@type": "uco-identity:Organization",
                    "uco-core:name": "Falcon"
                },
                {
                    "@id": "kb:ConfiguredTool-58f07c30-ae20-4587-9bb8-1a5299821e57",
                    "@type": "uco-tool:ConfiguredTool",
                    "uco-core:name": "Logicube",
                    "uco-tool:toolType": "acquisition/duplication",
                    "uco-tool:creator": {
                        "@id": "kb:organization-637dee9d-145d-45e7-b6f8-7ffdf0d4bf4f"
                    },
                    "uco-tool:version": "3.2u1",
                    "drafting:toolIdentifier": "134090",
                    "uco-configuration:usesConfiguration": {
                        "@id": "kb:Configuration-2afbfbb1-b4d6-4ad5-9691-ff09b9f6eebe",
                        "@type": "uco-configuration:Configuration",
                        "uco-configuration:configurationEntry": [
                            {
                                "@id": "kb:configuration-entry-7871463a-558f-439b-a883-7715c0c7f098",
                                "@type": "uco-configuration:ConfigurationEntry",
                                "uco-configuration:itemName": "Mode",
                                "uco-configuration:itemValue": "DriveToFile"
                            },
                            {
                                "@id": "kb:configuration-entry-cc729420-2155-43d9-ade5-15c146eea55d",
                                "@type": "uco-configuration:ConfigurationEntry",
                                "uco-configuration:itemName": "Method",
                                "uco-configuration:itemValue": "E01Capture"
                            },
                            {
                                "@id": "kb:configuration-entry-d29f59be-8fe3-4ecf-a8ae-4f975e09b5eb",
                                "@type": "uco-configuration:ConfigurationEntry",
                                "uco-configuration:itemName": "Hash",
                                "uco-configuration:itemValue": "SHA-1+MD5"
                            },
                            {
                                "@id": "kb:configuration-entry-d4202748-bd26-425f-add1-c31d16b64f0a",
                                "@type": "uco-configuration:ConfigurationEntry",
                                "uco-configuration:itemName": "SegmentSize",
                                "uco-configuration:itemValue": "4GB"
                            }
                        ]
                    }
                }
            ]
        }
    ]
}

NOTE: Update Configuration settings to relationship

EVIDENTIAL ITEM

Representing the hard drive being acquired and its provenance record.

@HARDWARE_DUPLICATOR_EVIDENTIAL_ITEM.JSON@

PARTITION STRUCTURE

Representing the partition structure of the evidential hard drive as reported by the Logicube Falcon.

[
    {
        "@id": "kb:diskpartition-6f643033-9a10-4519-af98-a0902690b9a9",
        "@type": "uco-observable:DiskPartition",
        "uco-core:hasFacet": [
            {
                "@id": "kb:disk-partition-facet-1fc828ec-77b6-44d4-8810-35d4c7875699",
                "@type": "uco-observable:DiskPartitionFacet",
                "uco-observable:diskPartitionType": "FAT32",
                "uco-observable:partitionID": "1",
                "uco-observable:partitionOffset": 1048576,
                "uco-observable:partitionLength": 104857600
            }
        ]
    },
    {
        "@id": "kb:relationship-52aa42a6-8d79-450d-9236-bc76d67840ec",
        "@type": "uco-observable:ObservableRelationship",
        "uco-core:source": {
            "@id": "kb:diskpartition-6f643033-9a10-4519-af98-a0902690b9a9"
        },
        "uco-core:target": {
            "@id": "kb:disk-e598c1b3-f76d-4c27-b592-49bfdbf23d11"
        },
        "uco-core:kindOfRelationship": "Contained_Within",
        "uco-core:isDirectional": true
    },
    {
        "@id": "kb:diskpartition-820d247d-3016-49a0-82ca-705dc9b70254",
        "@type": "uco-observable:DiskPartition",
        "uco-core:hasFacet": [
            {
                "@id": "kb:disk-partition-facet-177cecb7-f2cb-44be-b643-672650383865",
                "@type": "uco-observable:DiskPartitionFacet",
                "uco-observable:diskPartitionType": "unknown",
                "uco-observable:partitionID": "2",
                "uco-observable:partitionOffset": 105906176,
                "uco-observable:partitionLength": 16777216
            }
        ]
    },
    {
        "@id": "kb:relationship-fb44d09e-2ada-44e8-9c2e-70fe71202652",
        "@type": "uco-observable:ObservableRelationship",
        "uco-core:source": {
            "@id": "kb:diskpartition-820d247d-3016-49a0-82ca-705dc9b70254"
        },
        "uco-core:target": {
            "@id": "kb:disk-e598c1b3-f76d-4c27-b592-49bfdbf23d11"
        },
        "uco-core:kindOfRelationship": "Contained_Within",
        "uco-core:isDirectional": true
    },
    {
        "@id": "kb:diskpartition-e19c38f5-692b-4336-8d6d-fdc34a51b00e",
        "@type": "uco-observable:DiskPartition",
        "uco-core:hasFacet": [
            {
                "@id": "kb:disk-partition-facet-4a13df3b-6a69-4d0b-85f1-a0798ebf2c28",
                "@type": "uco-observable:DiskPartitionFacet",
                "uco-observable:diskPartitionType": "ntfs",
                "uco-observable:partitionID": "3",
                "uco-observable:partitionOffset": 122683392,
                "uco-observable:partitionLength": 505077039104
            }
        ]
    },
    {
        "@id": "kb:relationship-c34de1cd-daa3-4381-a4c6-7a05005cb3d3",
        "@type": "uco-observable:ObservableRelationship",
        "uco-core:source": {
            "@id": "kb:diskpartition-e19c38f5-692b-4336-8d6d-fdc34a51b00e"
        },
        "uco-core:target": {
            "@id": "kb:disk-e598c1b3-f76d-4c27-b592-49bfdbf23d11"
        },
        "uco-core:kindOfRelationship": "Contained_Within",
        "uco-core:isDirectional": true
    },
    {
        "@id": "kb:diskpartition-a193840c-7b8b-4ede-a5a7-e4464b30b9c7",
        "@type": "uco-observable:DiskPartition",
        "uco-core:hasFacet": [
            {
                "@id": "kb:disk-partition-facet-9dadb9d9-10ef-44ab-aa4b-1a96701e7b34",
                "@type": "uco-observable:DiskPartitionFacet",
                "uco-observable:diskPartitionType": "ntfs",
                "uco-observable:partitionID": "4",
                "uco-observable:partitionOffset": 505199722496,
                "uco-observable:partitionLength": 493928579072
            }
        ]
    },
    {
        "@id": "kb:relationship-d348200b-e180-40b8-8617-2319f5fe6ffa",
        "@type": "uco-observable:ObservableRelationship",
        "uco-core:source": {
            "@id": "kb:diskpartition-a193840c-7b8b-4ede-a5a7-e4464b30b9c7"
        },
        "uco-core:target": {
            "@id": "kb:disk-e598c1b3-f76d-4c27-b592-49bfdbf23d11"
        },
        "uco-core:kindOfRelationship": "Contained_Within",
        "uco-core:isDirectional": true
    },
    {
        "@id": "kb:diskpartition-f90a3ee1-2cde-439f-9768-23c67aafe347",
        "@type": "uco-observable:DiskPartition",
        "uco-core:hasFacet": [
            {
                "@id": "kb:disk-partition-facet-c6cc1366-30f5-46f0-9537-64ed9e9e85bc",
                "@type": "uco-observable:DiskPartitionFacet",
                "uco-observable:diskPartitionType": "ntfs",
                "uco-observable:partitionID": "5",
                "uco-observable:partitionOffset": 999129350144,
                "uco-observable:partitionLength": 1073741824
            }
        ]
    },
    {
        "@id": "kb:relationship-ff010f40-7f95-498a-9cde-14fa8de501b9",
        "@type": "uco-observable:ObservableRelationship",
        "uco-core:source": {
            "@id": "kb:diskpartition-f90a3ee1-2cde-439f-9768-23c67aafe347"
        },
        "uco-core:target": {
            "@id": "kb:disk-e598c1b3-f76d-4c27-b592-49bfdbf23d11"
        },
        "uco-core:kindOfRelationship": "Contained_Within",
        "uco-core:isDirectional": true
    }
]

INVESTIGATIVE ACTION

Representing the action to perform the forensic acquisition using the Logicube Falcon hardware duplicator.

[
    {
        "@id": "kb:investigativeAction-414ef4e5-0a1f-43d9-9e93-002bc2a28de4",
        "@type": "case-investigation:InvestigativeAction",
        "uco-core:name": "acquired",
        "uco-core:description": "Acquisition of TOSHIBA_MQ01ABD100",
        "uco-action:startTime": {
            "@type": "xsd:dateTime",
            "@value": "2018-10-26T13:12:48.00Z"
        },
        "uco-action:endTime": {
            "@type": "xsd:dateTime",
            "@value": "2018-10-26T16:31:50.00Z"
        },
        "uco-action:instrument": {
            "@id": "kb:ConfiguredTool-58f07c30-ae20-4587-9bb8-1a5299821e57"
        },
        "drafting:notProvidedByReport": {
            "@id": "uco-action:location"
        },
        "uco-action:performer": {
            "@id": "kb:role-856975ce-3c25-49c3-b6eb-28d1e929f915"
        },
        "uco-action:object": {
            "@id": "kb:disk-e598c1b3-f76d-4c27-b592-49bfdbf23d11"
        },
        "uco-action:result": [
            {
                "@id": "kb:provenancerecord-d1828cbb-bb0f-42e3-b021-cfd9d6419ae6"
            },
            {
                "@id": "kb:file-3366d44d-4e46-43a3-9df6-20aaff011d16"
            },
            {
                "@id": "kb:file-e8b28291-ca89-4199-b30d-d1d180619077"
            },
            {
                "@id": "kb:file-3a3fffe1-630f-4f2c-a1a3-d7d4ee0d632e"
            },
            {
                "@id": "kb:file-9d5d0b5d-73cb-4eac-8123-dba4d177ba78"
            },
            {
                "@id": "kb:file-ead689c2-26d4-4268-b4dd-d7936221f1ac"
            },
            {
                "@id": "kb:file-1616af98-d178-45ba-adb6-e45ba004b7be"
            },
            {
                "@id": "kb:file-9c08fdb3-36f6-4438-9da1-9d5eef691283"
            },
            {
                "@id": "kb:file-49457498-305a-42e8-b5a4-54559940b3ef"
            },
            {
                "@id": "kb:file-b4e0f188-26d0-4c94-b7f4-e3dd92df2321"
            },
            {
                "@id": "kb:file-697cab05-bd2a-4c41-87f4-c279b0fd9089"
            },
            {
                "@id": "kb:file-ea3a8789-fd83-4768-ad72-aed2ebf7ee67"
            },
            {
                "@id": "kb:file-c0c296e6-d143-4af0-bec4-81e3b62d70f6"
            },
            {
                "@id": "kb:file-7b828acc-1e0a-4215-b847-5f79869791ed"
            },
            {
                "@id": "kb:file-05f2d0ad-1fb0-4015-8805-5cf2b17574de"
            },
            {
                "@id": "kb:file-2377b497-02fa-4010-b00d-545a682b5022"
            },
            {
                "@id": "kb:file-61cf1397-159e-4b45-99c4-4c3eb78a500d"
            },
            {
                "@id": "kb:file-6d3551e3-c707-49d9-a17c-c297de884995"
            },
            {
                "@id": "kb:file-c5a93f7d-2482-4752-b8f1-491d8584496a"
            },
            {
                "@id": "kb:file-14ca15b8-020c-449e-9206-7c66c92a7663"
            },
            {
                "@id": "kb:file-24d16a25-55dd-46e2-8114-590b4ca01ab7"
            },
            {
                "@id": "kb:file-9322e5d1-175e-4b27-b750-f3d3ef16b601"
            },
            {
                "@id": "kb:file-1c0fcc09-a413-4cbf-8d6b-ff1fcff1b28c"
            },
            {
                "@id": "kb:file-795ce33b-87ec-43c4-b7d6-fa656e77c407"
            },
            {
                "@id": "kb:file-6422b2db-8e83-4635-bda3-21ef3f7f571e"
            },
            {
                "@id": "kb:file-a672b9b3-2b00-49f3-bff1-997ec5c4d1a0"
            },
            {
                "@id": "kb:file-cefde0b9-201d-424c-86cb-866253a089f7"
            },
            {
                "@id": "kb:file-2e5c740c-1948-48f5-a7dc-2dc58071efc6"
            },
            {
                "@id": "kb:file-73891986-60af-47f9-a7c6-c2bd0b749754"
            },
            {
                "@id": "kb:file-eff98353-779f-455c-828a-0c5a31a83b89"
            },
            {
                "@id": "kb:file-37eb9103-46af-4b60-93a6-6169f8cd0767"
            },
            {
                "@id": "kb:file-fb00a9cd-17e1-438f-9b28-ca5d7149f9c7"
            },
            {
                "@id": "kb:file-7fbb2a37-b524-41da-843c-512c757f9a53"
            },
            {
                "@id": "kb:file-339d008c-9a91-4db8-a0fd-772e0824f7a3"
            },
            {
                "@id": "kb:file-3781b13c-4814-4884-ad9e-f7c8a5912a77"
            },
            {
                "@id": "kb:file-f1980292-3045-445f-a0e4-f6f89a60835f"
            },
            {
                "@id": "kb:file-f8896dfb-6d42-4962-bb9b-84c0eb998da7"
            },
            {
                "@id": "kb:file-1908407e-ddde-4524-9f23-81ff37b4daf9"
            },
            {
                "@id": "kb:file-42533fb7-0cb4-4016-bb0d-d1e13846eca1"
            }
        ]
    },
    {
        "@id": "kb:provenancerecord-d1828cbb-bb0f-42e3-b021-cfd9d6419ae6",
        "@type": "case-investigation:ProvenanceRecord",
        "uco-core:description": "Segment files (38) partitions with E01Capture",
        "uco-observable:observableCreatedTime": {
            "@type": "xsd:dateTime",
            "@value": "2018-10-26T13:12:48.00Z"
        },
        "drafting:notProvidedByReport": {
            "@id": "case-investigation:exhibitNumber"
        },
        "uco-core:object": [
            {
                "@id": "kb:file-3366d44d-4e46-43a3-9df6-20aaff011d16"
            },
            {
                "@id": "kb:file-e8b28291-ca89-4199-b30d-d1d180619077"
            },
            {
                "@id": "kb:file-3a3fffe1-630f-4f2c-a1a3-d7d4ee0d632e"
            },
            {
                "@id": "kb:file-9d5d0b5d-73cb-4eac-8123-dba4d177ba78"
            },
            {
                "@id": "kb:file-ead689c2-26d4-4268-b4dd-d7936221f1ac"
            },
            {
                "@id": "kb:file-1616af98-d178-45ba-adb6-e45ba004b7be"
            },
            {
                "@id": "kb:file-9c08fdb3-36f6-4438-9da1-9d5eef691283"
            },
            {
                "@id": "kb:file-49457498-305a-42e8-b5a4-54559940b3ef"
            },
            {
                "@id": "kb:file-b4e0f188-26d0-4c94-b7f4-e3dd92df2321"
            },
            {
                "@id": "kb:file-697cab05-bd2a-4c41-87f4-c279b0fd9089"
            },
            {
                "@id": "kb:file-ea3a8789-fd83-4768-ad72-aed2ebf7ee67"
            },
            {
                "@id": "kb:file-c0c296e6-d143-4af0-bec4-81e3b62d70f6"
            },
            {
                "@id": "kb:file-7b828acc-1e0a-4215-b847-5f79869791ed"
            },
            {
                "@id": "kb:file-05f2d0ad-1fb0-4015-8805-5cf2b17574de"
            },
            {
                "@id": "kb:file-2377b497-02fa-4010-b00d-545a682b5022"
            },
            {
                "@id": "kb:file-61cf1397-159e-4b45-99c4-4c3eb78a500d"
            },
            {
                "@id": "kb:file-6d3551e3-c707-49d9-a17c-c297de884995"
            },
            {
                "@id": "kb:file-c5a93f7d-2482-4752-b8f1-491d8584496a"
            },
            {
                "@id": "kb:file-14ca15b8-020c-449e-9206-7c66c92a7663"
            },
            {
                "@id": "kb:file-24d16a25-55dd-46e2-8114-590b4ca01ab7"
            },
            {
                "@id": "kb:file-9322e5d1-175e-4b27-b750-f3d3ef16b601"
            },
            {
                "@id": "kb:file-1c0fcc09-a413-4cbf-8d6b-ff1fcff1b28c"
            },
            {
                "@id": "kb:file-795ce33b-87ec-43c4-b7d6-fa656e77c407"
            },
            {
                "@id": "kb:file-6422b2db-8e83-4635-bda3-21ef3f7f571e"
            },
            {
                "@id": "kb:file-a672b9b3-2b00-49f3-bff1-997ec5c4d1a0"
            },
            {
                "@id": "kb:file-cefde0b9-201d-424c-86cb-866253a089f7"
            },
            {
                "@id": "kb:file-2e5c740c-1948-48f5-a7dc-2dc58071efc6"
            },
            {
                "@id": "kb:file-73891986-60af-47f9-a7c6-c2bd0b749754"
            },
            {
                "@id": "kb:file-eff98353-779f-455c-828a-0c5a31a83b89"
            },
            {
                "@id": "kb:file-37eb9103-46af-4b60-93a6-6169f8cd0767"
            },
            {
                "@id": "kb:file-fb00a9cd-17e1-438f-9b28-ca5d7149f9c7"
            },
            {
                "@id": "kb:file-7fbb2a37-b524-41da-843c-512c757f9a53"
            },
            {
                "@id": "kb:file-339d008c-9a91-4db8-a0fd-772e0824f7a3"
            },
            {
                "@id": "kb:file-3781b13c-4814-4884-ad9e-f7c8a5912a77"
            },
            {
                "@id": "kb:file-f1980292-3045-445f-a0e4-f6f89a60835f"
            },
            {
                "@id": "kb:file-f8896dfb-6d42-4962-bb9b-84c0eb998da7"
            },
            {
                "@id": "kb:file-1908407e-ddde-4524-9f23-81ff37b4daf9"
            },
            {
                "@id": "kb:file-42533fb7-0cb4-4016-bb0d-d1e13846eca1"
            }
        ]
    }
]

NOTE: Destination drive properties where output was saved as Serial Number = "Z50503SC" and Destination UID="SAS_D1/5C1C79AB3F137696"

FORENSIC ACQUISITION RESULTS

Representing file segments of acquired forensic acquisition.

[
    {
        "@id": "kb:file-3366d44d-4e46-43a3-9df6-20aaff011d16",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-81b80de3-c1ca-48ec-a052-4b07da5f4a2e",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E01",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E01",
                "uco-observable:extension": "E01",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-83493b92-2a26-4bcb-a183-4d39c3795c6a",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-7075ec42-538a-5688-b59a-e6494e16f832",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "3f9006a2d3130c4845678bdb6824dbac2b12c9c8"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-e8b28291-ca89-4199-b30d-d1d180619077",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-59eb6144-51c1-4c5e-914a-f301c3fc3afe",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E02",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E02",
                "uco-observable:extension": "E02",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-dce181c7-fbb6-4122-abf4-29be4f9b5441",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-41f6331e-1190-5c29-a8c5-63e93b1162bd",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "fd56f96a0c58eda0444ca7acfa85e9bea4093a59"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-3a3fffe1-630f-4f2c-a1a3-d7d4ee0d632e",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-3cc91c06-c33a-4548-82dd-561e17427e7a",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E03",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E03",
                "uco-observable:extension": "E03",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-96d08ade-7a04-4272-a41b-9bd9450b863a",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-af48a01c-cdc3-5bc7-a055-cc15e2629e2e",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "91721ead5b3f0179473e4b8b724f13b9564c779c"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-9d5d0b5d-73cb-4eac-8123-dba4d177ba78",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-77d2b5db-7f78-4855-a925-e46a562ad88c",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E04",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E04",
                "uco-observable:extension": "E04",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-5b86e62a-1143-497f-add1-945c72f2ff52",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-dca56087-1174-55de-b8b7-0e2354bb3ef2",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "89f64fe23f7b03442fe21eed10bdc4196b2e665b"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-ead689c2-26d4-4268-b4dd-d7936221f1ac",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-8f0f9d96-601f-46a4-b568-767c49a12c8c",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E05",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E05",
                "uco-observable:extension": "E05",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-79d69309-3b1a-4235-9312-adb0c23eeb52",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-d3ba3b98-b06a-5a2e-b45b-3668f50608c2",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "b05c8001c9ecf8f3406c0be578989130ed57f63d"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-1616af98-d178-45ba-adb6-e45ba004b7be",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-b9d778fa-2826-4f4e-85f1-d369e234e281",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E06",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E06",
                "uco-observable:extension": "E06",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-9e8a43dd-09de-4190-af9d-0d724acbb1a2",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-9d0e1cf7-26f2-5ce8-a73f-dd5557d65ff5",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "284c2ee098c699fc64c23a4ad76814d5002cf6a7"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-9c08fdb3-36f6-4438-9da1-9d5eef691283",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-fe054752-ca76-475d-908c-6069624c3e45",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E07",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E07",
                "uco-observable:extension": "E07",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-3925df18-8d68-4a89-8324-6f1da39361a0",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-e3a56b3f-a7dd-5301-a1b2-9b23063b85e1",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "34a95a0bd04d3a329ea272a249122ab1bbd871fb"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-49457498-305a-42e8-b5a4-54559940b3ef",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-a8198729-1105-429f-8739-761c38aada55",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E08",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E08",
                "uco-observable:extension": "E08",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-0f5a95d7-efe5-404f-8062-bd2291d88367",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-fa37fe1f-5dd7-5ce6-972d-132a65dbddfa",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "ad575817855d5f217bfd1f8d677b89a52d32a77e"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-b4e0f188-26d0-4c94-b7f4-e3dd92df2321",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-eb756eda-521a-4073-9cb3-e2c3952983b0",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E09",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E09",
                "uco-observable:extension": "E09",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-62e570c6-8fd6-4939-9183-f13533d81801",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-c4bda428-31fb-51ad-b477-11c31b9dd624",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "57ff2394d71ef568bcde02e204b9f1dbdb403250"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-697cab05-bd2a-4c41-87f4-c279b0fd9089",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-ca17615e-efc4-4e76-9f44-06f1d94ee4d5",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E10",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E10",
                "uco-observable:extension": "E10",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-388da6a1-9cdc-450f-baa1-56ed1be686f4",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-f089a49f-45ce-5721-9806-ba6c3fc639b7",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "ec6e362796888fe28a4e66c7f3f608a00039a902"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-ea3a8789-fd83-4768-ad72-aed2ebf7ee67",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-b4738cd2-a3fc-4c91-a0bc-beb8d6f09e22",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E11",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E11",
                "uco-observable:extension": "E11",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-18c836aa-a1ad-4770-a2c6-58b61655522b",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-ef6c6376-25e8-52c0-94f6-851605d701bd",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "ffb03762947211ed3e395fb571eeacd3214fc63b"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-c0c296e6-d143-4af0-bec4-81e3b62d70f6",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-736bb987-709d-40e0-88af-aad055fb2f3d",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E12",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E12",
                "uco-observable:extension": "E12",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-f6b341ef-2d97-4d40-9f49-c483a1a0620e",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-5039341f-80c1-584a-88cb-1a3d0957b0b2",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "885f1f3ecb58a081e22a0ff475340ce36836edbf"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-7b828acc-1e0a-4215-b847-5f79869791ed",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-16479554-f683-4672-923c-0aa647b86802",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E13",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E13",
                "uco-observable:extension": "E13",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-89044d8e-1a2f-4c68-ba3a-9118908bdf8f",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-d3183f9a-7f14-533a-829b-075389410fb1",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "3309dfbabf425e8eda61c55ecaca74d3b0a20a93"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-05f2d0ad-1fb0-4015-8805-5cf2b17574de",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-d0c8c2cd-5528-4bef-83e8-59af8a8ce281",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E14",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E14",
                "uco-observable:extension": "E14",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-eaf573a3-e2cb-453c-836b-d3f1c0ad0869",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-c6244bd4-64ec-50fc-9045-cca4880d8728",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "82e6e5a7036eb791405525de1018851bc211e11f"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-2377b497-02fa-4010-b00d-545a682b5022",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-179ef591-aaf9-4941-8a51-ec195a087b89",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E15",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E15",
                "uco-observable:extension": "E15",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-8dddab43-11c0-4cd3-9478-ecad6b26956b",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-4c6811cf-22d9-53a5-9084-4e0b3bfde399",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "c0324777a8895014bed7e6842307682299a7f828"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-61cf1397-159e-4b45-99c4-4c3eb78a500d",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-853cf3bb-e973-4f09-821b-20ffa2d0969e",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E16",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E16",
                "uco-observable:extension": "E16",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-e0bfaeaa-2a54-445f-a928-0918d3d02a71",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-e428f48b-5b2a-5002-83a8-7f7bda6b5ffe",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "92880af1cdacfd65be0807ddc8ffe6181bc06e89"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-6d3551e3-c707-49d9-a17c-c297de884995",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-69e136b4-2d59-45e7-b26d-3611dd34b5d3",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E17",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E17",
                "uco-observable:extension": "E17",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-de0fcb2b-a062-4fe5-b1dc-45f23dbd3637",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-cb9c7ec9-1cc6-55a8-bb32-c3d24881eb97",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "4d175e0921adb8311aa367ce6475c71228ef37cb"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-c5a93f7d-2482-4752-b8f1-491d8584496a",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-fbcdd931-8efe-4809-923f-89cce9a5bb84",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E18",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E18",
                "uco-observable:extension": "E18",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-033fb52c-a445-4458-8759-a0b9878374af",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-a40849e5-15dd-50ff-ae81-62a94642d90c",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "1495f4d71191b68e0b27fc5a204cd25201a77091"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-14ca15b8-020c-449e-9206-7c66c92a7663",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-16182747-d679-4bbd-8088-dc9c6da0481f",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E19",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E19",
                "uco-observable:extension": "E19",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-93acd519-2ae8-43b1-bd13-2aae48511a27",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-e25c0fb6-ade5-57c0-8c58-e110889f9eed",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "7777970eb1a5b89e9b78c4dd438250def5ddb9cd"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-24d16a25-55dd-46e2-8114-590b4ca01ab7",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-1c24f350-107a-4207-bfca-c195a97fcd4b",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E20",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E20",
                "uco-observable:extension": "E20",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-0107676d-66be-4daa-ba74-e1cbde36662f",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-d7afd411-0da4-5761-b031-1aed669fba49",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "7122572ec9ee8ebd9d202548d51eff08f0bd28ec"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-9322e5d1-175e-4b27-b750-f3d3ef16b601",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-a3e941dc-d746-4d7a-a413-7ce15815f0b6",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E21",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E21",
                "uco-observable:extension": "E21",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-0ff50736-91f1-4b89-ad75-af54283593b9",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-6611ab3e-34cb-57f2-9277-942adbf98d10",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "3d4883db867d3c4ad5f9ed3a0f9b903502c40561"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-1c0fcc09-a413-4cbf-8d6b-ff1fcff1b28c",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-282296c0-ee51-4607-96dc-905509419f1c",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E22",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E22",
                "uco-observable:extension": "E22",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-26948235-5c93-4411-986b-4b23d3f4aa62",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-6615b5a2-32b3-5453-9c0c-687eea0aaa30",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "11c2c9e940859133d1928dd5f9483e430bfe9991"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-795ce33b-87ec-43c4-b7d6-fa656e77c407",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-df3d9872-d4a5-499e-86a3-9288dae466c8",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E23",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E23",
                "uco-observable:extension": "E23",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-d8f23f46-7fd8-4c1e-b83e-b7d58873072e",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-1114a157-d6e6-5fdc-807c-4ae205188bc3",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "6e86c0bc7ef7ff0239be4013287e91c19aa9a682"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-6422b2db-8e83-4635-bda3-21ef3f7f571e",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-92832264-fbb3-4cbb-8d8e-b644eca562a8",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E24",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E24",
                "uco-observable:extension": "E24",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-05bbeb58-288b-4887-af72-b4574e3e4087",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-810aaef6-2836-55c4-bfca-bb666f30cc44",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "df801f9b8692940f5fb97d644051f275885466c5"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-a672b9b3-2b00-49f3-bff1-997ec5c4d1a0",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-30327754-ae0b-42f0-ae50-81208bd54989",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E25",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E25",
                "uco-observable:extension": "E25",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-c30e4632-aa6d-49f2-a136-48a621c7500e",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-b0130e51-fe12-5133-ba7e-8556adad5a09",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "8d304a07ca584dc291a6cd70b173af97925277da"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-cefde0b9-201d-424c-86cb-866253a089f7",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-60069041-51c0-4d81-af87-737f2b353ebb",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E26",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E26",
                "uco-observable:extension": "E26",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-d4ac7d77-a054-4ac9-b4a4-75995b79a909",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-fa7f690f-5393-5e5d-a370-2c66b40e6a31",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "e94f126c7014d14a3e78bcfd0a484ee2a43ccbd0"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-2e5c740c-1948-48f5-a7dc-2dc58071efc6",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-bff60f9d-5676-42b8-8bcc-2c4ffa0d7aa0",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E27",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E27",
                "uco-observable:extension": "E27",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-c766cef9-f0ca-452b-aeee-830ad8976665",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-df83960c-7ff8-5a8f-a0a0-f8ab4b980189",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "531f94930334f70119ed972ba2d20f29411dfb3b"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-73891986-60af-47f9-a7c6-c2bd0b749754",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-d3ab1c8e-3e82-4b79-98fa-d5021fd6d5d4",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E28",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E28",
                "uco-observable:extension": "E28",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-851808fc-6b97-47dd-84ab-d43ab616839f",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-37e613de-bc76-5f4a-aa6b-e25babfa5393",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "bb13c8cc5f0a3e89d3f6180c0b09fcbecac658a2"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-eff98353-779f-455c-828a-0c5a31a83b89",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-a920b4ec-756a-4524-85dd-d61f96ba9ee3",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E29",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E29",
                "uco-observable:extension": "E29",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-6b9a6470-3e1f-47e7-818b-91c2417d4c75",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-36c901fe-0d8c-5de0-808b-29e22e99726d",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "0de8a33ee74454068ead698c05eedc7196e5c0d1"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-37eb9103-46af-4b60-93a6-6169f8cd0767",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-bb57c8ff-566e-4a45-a878-e9a0da6e1a51",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E30",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E30",
                "uco-observable:extension": "E30",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-c1dbfec4-65e6-4fcb-b2dc-e6834db82305",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-1b2a8da7-ee8f-5abf-a44d-0ba1d435d909",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "81431e9f98571f45ff1af1978c5957573ea42676"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-fb00a9cd-17e1-438f-9b28-ca5d7149f9c7",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-744d291c-081a-4fbe-a681-51d3f6f9b583",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E31",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E31",
                "uco-observable:extension": "E31",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-b53a2678-e2ec-46fa-b71b-0f652484a0d3",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-4ae06bd2-52b0-5487-b401-afd81dcf26d5",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "db97a86aeaa1b8d3e8c913359e6917bda7d399d3"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-7fbb2a37-b524-41da-843c-512c757f9a53",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-a254e4bb-858a-4bca-aff9-516df87909f4",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E32",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E32",
                "uco-observable:extension": "E32",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-3dc4abc5-279b-45bd-84ae-22794cb83f04",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-7b1ab09c-61a5-5a6d-b989-de871655d008",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "0930bf04218e54fbcb2e8c065903a721272679c9"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-339d008c-9a91-4db8-a0fd-772e0824f7a3",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-8406c63a-758d-45f8-a926-8c351bd0ce0c",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E33",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E33",
                "uco-observable:extension": "E33",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-0ebb2215-c79c-4aad-827b-d8b6d75f93a6",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-c9bcd939-06f2-5367-b620-72be08d1fb2e",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "8504d05670f078fcd3060e174c550d223477a11e"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-3781b13c-4814-4884-ad9e-f7c8a5912a77",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-f3b43554-647d-4d60-aa13-9bd8ed9ad4ee",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E34",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E34",
                "uco-observable:extension": "E34",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-a1b8c2f6-14d5-4a99-a3cb-d828667274b6",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-aa0dba0f-d861-5118-ab69-2d8decb156f2",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "1c718a79ef8e137326dee872c6778445f9d92173"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-f1980292-3045-445f-a0e4-f6f89a60835f",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-aee47bc2-e0d1-457c-8651-82c680c9cc58",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E35",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E35",
                "uco-observable:extension": "E35",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-34895f2f-983b-4fae-b3b3-c763d940cbfb",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-d9e33ad4-3607-5095-95fa-9c8b888a0cce",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "77dfb7e832582c62ad06f0e5366238507f9fe0da"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-f8896dfb-6d42-4962-bb9b-84c0eb998da7",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-aa8d334b-10a5-423e-8431-42c51afaacc2",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E36",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E36",
                "uco-observable:extension": "E36",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-ce172d0c-aba9-42b0-b5d0-e41b1f6150ca",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-a87988bc-4b72-5265-b6b8-c333c89e0835",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "4bd27e99eca38f629debbeee150b3f7dd034037b"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-1908407e-ddde-4524-9f23-81ff37b4daf9",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-d2d7d229-3d5a-4207-811a-d38642a42d95",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E37",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E37",
                "uco-observable:extension": "E37",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-f297c5bf-f0c2-495b-a78e-e193ca9e4817",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-5dd9e9eb-665d-534d-a2cc-5c6d68d27150",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "8b4037c10e3c3b50a183fd396c68dffdc0fa8217"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:file-42533fb7-0cb4-4016-bb0d-d1e13846eca1",
        "@type": "uco-observable:File",
        "uco-core:hasFacet": [
            {
                "@id": "kb:file-facet-33d40dab-c65f-4204-985d-204c381069e0",
                "@type": "uco-observable:FileFacet",
                "uco-observable:fileName": "R14_ACER_HD.E38",
                "uco-observable:filePath": "/var/repo/sas-d1/R14_ACER_HD.E38",
                "uco-observable:extension": "E38",
                "uco-observable:fileSystemType": "ntfs",
                "uco-observable:isDirectory": false,
                "uco-observable:sizeInBytes": 4294967296,
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2018-10-26T13:12:48.00Z"
                }
            },
            {
                "@id": "kb:content-data-facet-687ea678-b8b8-4f2f-af07-c4ddf42533c0",
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:hash": [
                    {
                        "@id": "kb:hash-3a4926c9-4713-57b5-b980-347a28b38914",
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA1"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "47001faf6ae8d73e3a47df33c260be6bcc47b2d0"
                        }
                    }
                ]
            }
        ]
    }
]

Disclaimers

Participation by contributors in the creation of the documentation of mentioned software is not intended to imply a recommendation or endorsement by the United States Government nor any of the contributors' employers, nor is it intended to imply that any specific software is necessarily the best available for the purpose.

Events, locations, tools, and people represented in this and other CASE narratives are presented, and at many times created, for illustration purposes only and do not necessarily represent real events, locations, tools, or people.