Plugin naming convention
Plugin identifier
Each extraction plugin has a unique identifier. The identifier consists of three fields. These three fields combined form the plugin name.
The three fields of a plugin identifier are: domain, category, and name. The fields are described in more detail below.
domain
The domain name of the organisation where the plugin is created. If an organisation has multiple domain names, the
shortest name is preferred over the longer domain names. Examples: nfi.nl
, politie.nl
, fiod.nl
, hansken.org
.
category A type of action that the plugin performs. The category is a free text field, but the following table gives some recommendations.
Category |
Description |
---|---|
|
The plugin parses a clear data structure |
|
The plugin parses data fragments to reassemble traces in the absence of filesystem metadata |
|
The plugin categorizes a plugin based on its content, e.g. detecting money on traces of type |
|
The plugin digests data to compute a hash |
|
The plugin applies ocr (optical character recognition) to read text on |
|
The plugin matches a trace against a database, and reports whether there was hit or miss, e.g. matching a trace to a well known files database |
name The name of the plugin, or in the classic sense, a description detailing what the plugin processes. Note that the name can contain (forward) slashes.
Examples
The following table shows a list of plugin identifiers. The last column of the table shows the derived full plugin name. The derived full plugin name will be shown in Hansken.
Domain |
Category |
Name |
Derived plugin name |
Explanation |
---|---|---|---|---|
|
|
|
|
A plugin created by the Hansken development team that extracts traces from an arbitrary |
|
|
|
|
A plugin created by an NFI team that extracts traces from a specific |
|
|
|
|
The same as the previous example, but now the plugin is created by a different organisation: |
|
|
|
|
A plugin that carves data to detect a specific |
|
|
|
|
A plugin that digests data to compute a |
|
|
|
|
A plugin that performs ocr using |