Plugin naming convention

Plugin identifier

Each extraction plugin has a unique identifier. The identifier consists of three fields. These three fields combined form the plugin name.

The three fields of a plugin identifier are: domain, category, and name. The fields are described in more detail below.

domain The domain name of the organisation where the plugin is created. If an organisation has multiple domain names, the shortest name is preferred over the longer domain names. Examples: nfi.nl, politie.nl, fiod.nl, hansken.org.

category A type of action that the plugin performs. The category is a free text field, but the following table gives some recommendations.

Category

Description

extract

The plugin parses a clear data structure

carve

The plugin parses data fragments to reassemble traces in the absence of filesystem metadata

classify

The plugin categorizes a plugin based on its content, e.g. detecting money on traces of type picture

digest

The plugin digests data to compute a hash

ocr

The plugin applies ocr (optical character recognition) to read text on pictures or scanned documents

match

The plugin matches a trace against a database, and reports whether there was hit or miss, e.g. matching a trace to a well known files database

name The name of the plugin, or in the classic sense, a description detailing what the plugin processes. Note that the name can contain (forward) slashes.

Examples

The following table shows a list of plugin identifiers. The last column of the table shows the derived full plugin name. The derived full plugin name will be shown in Hansken.

Domain

Category

Name

Derived plugin name

Explanation

hansken.org

extract

archive

hansken.org/extract/archive

A plugin created by the Hansken development team that extracts traces from an arbitrary archive format

nfi.nl

extract

archive/zip

nfi.nl/extract/archive/zip

A plugin created by an NFI team that extracts traces from a specific archive format: zip

politie.nl

extract

archive/zip

politie.nl/extract/archive/zip

The same as the previous example, but now the plugin is created by a different organisation: politie.nl

hansken.org

carve

archive/zip

hansken.org/carve/archive/zip

A plugin that carves data to detect a specific archive format: zip

hansken.org

digest

sha256

hansken.org/digest/sha256

A plugin that digests data to compute a sha256 hash

hansken.org

ocr

tesseract

hansken.org/ocr/tesseract

A plugin that performs ocr using tesseract