ByteRunTypeCybOX Common Schema

The ByteRunType is used for representing a single byte run from within a raw object.


Fields

Field Name Type Description
Offset0..1 IntegerObjectPropertyType

The Offset field specifies the offset of the beginning of the byte run as measured from the beginning of the object.

Byte_Order0..1 EndiannessType

The Byte_Order field specifies the endianness of the unpacked (e.g., unencoded, unencrypted, etc.) data contained within the Byte_Run_Data field.

File_System_Offset0..1 IntegerObjectPropertyType

The File_System_Offset field is relevant only for byte runs of files in forensic analysis.It specifies the offset of the beginning of the byte run as measured from the beginning of the relevant file system.

Image_Offset0..1 IntegerObjectPropertyType

The Image_Offset field is provided for forensic analysis purposes and specifies the offset of the beginning of the byte run as measured from the beginning of the relevant forensic image.

Length0..1 IntegerObjectPropertyType

The Length field specifies the number of bytes in the byte run.

Hashes0..1 HashListType

The Hashes field contains computed hash values for this the data in this byte run.

Byte_Run_Data0..1 anyType

The Byte_Run_Data field contains a raw dump of the byte run data, typically enclosed within an XML CDATA section.