mirror of
https://github.com/NetherlandsForensicInstitute/hansken-extraction-plugin-sdk-documentation.git
synced 2026-02-14 14:09:49 +00:00
45 lines
3.9 KiB
Plaintext
45 lines
3.9 KiB
Plaintext
# Plugin naming convention
|
|
|
|
## Plugin identifier
|
|
|
|
Each extraction plugin has a unique identifier. The identifier consists of three fields. These three fields combined
|
|
form the plugin name.
|
|
|
|
The three fields of a plugin identifier are: *domain*, *category*, and *name*. The fields are described in more detail
|
|
below.
|
|
|
|
**domain**
|
|
The domain name of the organisation where the plugin is created. If an organisation has multiple domain names, the
|
|
shortest name is preferred over the longer domain names. Examples: `nfi.nl`, `politie.nl`, `fiod.nl`, `hansken.org`.
|
|
|
|
**category**
|
|
A type of action that the plugin performs. The category is a free text field, but the following table gives some
|
|
recommendations.
|
|
|
|
| Category | Description |
|
|
|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
| ``extract`` | The plugin parses a clear data structure |
|
|
| ``carve`` | The plugin parses data fragments to reassemble traces in the absence of filesystem metadata |
|
|
| ``classify`` | The plugin categorizes a plugin based on its content, e.g. detecting money on traces of type `picture` |
|
|
| ``digest`` | The plugin digests data to compute a hash |
|
|
| ``ocr`` | The plugin applies ocr (optical character recognition) to read text on `pictures` or scanned documents |
|
|
| ``match`` | The plugin matches a trace against a database, and reports whether there was hit or miss, e.g. matching a trace to a well known files database |
|
|
|
|
**name**
|
|
The name of the plugin, or in the classic sense, a description detailing what the plugin processes. Note that the name
|
|
can contain (forward) slashes.
|
|
|
|
## Examples
|
|
|
|
The following table shows a list of plugin identifiers. The last column of the table shows the derived full plugin name.
|
|
The derived full plugin name will be shown in Hansken.
|
|
|
|
| Domain | Category | Name | Derived plugin name | Explanation |
|
|
|-----------------|--------------|-----------------|------------------------------------|-------------------------------------------------------------------------------------------------------------|
|
|
| ``hansken.org`` | ``extract`` | ``archive`` | ``hansken.org/extract/archive`` | A plugin created by the Hansken development team that extracts traces from an arbitrary ``archive`` format |
|
|
| ``nfi.nl`` | ``extract`` | ``archive/zip`` | ``nfi.nl/extract/archive/zip`` | A plugin created by an NFI team that extracts traces from a specific ``archive`` format: ``zip`` |
|
|
| ``politie.nl`` | ``extract`` | ``archive/zip`` | ``politie.nl/extract/archive/zip`` | The same as the previous example, but now the plugin is created by a different organisation: ``politie.nl`` |
|
|
| ``hansken.org`` | ``carve`` | ``archive/zip`` | ``hansken.org/carve/archive/zip`` | A plugin that carves data to detect a specific ``archive`` format: ``zip`` |
|
|
| ``hansken.org`` | ``digest`` | ``sha256`` | ``hansken.org/digest/sha256`` | A plugin that digests data to compute a ``sha256`` hash |
|
|
| ``hansken.org`` | ``ocr`` | ``tesseract`` | ``hansken.org/ocr/tesseract`` | A plugin that performs ocr using ``tesseract`` |
|