https://ontology.solveit-df.org/solveit/analysis/HypothesisedRecord
A database record hypothesised to have existed, typically reconstructed from deallocated or partially overwritten storage such as freeblocks, unallocated page space, or freelist pages. The claim it makes is one of extent: that these bytes constituted one record, beginning and ending where the reconstruction says. That claim can fail - a sequence of ordinary integers can decode as a plausible record header, adjacent deletions can merge into one freeblock, and a later write can overwrite the leading bytes - so a HypothesisedRecord is deliberately not a solveit-observable:SQLiteRecord. Decoded values are linked with solveit-analysis:hasField, and the page the bytes came from with solveit-observable:recoveredFromPage. Which table the record belonged to is a separate claim, and is not asserted here: it is made by a solveit-analysis:HypothesisedTableAttribution, so that one reconstruction can carry several competing attributions without being duplicated.
Instances of solveit-analysis:HypothesisedRecord can have the following properties:
| PROPERTY | TYPE | DESCRIPTION | RANGE |
|---|
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix solveit-analysis: <https://ontology.solveit-df.org/solveit/analysis/> .
solveit-analysis:HypothesisedRecord a owl:Class ;
rdfs:label "Hypothesised Record"@en ;
rdfs:comment "A database record hypothesised to have existed, typically reconstructed from deallocated or partially overwritten storage such as freeblocks, unallocated page space, or freelist pages. The claim it makes is one of extent: that these bytes constituted one record, beginning and ending where the reconstruction says. That claim can fail - a sequence of ordinary integers can decode as a plausible record header, adjacent deletions can merge into one freeblock, and a later write can overwrite the leading bytes - so a HypothesisedRecord is deliberately not a solveit-observable:SQLiteRecord. Decoded values are linked with solveit-analysis:hasField, and the page the bytes came from with solveit-observable:recoveredFromPage. Which table the record belonged to is a separate claim, and is not asserted here: it is made by a solveit-analysis:HypothesisedTableAttribution, so that one reconstruction can carry several competing attributions without being duplicated."@en ;
rdfs:subClassOf solveit-analysis:Hypothesis .