Schema documentation for Volume

This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org.

The Volume object is intended to characterize generic drive volumes.

<xs:element name="Volume" type="VolumeObj:VolumeObjectType">
  <xs:annotation>
    <xs:documentation>The Volume object is intended to characterize generic drive volumes.</xs:documentation>
  </xs:annotation>
</xs:element>

The Name field specifies the name of the volume.

<xs:element name="Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Name field specifies the name of the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The Device_Path specifies the full path to the volume, including the device on which it resides.

<xs:element name="Device_Path" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Device_Path specifies the full path to the volume, including the device on which it resides.</xs:documentation>
  </xs:annotation>
</xs:element>

The File_System_Type field specifies the name of the file system which is used on the volume.

<xs:element name="File_System_Type" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The File_System_Type field specifies the name of the file system which is used on the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The Total_Allocation_Units field specifies the total number of allocation units available on the volume.

<xs:element name="Total_Allocation_Units" type="cyboxCommon:UnsignedLongObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Total_Allocation_Units field specifies the total number of allocation units available on the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The Sectors_Per_Allocation_Unit field specifies the number of disk sectors used for each allocation unit on the volume.

<xs:element name="Sectors_Per_Allocation_Unit" type="cyboxCommon:UnsignedIntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Sectors_Per_Allocation_Unit field specifies the number of disk sectors used for each allocation unit on the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The Bytes_Per_Sector field specifies the number of bytes allocated for each sector of the volume.

<xs:element name="Bytes_Per_Sector" type="cyboxCommon:PositiveIntegerObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Bytes_Per_Sector field specifies the number of bytes allocated for each sector of the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The Actual_Available_Allocation_Units field specifies the number of allocation units, or clusters, available on the volume.

<xs:element name="Actual_Available_Allocation_Units" type="cyboxCommon:UnsignedLongObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Actual_Available_Allocation_Units field specifies the number of allocation units, or clusters, available on the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The Creation_Time field specifies the date/time that the volume was created.

<xs:element name="Creation_Time" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
  <xs:annotation>
    <xs:documentation>The Creation_Time field specifies the date/time that the volume was created.</xs:documentation>
  </xs:annotation>
</xs:element>

The File_System_Flag_List field specifies the particular flags set for the volume by the file system which is used on the volume.

<xs:element name="File_System_Flag_List" type="VolumeObj:FileSystemFlagListType" minOccurs="0" maxOccurs="1">
  <xs:annotation>
    <xs:documentation>The File_System_Flag_List field specifies the particular flags set for the volume by the file system which is used on the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The File_System_Flag field specifies a particular flag used on the volume by the file system.

<xs:element name="File_System_Flag" type="VolumeObj:VolumeFileSystemFlagType" maxOccurs="20">
  <xs:annotation>
    <xs:documentation>The File_System_Flag field specifies a particular flag used on the volume by the file system.</xs:documentation>
  </xs:annotation>
</xs:element>

The Serial_Number field specifies the serial number of the volume.

<xs:element minOccurs="0" name="Serial_Number" type="cyboxCommon:StringObjectPropertyType">
  <xs:annotation>
    <xs:documentation>The Serial_Number field specifies the serial number of the volume.</xs:documentation>
  </xs:annotation>
</xs:element>

The VolumeObjectType type is intended to characterize generic drive volumes.

Element

VolumeObj:Volume

<xs:complexType name="VolumeObjectType" mixed="false">
  <xs:annotation>
    <xs:documentation>The VolumeObjectType type is intended to characterize generic drive volumes.</xs:documentation>
  </xs:annotation>
  <xs:complexContent>
    <xs:extension base="cyboxCommon:ObjectPropertiesType">
      <xs:sequence>
        <xs:element name="Name" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Name field specifies the name of the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Device_Path" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Device_Path specifies the full path to the volume, including the device on which it resides.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="File_System_Type" type="cyboxCommon:StringObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The File_System_Type field specifies the name of the file system which is used on the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Total_Allocation_Units" type="cyboxCommon:UnsignedLongObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Total_Allocation_Units field specifies the total number of allocation units available on the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Sectors_Per_Allocation_Unit" type="cyboxCommon:UnsignedIntegerObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Sectors_Per_Allocation_Unit field specifies the number of disk sectors used for each allocation unit on the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Bytes_Per_Sector" type="cyboxCommon:PositiveIntegerObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Bytes_Per_Sector field specifies the number of bytes allocated for each sector of the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Actual_Available_Allocation_Units" type="cyboxCommon:UnsignedLongObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Actual_Available_Allocation_Units field specifies the number of allocation units, or clusters, available on the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="Creation_Time" type="cyboxCommon:DateTimeObjectPropertyType" minOccurs="0">
          <xs:annotation>
            <xs:documentation>The Creation_Time field specifies the date/time that the volume was created.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element name="File_System_Flag_List" type="VolumeObj:FileSystemFlagListType" minOccurs="0" maxOccurs="1">
          <xs:annotation>
            <xs:documentation>The File_System_Flag_List field specifies the particular flags set for the volume by the file system which is used on the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
        <xs:element minOccurs="0" name="Serial_Number" type="cyboxCommon:StringObjectPropertyType">
          <xs:annotation>
            <xs:documentation>The Serial_Number field specifies the serial number of the volume.</xs:documentation>
          </xs:annotation>
        </xs:element>
      </xs:sequence>
      <xs:attribute name="is_mounted" type="xs:boolean">
        <xs:annotation>
          <xs:documentation>The is_mounted field specifies whether the volume is mounted.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:extension>
  </xs:complexContent>
</xs:complexType>

The FileSystemFlagListType is a listing of the flags specified for the volume by the file system.

<xs:complexType name="FileSystemFlagListType">
  <xs:annotation>
    <xs:documentation>The FileSystemFlagListType is a listing of the flags specified for the volume by the file system.</xs:documentation>
  </xs:annotation>
  <xs:sequence>
    <xs:element name="File_System_Flag" type="VolumeObj:VolumeFileSystemFlagType" maxOccurs="20">
      <xs:annotation>
        <xs:documentation>The File_System_Flag field specifies a particular flag used on the volume by the file system.</xs:documentation>
      </xs:annotation>
    </xs:element>
  </xs:sequence>
</xs:complexType>

VolumeFileSystemFlagType specifies file system flags, via a union of the VolumeFileSystemFlagEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.

<xs:complexType name="VolumeFileSystemFlagType">
  <xs:annotation>
    <xs:documentation>VolumeFileSystemFlagType specifies file system flags, via a union of the VolumeFileSystemFlagEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications.</xs:documentation>
  </xs:annotation>
  <xs:simpleContent>
    <xs:restriction base="cyboxCommon:BaseObjectPropertyType">
      <xs:simpleType>
        <xs:union memberTypes="VolumeObj:VolumeFileSystemFlagEnum xs:string"/>
      </xs:simpleType>
      <xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
        <xs:annotation>
          <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
        </xs:annotation>
      </xs:attribute>
    </xs:restriction>
  </xs:simpleContent>
</xs:complexType>

The VolumeOptionsType type specifies the particular options set for the volume. This is an abstract type since volume options are OS-specific, and is extended by the related OS-specific CybOX volume objects.

<xs:complexType name="VolumeOptionsType" abstract="true">
  <xs:annotation>
    <xs:documentation>The VolumeOptionsType type specifies the particular options set for the volume. This is an abstract type since volume options are OS-specific, and is extended by the related OS-specific CybOX volume objects.</xs:documentation>
  </xs:annotation>
</xs:complexType>

The FileSystemFlagEnum type is an enumeration of flags used by file systems on volumes, especially those on Windows Operating Systems. See http://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx and http://msdn.microsoft.com/en-us/library/cc232101(v=prot.13).aspx for more information.

<xs:simpleType name="VolumeFileSystemFlagEnum">
  <xs:annotation>
    <xs:documentation>The FileSystemFlagEnum type is an enumeration of flags used by file systems on volumes, especially those on Windows Operating Systems. See http://msdn.microsoft.com/en-us/library/windows/desktop/aa364993(v=vs.85).aspx and http://msdn.microsoft.com/en-us/library/cc232101(v=prot.13).aspx for more information.</xs:documentation>
  </xs:annotation>
  <xs:list>
    <xs:simpleType>
      <xs:restriction base="xs:string">
        <xs:enumeration value="FILE_CASE_SENSITIVE_SEARCH">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports case-sensitive file names. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000001.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_CASE_PRESERVED_NAMES">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports preserved case of file names when it places a name on disk. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000002.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_UNICODE_ON_DISK">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports preserved case of file names when it places a name on disk. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000004.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_PERSISTENT_ACLS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume preserves and enforces access control lists (ACL). For example, the NTFS file system preserves and enforces ACLs, and the FAT file system does not. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000008.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_FILE_COMPRESSION">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports file-based compression. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000010.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_VOLUME_QUOTAS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports disk quotas. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000020.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_SPARSE_FILES">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports sparse files. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000040.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_REPARSE_POINTS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports re-parse points. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00000080.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_REMOTE_STORAGE">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports remote storage. This is not listed with a lpFileSystemFlags value in documentation, but corresponds to the FileSystemAttributes value 0x00000100.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_VOLUME_IS_COMPRESSED">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume is a compressed volume, for example, a DoubleSpace volume. This flag is incompatible with the FILE_FILE_COMPRESSION flag. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00008000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_OBJECT_IDS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports object identifiers. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00010000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_ENCRYPTION">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports encryption. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00020000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_NAMED_STREAMS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports named streams. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00040000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_READ_ONLY_VOLUME">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume is read-only. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00080000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SEQUENTIAL_WRITE_ONCE">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports a single sequential write. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00100000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_TRANSACTIONS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports transactions. For more information about transactions, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa365993(v=vs.85).aspx. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00200000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_HARD_LINKS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports hard links. For more information about hard links, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa365006(v=vs.85).aspx. Note that hard links are DIFFERENT from symbolic links. This value is ONLY supported for Windows Server 2008 R2 and Windows 7 and later. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00400000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_EXTENDED_ATTRIBUTES">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports extended attributes. An extended attribute is a piece of application-specific metadata that an application can associate with a file and is not part of the file's data. This value is ONLY supported for Windows Server 2008 R2 and Windows 7 and later. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x00800000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_OPEN_BY_FILE_ID">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports open by FileID. For more information about open by FileID, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa364226(v=vs.85).aspx. This value is ONLY supported for Windows Server 2008 R2 and Windows 7 and later. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x01000000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_USN_JOURNAL">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports unique service number (USN) journals. For more information about USN journals, see http://msdn.microsoft.com/en-us/library/windows/desktop/aa363803(v=vs.85).aspx. This value is ONLY supported for Windows Server 2008 R2 and Windows 7 and later. This corresponds to the lpFileSystemFlags and FileSystemAttributes value 0x02000000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
        <xs:enumeration value="FILE_SUPPORTS_INTEGRITY_STREAMS">
          <xs:annotation>
            <xs:documentation>Indicates that the specified volume supports integrity streams. Currently, this value is ONLY available for ReFS and Windows 8 Beta. This corresponds to the FileSystemAttributes value 0x04000000.</xs:documentation>
          </xs:annotation>
        </xs:enumeration>
      </xs:restriction>
    </xs:simpleType>
  </xs:list>
</xs:simpleType>

This attribute is optional and specifies the expected type for the value of the specified property.

<xs:attribute name="datatype" type="cyboxCommon:DatatypeEnum" fixed="string">
  <xs:annotation>
    <xs:documentation>This attribute is optional and specifies the expected type for the value of the specified property.</xs:documentation>
  </xs:annotation>
</xs:attribute>

The is_mounted field specifies whether the volume is mounted.

<xs:attribute name="is_mounted" type="xs:boolean">
  <xs:annotation>
    <xs:documentation>The is_mounted field specifies whether the volume is mounted.</xs:documentation>
  </xs:annotation>
</xs:attribute>

XML Schema documentation generated by <oXygen/>^® XML Editor.

Showing: