Data Standards for Cyber-Investigation: CASE, UCO, and WANDA

Data standards for cyber-investigation are formal, machine-readable schemas designed to represent digital forensic evidence, tool output, and investigative process in a consistent, tool-independent format. They exist to solve a persistent technical problem in digital forensics: different forensic tools each produce output in proprietary or inconsistent formats, making it difficult for analysts, or automated systems, to combine, cross-reference, and validate data across tools and cases. Three related efforts — the Unified Cyber Ontology (UCO), the Cyber-investigation Analysis Standard Expression (CASE), and the earlier, narrower WANDA standard — approach this problem from different angles, and a 2020 academic critique argues that none of them, on its own, fully satisfies the reliability requirements that legal admissibility standards and international forensic standards demand.

Data Standards at a Glance
UCO	Foundational cybersecurity ontology; broad scope
CASE	Cyber-investigation extension of UCO; artefact-oriented
WANDA	2001–2004 process-oriented standard, built for Daubert
Format	OWL 2 / Turtle (CASE, UCO)
License	Apache-2.0 (CASE, UCO)
Governance	The Linux Foundation, with DFRWS support
Key critique	Stoykova & Franke, SADFE 2020

1 The Interoperability Problem

A modern digital forensic investigation routinely draws on output from a dozen or more tools: an imaging tool that produces a bit-for-bit disk image, a mobile extraction platform that recovers application artifacts, a video-enhancement suite that generates a processing log, and a memory-forensics utility that flags suspicious processes. Each of these tools was built by a different vendor or open-source project, at a different time, with its own internal data model and export format. Some produce proprietary binary containers; others emit CSV, XML, or plain-text reports with no shared vocabulary for describing what a "file," an "email message," or a "network connection" actually is.

This fragmentation creates two distinct downstream problems. First, it is difficult for a human analyst to combine outputs from multiple tools into a single coherent timeline or case file without manual, error-prone reformatting. Second, and more consequentially for legal proceedings, it is difficult for anyone — analyst, opposing expert, or court — to independently verify how a given piece of digital evidence was derived, transformed, or interpreted as it moved from raw acquisition through a chain of tool outputs to a final human-readable conclusion. This second problem connects directly to the reliability criteria at the center of the Daubert framework: an expert's methodology must be testable, subject to known error rates, and reproducible. A forensic conclusion built on an unrecorded chain of proprietary tool transformations is difficult to test or reproduce even in principle.

Ontology-based data standards attempt to solve the first problem — cross-tool combination — directly, by defining a shared, machine-readable vocabulary that any tool vendor can adopt for its output. Whether they also solve the second, process-reliability problem is the central question examined in this article.

2 UCO: Unified Cyber Ontology

The Unified Cyber Ontology (UCO) is a community-developed foundational ontology intended to provide a single, consistent model for representing information across the entire cybersecurity domain, not merely cyber-investigation. Its scope extends to network defense, threat intelligence, malware analysis, vulnerability research, and offensive security, rather than each of these subdomains inventing its own incompatible data representation.

UCO defines general-purpose classes for cyber-relevant objects — items, tools, people, places — and their relationships, along with mechanisms for tracking the provenance of items and actions across an action life-cycle. Because it is deliberately broad, UCO functions as a base layer: other, more specialized ontologies (such as CASE) extend it to add domain-specific vocabulary for their narrower use case.

UCO is governed under The Linux Foundation, structured as an LF Projects, LLC series, with support from DFRWS (the Digital Forensic Research Workshop, a long-running academic and practitioner community for digital forensics research). Development occurs openly on GitHub.^[1]

3 CASE: Cyber-investigation Analysis Standard Expression

CASE is a domain-specific extension of UCO, purpose-built for cyber-investigations. It is a community-developed, ontology-based specification expressed in W3C OWL 2 (Web Ontology Language) using Turtle syntax, a compact, human-readable format for writing RDF (Resource Description Framework) data. The current stable release is v1.5.0, with v1.6.0 and v2.0.0 in development at the time of the underlying research.^[2]

CASE's stated goal is to enable automated normalization, combination, interoperability, and validation of heterogeneous information sources produced by different forensic tools. It achieves this through two central modeling concepts:

• Observable Objects — representations of data sources (mobile devices, storage media, memory images) and digital artifacts (files, chat and email messages, documents, multimedia, browser and log history).
• Facets — attachable property sets that describe specific characteristics of an Observable Object, allowing the same base object type to be extended with different descriptive detail depending on context.

Beyond describing artifacts themselves, CASE also models provenance and chain-of-custody structures, tracking investigative actions, actors, tools, and their relationships across the investigation lifecycle. Like UCO, CASE is governed under The Linux Foundation with DFRWS support, and is licensed under the permissive Apache-2.0 open-source license, allowing commercial forensic tool vendors to adopt it without licensing friction.

Despite this broad and actively maintained design, a 2020 academic paper identifies a structural gap in what CASE can represent — one with direct consequences for how digital evidence produced through CASE-compliant tools would hold up under admissibility scrutiny.

4 WANDA: A Process-Oriented Precursor

WANDA is a generic, process-oriented data standard originally developed between 2001 and 2004, considerably earlier than CASE or UCO, and built for a narrower initial purpose: forensic handwriting analysis and writer identification, specifically the annotation, processing, and storage of digitized handwritten documents. WANDA's defining historical feature is that it was developed explicitly in response to criticisms raised by the Daubert case^[3] — that is, its designers set out from the start to build a standard that could demonstrate the scientific reproducibility and reliability that Daubert v. Merrell Dow Pharmaceuticals, Inc. (1993) demanded of expert forensic methodology, at a time when much forensic document examination relied on subjective examiner judgment. See Daubert Standard for the underlying legal framework.

WANDA's core design goal was to let examiners demonstrate that a forensic tool treats all input data consistently, omits no data, and processes everything according to stated forensic objectives — directly countering the risk of subjective, opinion-based evaluation that Daubert's reliability factors were designed to screen out.

According to Stoykova and Franke (2020), WANDA's key structural advantage is that it is process-oriented rather than artefact-oriented. Concretely, this means WANDA:

• traces back and separately represents human-generated versus machine-generated annotations, so a reviewer can distinguish an examiner's judgment call from an automated processing step;
• documents objective measurements usable for independent algorithm evaluation; and
• separates data, graphical user interfaces, and processing modules for modular quality control, so each component of a tool's pipeline can be tested and validated independently.

WANDA was never designed to be a general-purpose cyber-investigation data model in the way CASE and UCO are; it originated in a narrower forensic-document context. Its significance for cyber-investigation standards lies in the reproducibility and process-transparency properties it demonstrates, not in its adoption as a general schema.

5 Stoykova and Franke (2020): The Artefact-Oriented Critique

Rositsa Stoykova and Katrin Franke's paper, "Standard Representation for Digital Forensic Processing," published in the Proceedings of the 13th International Conference on Systematic Approaches to Digital Forensic Engineering (SADFE 2020), pp. 46–56 (IEEE, DOI 10.1109/SADFE51007.2020.00014), provides the central critical analysis this article draws on.^[4]

The paper's central finding is that CASE is "artefact-oriented" and lacks process-level expressivity. In practice, this means CASE can richly describe what a digital artifact is, where it came from, and how it relates to other artifacts and actors in an investigation — but it does not necessarily capture how a tool's internal algorithm transformed raw input data into that artifact. A CASE-compliant record can state that a given file was recovered from a disk image by a named tool at a given time, but it does not, by design, document the algorithmic steps, parameter choices, or intermediate processing states that tool used to arrive at that recovered artifact.

Stoykova and Franke connect this gap directly to legal reliability standards. They cite EnCase as an example of a "complex tool" whose internal processing and outputs "cannot easily be reversed" — meaning that even a long-established, court-proven forensic suite is not currently required, and its architecture does not readily allow, the kind of transparent, step-by-step processing documentation that a genuinely reproducible scientific methodology would require under Daubert's reliability factors (testability, known error rate, and standards controlling operation). They similarly discuss open-source tools such as bulk_extractor in terms of the same reliability and validation questions, framed against ISO/IEC 27042, the international standard governing the analysis and interpretation of digital evidence — see International Forensic Standards for its continuity, validity, reproducibility, and repeatability requirements.

The practical consequence is that CASE, as currently specified, is well suited to solving the cross-tool combination problem described in Section 1, but is not, by itself, sufficient to solve the process-reliability problem that admissibility law demands.

6 The Proposed WANDA-Based Module for CASE

Having identified this gap, Stoykova and Franke propose integrating a "WANDA-based schema" as a new module within CASE. The intent is for CASE to gain WANDA's process- and reproducibility-documentation strengths — the human/machine annotation distinction, objective algorithm-evaluation measurements, and modular separation of data, interface, and processing components — while retaining CASE's own broader artefact and provenance representation, including its Observable Objects, Facets, and chain-of-custody modeling.

Note: as of the cited 2020 paper, this integration is a proposal, not an implemented standard. No verified evidence in the underlying research indicates that a WANDA-based module has since been formally adopted into a released CASE specification.

The proposal illustrates a recurring theme in forensic standards development: a broad, actively governed, industry-adopted schema (CASE) and a narrower, older, more rigorously process-focused schema (WANDA) each solve half of the same underlying problem, and combining their strengths is more straightforward to state as a research recommendation than to execute as a maintained, backward-compatible technical standard with buy-in from tool vendors.

7 Why This Matters for Admissibility

The distinction between artefact-oriented and process-oriented representation is not a purely academic modeling concern; it bears directly on how digital evidence is tested in court. Under the Daubert framework and its codification in Federal Rule of Evidence 702, a proponent of expert testimony must show that the testimony is the product of reliable principles and methods, and that those methods were reliably applied to the facts of the case. A forensic tool whose internal processing "cannot easily be reversed," in Stoykova and Franke's phrase, makes it difficult for an opposing expert, or a judge acting as gatekeeper, to independently assess whether the tool's methodology was in fact reliably applied in a given instance.

International standards move in the same direction as the WANDA-into-CASE proposal, without fully closing the gap on their own. ISO/IEC 27042:2015, discussed at International Forensic Standards, requires recording sufficient information about each analytical process so that it can be independently reviewed or reproduced by another qualified examiner — a requirement that aligns conceptually with WANDA's process-transparency goals, but ISO/IEC 27042 is a procedural and quality-assurance standard for laboratories and examiners, not a machine-readable data schema that tool vendors implement. CASE and UCO operate at the data-representation layer; ISO/IEC 27042 operates at the laboratory-process layer. None of the three, individually, gives a court a ready-made, tool-agnostic way to verify that a specific tool's specific algorithmic transformation of specific input data was executed correctly in a specific case.

8 Current Status and Limitations

As of the underlying research, UCO and CASE remain the actively governed, community-developed standards in this space, maintained under The Linux Foundation with DFRWS support and licensed Apache-2.0 to encourage broad tool-vendor adoption. WANDA remains a narrower, earlier standard whose main contribution to the present-day discussion is conceptual and historical: it demonstrates that a process-oriented, Daubert-responsive data standard was built once, for a specific forensic sub-discipline, roughly two decades before CASE's artefact-oriented gap was formally identified.

The Stoykova and Franke critique should be read as a diagnosis and a research proposal, not as evidence that CASE has failed or been superseded. CASE continues to address a real and serious interoperability problem across the fragmented landscape of commercial and open-source digital forensics tools. What remains unresolved — and what the WANDA-based module proposal was designed to address — is whether any single, widely adopted cyber-investigation data standard can simultaneously satisfy the practical need for cross-tool artifact interoperability and the legal need for process-level reproducibility demanded by admissibility doctrine and by international standards such as ISO/IEC 27042. No standard reviewed here fully closes that gap.

References

1. Unified Cyber Ontology (UCO) Project. unifiedcyberontology.org; github.com/ucoProject/UCO. https://github.com/ucoProject/UCO
2. Cyber-investigation Analysis Standard Expression (CASE) Community. caseontology.org; github.com/casework/CASE. https://caseontology.org/
3. Stoykova, R., & Franke, K. "Standard Representation for Digital Forensic Processing." 2020. Proceedings of the 13th International Conference on Systematic Approaches to Digital Forensic Engineering (SADFE 2020), pp. 46-56. IEEE. DOI: 10.1109/SADFE51007.2020.00014
4. Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993).
5. International Organization for Standardization / International Electrotechnical Commission. ISO/IEC 27042:2015. 2015. https://www.iso.org/standard/44406.html
6. OpenText (formerly Guidance Software). "EnCase Forensic" / "OpenText Forensic (EnCase)." https://www.opentext.com/products/forensic