Authors: Cory Hall
DFRWS APAC 2026
Abstract
Digital investigations increasingly require investigators, analysts, researchers, and tool developers to combine information from heterogeneous sources, including warrant returns, cloud service provider records, open-source search results, forensic tool exports, spreadsheets, case notes, and other structured or semi-structured data. These sources often contain valuable investigative leads, but they are commonly delivered in inconsistent formats, with different field names, ambiguous identifiers, incomplete provenance, and limited support for validation or exchange between tools. Project VIC International has sponsored the development of the free and open-source CASE/UCO software development kit that addresses these problems by making it easy to analyze and serialize any cyber or cyber-adjacent investigation data into knowledge graphs using open ontologies from the Linux Foundation’s Cyber Domain Ontology project and Project VIC International.
Learning Objectives
Participants will leave with:
- A working understanding of how CASE/UCO can normalize cyber investigation data
- Practical exposure to the open-source CASE/UCO SDK
- Experience using or observing Link-Look on representative investigative data
- A clearer understanding of how ontology-based modeling can support digital forensic interoperability
- Learn how the SDK can model SOLVE-IT to help you plan and review your digital forensics examination approach
- Learn how the SDK can model investigation data from crimes against children cases, and many other types of cases
- Learn how Project VIC International’s volunteer team builds and maintains these technologies, and how participants can join this nonprofit charitable effort if they choose
- Develop ideas for future research, validation, synthetic dataset development, and tool integration
Target experience level
This workshop is for analysts, investigators, forensic examiners, and capability developers at all levels of experience. You should join this workshop if you think data and analytic interoperability between tools, teams, agencies, and countries is important.
Workshop description
This four-hour hands-on workshop introduces attendees to the DFRWS and Linux Foundation supported Cyber-investigative Analysis Standard Expression and Unified Cyber Ontology (CASE/UCO) ontologies, the new open-source CASE/UCO software development kit (SDK), and Project VIC’s experimental Link-Look tool. The workshop will show how ontology-based modeling can help normalize investigative data, preserve source context, support structured review, and help investigators identify potential leads across multiple investigative data sources while avoiding unsupported conclusions.
The workshop will begin with a practical introduction to UCO and CASE: what they are, what investigative concepts they represent, and how they support interoperability across cyber, digital forensic, and law enforcement workflows. Attendees will then learn how the open-source CASE/UCO SDK can be used to create typed investigative graph objects, validate required fields, create extension ontologies and change proposals, serialize interoperable JSON-LD, and support repeatable data exchange across tools and programming languages.
The second half of the workshop will focus on Link-Look, an experimental desktop application that lets users import files, normalize the content with the CASE/UCO SDK, present the normalized data in a graph view, search the graph, find connections, and export the findings. Attendees will be able to help shape the future direction of Link-Look development, and join Project VIC as a volunteer if they would like to participate.
This is not a commercial product workshop. CASE/UCO and the CASE/UCO SDK are open-source community efforts. Link-Look is Project VIC International’s approach to putting a workflow application on top of it to find relationships and investigative leads. The goal of the workshop is to educate attendees, demonstrate the current state of the technology, gather feedback from the DFRWS community, and invite practitioners, researchers, developers, ontology contributors, and law enforcement partners to participate in continued development, testing, mapping design, validation, documentation, and workflow evaluation.
The presenter will provide:
- Workshop slides
- Synthetic warrant return examples
- Synthetic open-source search result examples
- Hands-on exercise instructions
- Sample CASE/UCO mappings
- Link-Look installation or demonstration instructions
- References to the CASE/UCO SDK GitHub repository
- References to the Linux Foundation Cyber Domain Ontology project and CASE/UCO documentation
- Contributor guidance for Project VIC, Link-Look, the CASE/UCO SDK, and related ontology mapping work
Preparation details
A laptop that can run a Docker container with Apache Jena Fuseki graph database, Rust to run Link-Look. Laptops can run Windows, Linux or Mac. Windows laptops will need to run Docker Desktop. The SDK’s mcp server can be run using AI agents such as Cursor or Hermes.
15 GB of storage.
The workshop venue will have internet for participants, but the presenter will also bring everything for distribution to attendees via thumb-drive.
Biography
 Cory Hall serves as Chief Executive Officer and President of the Board of Directors of Project VIC International, a USA-based nonprofit that focuses on providing crimes against children investigators with technical intelligence, analytic frameworks, tools, and education to find and rescue children from sexual exploitation and abuse. Cory’s career was shaped in national security roles spanning cybersecurity and intelligence, where he repeatedly saw the urgent need for stronger capabilities in the ICAC mission. He previously served at the MITRE Corporation as a Group Leader, Project Leader, and Principal Cybersecurity Engineer, leading R&D teams that developed cyber-domain analysis methods, machine learning applications for cybercrime data, and new approaches to digital forensic examination. He holds an M.S. in Cybersecurity and a B.S. in Information Technology, is a U.S. Army veteran, and participates in professional communities supporting high-integrity digital investigations, including INTERPOL-led working groups, the American Academy of Forensic Sciences (AAFS), DFRWS, and SWGDE. Cory is the chair of the Linux Foundation’s Cyber Domain Ontology project.
|