Contribute
The IoI Framework is community-driven. You do not need to know SPARQL or JSON-LD to contribute — there is a path for every technical level. Pick the level that fits you.
Three levels of contribution
You have encountered an anti-forensic technique and can describe it in plain language. Open a GitHub issue using the Ground Truth template: describe the artifacts involved, the expected invariant, what was missing or inconsistent, and how you detected it. No fork, no SPARQL, no JSON needed — maintainers or Level 2 contributors formalize it into a rule.
You are comfortable with SPARQL and JSON-LD. Take a validated ground truth document (from a Level 1 issue or your own case) and write the corresponding CASE/UCO JSON-LD template and IoI SPARQL signature. The core community contribution focus is templates and SPARQL rules — instantiators are mostly maintained by the core team.
You want to add support for a new artifact type or parser — writing a Template Instantiator that maps its CSV/JSON output to CASE/UCO JSON-LD graphs. You can also contribute Autopsy plugins or other tool-specific integrations that execute IoI rules directly within your forensic workflow.
PR workflow Level 2 & 3
Fork and branch
Fork ioi-framework/ioi-framework ↗ and create a descriptive branch.
git checkout -b add/your-scenario-nameUse add/, fix/, or docs/ prefixes. You do not need a final ID — maintainers assign the canonical ID during review.
Add your files
Follow the schemas in CONTRIBUTING.md ↗. Set status: Community and your GitHub handle as contributor. Use a placeholder ID if unsure — reviewers will finalize it.
CASES/AF-NEW/
ground_truth.md
test/
<artifact>_test.jsonld # synthetic graph that makes the rule fire
RULES/temporal/
IOI-NEW_your_rule.rq
For the test graph structure: if an existing case uses the same artifact, copy from its CASES/AF-NNN/snippets/. If it is a new artifact type, use instantiators/templates/{artifact_type}/ as reference. Use synthetic values — no real case data.
Validate locally
Run the front-matter validator before pushing. CI runs it again on every PR — catch errors locally first.
python scripts/validate_frontmatter.pyOpen a Pull Request
The PR template auto-loads with a checklist. Fill out every section: artifacts involved, ground truth summary, and SPARQL query result confirming the rule fires on post-manipulation data.
Review and merge
CI validates front matter and linked files. A maintainer reviews within 14 days. Once merged the site deploys automatically — your case and rule appear on the index pages under Community status.
Status lifecycle
| Status | Meaning | How to achieve |
|---|---|---|
| Community | Contributed by a community member, not independently validated | Default for all new contributions |
| ✓ Validated | Independently reproduced or reviewed by the core maintainer team | Open a PR adding a validation_note and tagging a maintainer |
| Deprecated | Superseded, known-broken, or no longer applicable | Maintainer decision; original content preserved for reference |