1. In this session, you will learn to:
Objectives
In this session, you will learn to:
Identify the XML Document Object Model
Validate an XML document against an XML schema using the Document Object Model
Apply a Style Sheet to an XML document
Introduce the students to the course by asking them what they know about forensics. Next, ask the students what they know about system forensics and why is it required in organizations dependent on IT. This could be a brief discussion of about 5 minutes.
Lead the discussion to the objectives of this chapter.

2. Identifying the XML Document Object Model
DOM defines the logical structure of documents.
DOM provides an Application Programming Interface (API) for dynamically accessing and manipulating a document.
The DOM objects have associated methods and properties to access and manipulate a document.
A DOM-enabled parser is required to use the features provided by DOM.
A DOM-enabled parser:
Parses an XML document to ascertain its validity.
Creates an in‑memory representation of the XML document as a tree structure.
Introduce the students to the different types of threats that systems face by:
Asking the students to give examples of what they think are environmental and human threats.
Asking the students to give instances of what they think are malicious and non-malicious threats.
Conclude the discussion on the different types of threats by giving additional examples of malicious and non malicious threats.

3. Implementation of DOM in MSXML Parser
Is the Microsoft implementation of DOM.
Provides fundamental as well as added interfaces to access documents.
The following figure represents how a DOM tree is used by applications to access data.
XML
Document
MSXML Library
Introduce the students to the different types of threats that systems face by:
Asking the students to give examples of what they think are environmental and human threats.
Asking the students to give instances of what they think are malicious and non-malicious threats.
Conclude the discussion on the different types of threats by giving additional examples of malicious and non malicious threats.
DOM
Tree
Parser
Parsed
Document
Application
Root
Child
Text

4. XML DOM Objects and Methods
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

5. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
It is the top-level object that implements all the basic DOM methods.
It also has methods that support XSLT.
It has methods that can be used to navigate, query, and modify the content and structure of an XML document.
Some of the methods provided by this object are createElement(), createAttribute(), createComment() , and createTextNode().
Some of the properties provided by this object that help in manipulating the information contained in the object are async, childNodes, firstChild, documentElement, xml, and readyState.
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

6. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
It represents all the element nodes in an XML document.
The attributes associated with the elements are considered to be the properties of the elements rather than their child elements.
Some of the methods of this object are also inherited from the Node object.
Some of the methods provided by this object are getAttribute(), getElementsByTagName(), normalize(), and removeAttributeNS().
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

7. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
It represents a single node in the XML document tree structure.
It provides methods to work with child elements.
Some of the methods of this object are
appendChild(newChild), insertBefore(newNode,refNode), and removeChild(nodeName).
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

8. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
It provides a list of nodes present in an XML document for manipulation.
This object enables you to iterate through a collection of nodes.
Some of the method of this object are item() and nextNode().
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

9. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
It represents an attribute of the Element object.
It is also a Node and inherits various attributes and methods of Node object.
An attribute is not considered by the DOM to be a child node of an element, but rather a property.
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

10. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
It represents the text inside an XML element in the node tree.
The splitText() method is associated with this object.
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

11. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
It represents the CDATA sections in the node tree.
This node is used to escape the parts of text that normally would be recognized as markup.
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.

12. XML DOM Objects and Methods (Contd.)
Following are the key DOM objects:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
Hold a two- three minute discussion on the different types of system-related crimes that the students have experienced or heard.
At the end of the discussion, give additional examples of system-related crimes.
It returns information about the most recent parse error.
It provides properties to retrieve information, such as the error code, the error text, and the line that caused the error.
Some of the properties of this object are errorCode, reason, line, and srcText.

13. XML DOM Objects in Scripts
The DOM objects can be used within scripting languages such as JavaScript and VBScript.
Using DOM objects in scripts allow dynamically applying a style sheet to an XML document.
The code for using DOM objects for accessing an XML document needs to be used as an HTML page.
Elaborate on the role that system forensics plays in an organization, based on the discussion in the previous slide and the information given on this slide.

14. Validating an XML Document Against an XML Schema Using DOM
Used to validate XML documents against XML schemas.
Ensures proper grammar and proper formation of the XML document.
DOMDocument object:
Main object in a DOM.
Represents the top node in every document tree.
Used to load an XML document, parse it, and validate it.
XMLSchemaCache object:
Loads the schema document associated with the XML document.
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

15. Accessing an XML Document by Using the XMLSchemaCache Object
Used to hold a collection of schema documents that specifies the rules to which XML documents must conform.
Following table describes some methods provided by the XMLSchemaCache object.
Method
Description
add(namespaceURI, variable)
This method adds a new schema to the collection and also associates the specified namespaceURI with the schema.
addCollection(XMLSchemaCollection object)
This method adds schemas from other schema collections. It also ensures that the namespaceURIs of the different schemas do not clash.
get(namespaceURI)
This method returns a node that contains the <schema> element.
namespaceURI(index number)
This method returns the namespace that is associated with the schema at the specified index number.
remove(namespaceURI)
This method removes a schema from a collection.
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

16. Validating an XML Document Against the Schema
To write a script that validates an XML document against the schema, you need to follow the given tasks:
Create the user interface to accept the name of the XML document and the XML schema.
Write the code to load the XML document.
Write the code to add the XML schema in the XMLSchemaCache object.
Write the code to validate the XML document against the schema.
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

17. Demo: Validating an XML Document
Problem Statement:
The head office of CyberShoppe receives data in the form of XML documents from its branches. In order to ensure the consistency of data sent by the branches, the head office maintains the definitions for the structures of documents in schemas. After receiving data from the branches, the head office needs to verify that the data conforms to the schema of the respective document. For this, the head office needs to write a script that validates the data stored in an XML document against a schema. You will initially do the testing for the product.xml file.
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

18. Applying a Style Sheet to an XML Document
Style sheet object that passes into the transformNode method needs to be recompiled every time the method is called.
Compiling a style sheet means setting all its template rules in an executable state.
Using the XSLTemplate object and the XSLProcessor object to perform transformation facilitates the following:
Reduction of overheads
Increase in the performance of an XSLT application
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

19. The XSLTemplate Object
Is a DOM object that is used to access an XSLT style sheet.
Used to hold a cached style sheet that can then be dynamically associated with an XML document.
Before a style sheet document can be applied to an XML document, it is converted into a tree structure by the parser.
XSLT tree structure is loaded into the memory of the computer and used to process the XML document.
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

20. var xslprocobj= xsltobj.createProcessor();
The XSLProcessor Object (Contd.)
Used to apply a style sheet to an XML document and then process that document.
Applies the given XSLT document to a specific XML document.
Transforms an XML document by using the XSLT style sheet.
JavaScript code to create an XSLProcessor object is as follows:
var xslprocobj= xsltobj.createProcessor();
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

21. Demo: Applying a Style Sheet to an XML Document During Run Time
Problem Statement:
CyberShoppe sells its products through an e-commerce Web site. Product details, such as product name, description, price, and quantity, need to be displayed.
A customer can choose to view the product details either as a table or as a bulleted list.
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

22. Exercises Problem Statement:
The following XML document, customer.xml contains customer details:
<?xml version="1.0"?>
<CUSTOMER>
<CUSTOMERNAME>Harold Johnson</CUSTOMERNAME>
<ADDRESS>56, Regent Road</ADDRESS>
<CITY>London</CITY>
<COUNTRY>UK</COUNTRY>
<PHONE> </PHONE>
</CUSTOMER>
Create a Web page that accepts the name of the XML file in a text box. When you click the Submit hyperlink, a JavaScript code should load the XML document and extract the CUSTOMERNAME element. The address and phone number should be changed to 94, McFarlane Avenue and , respectively, by using XML DOM objects.
While explaining the definition of system forensics, ask the students to note the following key words in the definition:
Identify
Extract
Process
Analyze
Digital and hardware evidence
Tell the students that these form an integral aspect of system forensics and would be discussed in detail.
Before moving on to the next slide, hold a brief discussion on why is it important for organizations to take the help of system forensics. The discussion should be focused on:
The role that system forensics plays in organizations having an IT set up.
This discussion will serve as a precursor to the next slide.

23. Practice Questions
Which of the following methods of the DOMDocument object will you use to create an element node that has a namespace prefix associated with it?
a. createElement()
b. createTextNode()
c. createNode()
d. createAttribute()
Reiterate the concepts taught earlier by asking the given question.
Answer:
c. createNode()

24. Practice Questions
You have written a script to load an XML document and validate it against a schema. Which of the following properties of the DOMDocument object will you use to ensure that the script waits till the XML document is loaded before executing the rest of the code?
a. async
b. readyState
c. documentElement
d. xml
Reiterate the concepts taught earlier by asking the given question.
Answer:
a. async

25. Practice Questions
Which of the following properties of the IXMLDOMNode object will you use to return the text associated with a node?
a. nodeName
b. xml
c. nodeType
d. nodeValue
Reiterate the concepts taught earlier by asking the given question.
Answer:
d. nodeValue

26. Practice Questions
Which of the following properties of the IXMLDOMParseError object will you use to retrieve the string containing the line that caused an error while parsing an XML document?
a. srcText
b. linePos
c. reason
d. line
Reiterate the concepts taught earlier by asking the given question.
Answer:
a. srcText

27. Practice Questions
Which one of the following is an object that represents the complete XML document map?
a. IXMLDOMNode
b. DOMDocument
c. IXMLDOMNodeList
d. IXMLDOMParseError
Reiterate the concepts taught earlier by asking the given question.
Answer:
b. DOMDocument

28. In this session, you learned that:
Summary
In this session, you learned that:
The XMLSchemaCache object is used to associate an XML document with an XSD document.
The XMLSchemaCache object is used to hold a collection of schema documents that specifies the rules to which XML documents must conform.
The XSLTemplate object is used to access an XSLT style sheet.
The XSLProcessor object is used to apply style sheets on a given XML document.
The XSLProcessor object is created using the createProcessor() method.
The XSLProcessor object is associated with an XML document by using the input property of the XSLProcessor object.

29. Summary (Contd.)
The XSLProcessor object provides the transform() method to transform an XML document according to the information provided in an XSLT style sheet.
DOM is an application-programming interface that allows an application to access the contents of an XML document.
DOM objects allow you to access and manipulate XML documents.
The MSXML parser loads an XML document and creates a tree structure that represents the various components of the XML document.
The basic building block of the tree structure is a node. A node is a container that holds information about the elements, attributes, and content stored in an XML document.

30. Summary (Contd.)
Some DOM objects that are used to manipulate data in a document are:
Document
Element
Node
NodeList
Attr
Text
CDataSection
ParseError
The Document object is the top-level object in the XML DOM. This object provides various properties and methods that help you to navigate, query, and modify the content and structure of XML documents.
The Element object represents all the element nodes in a document.

31. Summary (Contd.)
The Node object represents a node in the XML document structure. This object provides methods to work with the child elements.
The NodeList object allows you to iterate through a collection of nodes.
The Attr object represents an attribute of an Element object.
The Text object represents the text inside an XML element in the node tree.
The ParseError object returns information about the most recent parse error.