Ruleset used by Autopsy