A Study on Digital Forensics in Hadoop

Thanekar, Sachin Arun; Subrahmanyam, K.; Bagwan, A. B.

doi:10.11591/ijeecs.v4.i2.pp473-478

Cited by 6 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Adedayo et al [32] presented new challenges and opportunities for forensic analysis of large-scale data such as identification, collection, organization, preservation, and presentation. Thaneker et al [33] proposed a forensic framework on largescale data that uses Hadoop for storing and managing forensic evidence, and used Autopsy, an open-source forensic tool, for file carving, data carving, and keyword searching.…”

Section: Big Data Forensicsmentioning

confidence: 99%

Large-scale digital forensic investigation for Windows registry on Apache Spark

Lee

Kwon

2022

PLoS ONE

View full text Add to dashboard Cite

In this study, we investigate large-scale digital forensic investigation on Apache Spark using a Windows registry. Because the Windows registry depends on the system on which it operates, the existing forensic methods on the Windows registry have been targeted on the Windows registry in a single system. However, it is a critical issue to analyze large-scale registry data collected from several Windows systems because it allows us to detect suspiciously changed data by comparing the Windows registry in multiple systems. To this end, we devise distributed algorithms to analyze large-scale registry data collected from multiple Windows systems on the Apache Spark framework. First, we define three main scenarios in which we classify the existing registry forensic studies into them. Second, we propose an algorithm to load the Windows registry into the Hadoop distributed file system (HDFS) for subsequent forensics. Third, we propose a distributed algorithm for each defined forensic scenario using Apache Spark operations. Through extensive experiments using eight nodes in an actual distributed environment, we demonstrate that the proposed method can perform forensics efficiently on large-scale registry data. Specifically, we perform forensics on 1.52 GB of Windows registry data collected from four computers and show that the proposed algorithms can reduce the processing time by up to approximately 3.31 times, as we increase the number of CPUs from 1 to 8 and the number of worker nodes from 2 to 8. Because the distributed algorithms on Apache Spark require the inherent network and MapReduce overheads, this improvement of the processing performance verifies the efficiency and scalability of the proposed algorithms.

show abstract

Section: Big Data Forensicsmentioning

confidence: 99%

Large-scale digital forensic investigation for Windows registry on Apache Spark

Lee

Kwon

2022

PLoS ONE

View full text Add to dashboard Cite

show abstract

“…Recent works on media file forensic, such as audio, photo, and video were also found in [11], [12]- [13], respectively, as well as digital forensic on Hadoop [14]. In [11], an audio forensic on identical microphones was conducted using statistical based method, while in [12] an algorithm on photo forensic was proposed in order to detect image manipulation using error level analysis.…”

Section: Introductionmentioning

confidence: 99%

“…Forgery detection on video inter-frame had also been conducted in [13] for survellance and mobile recorded videos. As popularity of big data analysis has been flourish in recent days, [14] conducted a study on digital forensic in Hadoop.…”

Section: Introductionmentioning

confidence: 99%