Book Image

Big Data Forensics: Learning Hadoop Investigations

Book Image

Big Data Forensics: Learning Hadoop Investigations

Overview of this book

Table of Contents (15 chapters)
Big Data Forensics – Learning Hadoop Investigations
About the Author
About the Reviewers

Identifying evidence

Identifying evidence is a complex process. It involves surveying a set of possible sources of evidence and determining which sources warrant collection. Data in any organization's systems is rarely well organized or documented. Investigators will need to take a set of investigation requirements and determine which data needs to be collected. This requires the following steps:

  • Properly reviewing system and data documentation

  • Interviewing staff

  • Locating backup and noncentralized data repositories

  • Previewing data

The process of identifying Big Data evidence is made difficult by the large volume of data, distributed filesystem, the numerous types of data, and the potential for large-scale redundancy in evidence.

Big Data solutions are also unique since evidence can reside in different layers within it. Within Hadoop, evidence can take on multiple forms, as described in Chapter 2, Understanding Hadoop Internals and Architecture. To properly identify the evidence in Hadoop, multiple...