The previous two chapters covered the data collection process. Chapter 4, Collecting Hadoop Distributed File System Data discussed filesystem data collection, with a focus on how to collect Hadoop Distributed File System (HDFS) data in several different ways. Chapter 5, Collecting Hadoop Application Data, went through the process of collecting application-level Hadoop data. The analysis phase begins after the collection process, and the type(s) of analysis chosen depend on the collection method that was selected. This chapter covers examples of the main types of analyses that are conducted against the filesystem-level data collection, which was covered in Chapter 4, Collecting Hadoop Distributed File System Data.

Evidence collected from the HDFS filesystem can be analyzed in several ways. First, evidence can be reconstructed into its original format for analysis. This is typically the case when a Hadoop cluster is offline during...