Book Image

Big Data Forensics: Learning Hadoop Investigations

Book Image

Big Data Forensics: Learning Hadoop Investigations

Overview of this book

Table of Contents (15 chapters)
Big Data Forensics – Learning Hadoop Investigations
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Index

Validating application collections


Collecting application data requires a different form of information for validation. Validating a collection involves proving the following:

  • The collection was performed correctly and completely

  • The collected data is a replica of the source system's data

Unlike file-based collection methods, record-based collections compiled through an application are not typically validated with hash values. Hash values are useful for proving that data was not modified and that the collection was performed correctly. Supplemental information (for example, collection logs) is used to prove that the collection was performed completely. The use of hash values, however, is not always appropriate for application collections. There are several reasons why hash values are not used to validate application collections:

  • It is not necessary to calculate hash values because of the absence of metadata or other artifacts that are collected

  • Large data volumes make computing hash values infeasible...