Collecting evidence through Hadoop applications instead of HDFS offers a number of benefits. The applications offer a quicker, easier means to access the data. Rather than collecting data from each node of the cluster, applications bridge all of the nodes and offer a means to collect data from a single point. Many application-based collection methods also offer an up-front method to cull out the data and limit it to only the relevant data. This is a huge benefit when dealing with terabytes or petabytes of data. In the case of petabytes, a full collection is not currently feasible for most investigations. Application-based collections also make the analysis phase easier. Collecting data from applications enables the investigator to begin the analysis more quickly, instead of spending a large amount of time carving out data and piecing together the data.

Regardless of the application, the same process and concepts can be applied. This chapter focused on Hive and HBase, which are the...