Book Image

Big Data Forensics: Learning Hadoop Investigations

Book Image

Big Data Forensics: Learning Hadoop Investigations

Overview of this book

Table of Contents (15 chapters)
Big Data Forensics – Learning Hadoop Investigations
Credits
About the Author
About the Reviewers
www.PacktPub.com
Preface
Index

Pre-analysis steps


Several steps are performed before the analysis can be started. The data is first imported into the database. Some data is structured in a manner that cannot be imported and requires pre-load transformations. The data should be surveyed after the data has been loaded to understand the structure of the data, detect any anomalies, and determine which data require transformations. Based on the results of the data survey process, the data may require transformations before it can be analyzed.

This process can be iterative. The data may require a series of transformations, and after each transformation, a data survey needs to be performed to assess whether any further transformations are required. The following figure illustrates the steps and iterative nature of the pre-analysis process:

Figure 2: Transformed records

Loading data

The collected evidence is next loaded into SQL Server. Relational databases systems store data in databases comprised of tables. With forensic evidence...