Book Image

Big Data Forensics: Learning Hadoop Investigations

Book Image

Big Data Forensics: Learning Hadoop Investigations

Overview of this book

Big Data forensics is an important type of digital investigation that involves the identification, collection, and analysis of large-scale Big Data systems. Hadoop is one of the most popular Big Data solutions, and forensically investigating a Hadoop cluster requires specialized tools and techniques. With the explosion of Big Data, forensic investigators need to be prepared to analyze the petabytes of data stored in Hadoop clusters. Understanding Hadoop’s operational structure and performing forensic analysis with court-accepted tools and best practices will help you conduct a successful investigation. Discover how to perform a complete forensic investigation of large-scale Hadoop clusters using the same tools and techniques employed by forensic experts. This book begins by taking you through the process of forensic investigation and the pitfalls to avoid. It will walk you through Hadoop's internals and architecture, and you will discover what types of information Hadoop stores and how to access that data. You will learn to identify Big Data evidence using techniques to survey a live system and interview witnesses. After setting up your own Hadoop system, you will collect evidence using techniques such as forensic imaging and application-based extractions. You will analyze Hadoop evidence using advanced tools and techniques to uncover events and statistical information. Finally, data visualization and evidence presentation techniques are covered to help you properly communicate your findings to any audience.
Table of Contents (10 chapters)
9
Index

Types of reports


Findings are typically presented in writing, but they can also be accompanied by various types of in-person presentations. There are several types of reports, depending on the nature of the investigation. The first is an internal report. These reports are formal but do not require specific legal formatting or standard language. The second is an affidavit, which is a sworn statement that can be admitted as evidence in court. The third is a declaration. Declarations are intended as statements of facts that are submitted to a court. The fourth is an expert report, and this is evidence that can be submitted by a subject matter expert about a particular set of facts and findings in a case. The forensic investigator can also be called to provide an in-person presentation based on the report, which can be in the form of a deposition, testimony, or a non-legal, question-and-answer meeting.

The following table summarizes the types of reports an investigator may be asked to write:

...