Big Data Forensics: Learning Hadoop Investigations

Perform forensic investigations on Hadoop clusters with cutting-edge tools and techniques

About This Book

• Identify, collect, and analyze Hadoop evidence forensically
• Learn about Hadoop's internals and Big Data file storage concepts
• A step-by-step guide to help you perform forensic analysis using freely available tools

Who This Book Is For

This book is meant for statisticians and forensic analysts with basic knowledge of digital forensics. They do not need to know Big Data Forensics. If you are an IT professional, law enforcement professional, legal professional, or a student interested in Big Data and forensics, this book is the perfect hands-on guide for learning how to conduct Hadoop forensic investigations. Each topic and step in the forensic process is described in accessible language.

What You Will Learn

• Understand Hadoop internals and file storage
• Collect and analyze Hadoop forensic evidence
• Perform complex forensic analysis for fraud and other investigations
• Use state-of-the-art forensic tools
• Conduct interviews to identify Hadoop evidence
• Create compelling presentations of your forensic findings
• Understand how Big Data clusters operate
• Apply advanced forensic techniques in an investigation, including file carving, statistical analysis, and more

In Detail

Big Data forensics is an important type of digital investigation that involves the identification, collection, and analysis of large-scale Big Data systems. Hadoop is one of the most popular Big Data solutions, and forensically investigating a Hadoop cluster requires specialized tools and techniques. With the explosion of Big Data, forensic investigators need to be prepared to analyze the petabytes of data stored in Hadoop clusters. Understanding Hadoop's operational structure and performing forensic analysis with court-accepted tools and best practices will help you conduct a successful investigation.

Discover how to perform a complete forensic investigation of large-scale Hadoop clusters using the same tools and techniques employed by forensic experts. This book begins by taking you through the process of forensic investigation and the pitfalls to avoid. It will walk you through Hadoop's internals and architecture, and you will discover what types of information Hadoop stores and how to access that data. You will learn to identify Big Data evidence using techniques to survey a live system and interview witnesses. After setting up your own Hadoop system, you will collect evidence using techniques such as forensic imaging and application-based extractions. You will analyze Hadoop evidence using advanced tools and techniques to uncover events and statistical information. Finally, data visualization and evidence presentation techniques are covered to help you properly communicate your findings to any audience.

Style and approach

This book is a complete guide that follows every step of the forensic analysis process in detail. You will be guided through each key topic and step necessary to perform an investigation. Hands-on exercises are presented throughout the book, and technical reference guides and sample documents are included for real-world use.