Big data forensics--learning Hadoop investigations : perform forensic investigations on Hadoop clusters with cutting-edge tools and techniques / Joe Sremack.

Format:

Book

Author/Creator:

Sremack, Joe, author.

Series:

Community experience distilled.

Community Experience Distilled

Language:

English

Subjects (All):

Apache Hadoop.

Big data.

Forensic sciences.

Data mining.

Physical Description:

1 online resource (264 p.)

Edition:

1st ed.

Place of Publication:

Birmingham, [England] ; Mumbai, [India] : Packt Publishing, 2015.

Language Note:

English

Summary:

Perform forensic investigations on Hadoop clusters with cutting-edge tools and techniques About This Book Identify, collect, and analyze Hadoop evidence forensically Learn about Hadoop's internals and Big Data file storage concepts A step-by-step guide to help you perform forensic analysis using freely available tools Who This Book Is For This book is meant for statisticians and forensic analysts with basic knowledge of digital forensics. They do not need to know Big Data Forensics. If you are an IT professional, law enforcement professional, legal professional, or a student interested in Big Data and forensics, this book is the perfect hands-on guide for learning how to conduct Hadoop forensic investigations. Each topic and step in the forensic process is described in accessible language. What You Will Learn Understand Hadoop internals and file storage Collect and analyze Hadoop forensic evidence Perform complex forensic analysis for fraud and other investigations Use state-of-the-art forensic tools Conduct interviews to identify Hadoop evidence Create compelling presentations of your forensic findings Understand how Big Data clusters operate Apply advanced forensic techniques in an investigation, including file carving, statistical analysis, and more In Detail Big Data forensics is an important type of digital investigation that involves the identification, collection, and analysis of large-scale Big Data systems. Hadoop is one of the most popular Big Data solutions, and forensically investigating a Hadoop cluster requires specialized tools and techniques. With the explosion of Big Data, forensic investigators need to be prepared to analyze the petabytes of data stored in Hadoop clusters. Understanding Hadoop's operational structure and performing forensic analysis with court-accepted tools and best practices will help you conduct a successful investigation. Discover how to perform a complete forensic investigation of large-scale Hadoop clusters using the same tools and techniques employed by forensic experts. This book begins by taking you through the process of forensic investigation and the pitfalls to avoid. It will walk you through Hadoop's internals and architecture, and you will discover what types of information Hadoop stores and how to access that data. You will learn to identify Big Data evidence using techniques to survey a live system and interview witnesses. After setting up your own Hadoop system, you will collect evidence using techniques such as forensic imaging and application-based extractions. You will analyze Hadoop evidence using advanced tools and techniques to uncover events and statistical information. Finally, data visualization and evidence presentation techniques are covered to help you properly communicate your findings to any audience. Style and approach This book is a complete guide that follows every step of the forensic analysis process in detail. You will be guided through each key topic and step necessary to perform an investigation. Hands-on exercises are presented throughout the book, and technical reference guides and sample documents are included for real-world use."

Contents:

""Cover""; ""Copyright""; ""Credits""; ""About the Author""; ""About the Reviewers""; ""www.PacktPub.com""; ""Table of Contents""; ""Preface""; ""Chapter 1: Starting Out with Forensic Investigations and Big Data""; ""Computer forensics overview""; ""The forensic process""; ""Identification""; ""Collection""; ""Analysis""; ""Presentation""; ""Other investigation considerations""; ""Equipment""; ""Evidence management""; ""Investigator training and certification""; ""The post-investigation process""; ""What is Big Data?""; ""The four Vs of Big Data""; ""Big Data architecture and concepts""

""Big Data forensics""""Metadata preservation""; ""Collection methods""; ""Collection verification""; ""Summary""; ""Chapter 2: Understanding Hadoop Internals and Architecture""; ""The Hadoop architecture""; ""The components of Hadoop""; ""The Hadoop Distributed File System""; ""The Hadoop configuration files""; ""Hadoop daemons""; ""Hadoop data analysis tools""; ""Hive""; ""HBase""; ""Pig""; ""Managing files in Hadoop""; ""File permissions""; ""Trash""; ""Log files""; ""File compression and splitting""; ""Hadoop SequenceFile""; ""The Hadoop archive files""; ""Data serialization""

""Packaged jobs and JAR files""""The Hadoop forensic evidence ecosystem""; ""Running Hadoop""; ""LightHadoop""; ""Amazon Web Services""; ""Loading Hadoop data""; ""Importing sample data for testing""; ""Summary""; ""Chapter 3: Identifying Big Data Evidence""; ""Identifying evidence""; ""Locating sources of data""; ""Compiling data requirements""; ""Reviewing the system architecture""; ""Interviewing staff and reviewing the documentation""; ""Assessing data viability""; ""Identify data sources in noncooperative situations""; ""Data collection requirements""; ""Data source identification""

""Structured and unstructured data""""Data collection types""; ""In-house or third-party collection""; ""An investigator-led collection""; ""The chain of custody documentation""; ""Summary""; ""Chapter 4: Collecting Hadoop File System Data""; ""Forensically collecting a cluster system""; ""Physical versus remote collections""; ""HDFS collections through the host operating system""; ""Imaging the host operating system""; ""Imaging a mounted HDFS partition""; ""Targeted collection from a Hadoop client""; ""The Hadoop shell command collection""; ""Collecting HDFS files""

""HDFS targeted data collection""""Hadoop Offline Image and Edits Viewers""; ""Collection via Sqoop""; ""Other HDFS collection approaches""; ""Summary""; ""Chapter 5: Collecting Hadoop Application Data""; ""Application collection approaches""; ""Backups""; ""Query extractions""; ""Script extractions""; ""Software extractions""; ""Validating application collections""; ""Collecting Hive evidence""; ""Loading Hive data""; ""Identifying Hive evidence""; ""Hive backup collection""; ""Hive query collection""; ""Hive query control totals""; ""Hive metadata and log collection""

""The Hive script collection""

Notes:

Includes index.

Description based on online resource; title from PDF title page (ebrary, viewed November 19, 2015).

ISBN:

9781785281211

1785281216