Title
HDFS file operation fingerprints for forensic investigations
Abstract
Understanding the Hadoop Distributed File System (HDFS) is currently an important issue for forensic investigators because it is the core of most Big Data environments. The HDFS requires more study to understand how forensic investigations should be performed and what artifacts can be extracted from this framework. The HDFS framework encompasses a large amount of data; thus, in most forensic analyses, it is not possible to gather all of the data, resulting in metadata and logs playing a vital role. In a good forensic analysis, metadata artifacts could be used to establish a timeline of events, highlight patterns of file-system operation, and point to gaps in the data.
Year
DOI
Venue
2018
10.1016/j.diin.2017.11.004
Digital Investigation
Keywords
DocType
Volume
Digital forensic,Hadoop,HDFS,Log analysis,Metadata forensics
Journal
24
ISSN
Citations 
PageRank 
1742-2876
0
0.34
References 
Authors
6
3
Name
Order
Citations
PageRank
Mariam Khader111.98
Ali Hadi201.35
Ghazi Al-Naymat315413.68