Hadoop集群取证：大数据法医分析实战

需积分: 9 187 浏览量更新于2024-07-21 收藏 12.07MB PDF 举报

"Big Data Forensics - Learning Hadoop Investigations" 是一本由PACKT于2015年出版的专业书籍，旨在教导读者如何利用尖端工具和技术对大规模Hadoop集群进行数字调查。这本书针对大数据法证，即在大数据环境中识别、收集和分析证据的过程。随着大数据的爆发式增长，对存储在Hadoop集群中的海量数据进行法证分析变得至关重要。本书由Joe Sremack撰写，首先介绍了法证调查的整个过程以及需要注意的陷阱。作者深入讲解了Hadoop的内部结构和架构，帮助读者理解Hadoop存储何种类型的信息以及如何访问这些数据。书中详细阐述了识别大数据证据的方法，包括如何调查运行中的系统和如何访谈目击者。在"www.it-ebooks.info"上可以找到该书的相关信息，读者可以通过这本书学习到： 1. **Hadoop基础**：了解Hadoop的分布式文件系统（HDFS）和MapReduce处理模型，这对理解Hadoop集群的工作原理至关重要。 2. **法证调查流程**：学习遵循法院认可的流程，从初步调查到证据保全，再到数据分析。 3. **数据采集与保全**：掌握在不破坏原始数据的情况下收集证据的技术和策略。 4. **Hadoop数据分析**：学习如何提取和解析Hadoop存储的复杂数据格式，如日志文件、用户行为数据等。 5. **取证工具**：探索适用于Hadoop环境的专门取证工具，如Cloudera Impala、Apache Hive等用于查询的工具，以及Ambari等管理工具在调查中的应用。 6. **案例研究**：通过实际案例分析，加深对Hadoop集群法证的理解，学习如何处理不同类型的犯罪或违规行为。 7. **法律合规性**：理解如何确保在整个调查过程中遵守法规，避免潜在的法律问题。 8. **现场调查技巧**：学习如何访谈相关人员以获取关键信息，以及如何在现场安全地调查Hadoop集群。这本书对于大数据安全专家、法证分析师、信息安全专业人员以及希望深入了解大数据法证的IT从业者来说，是一本宝贵的资源。通过学习，读者将具备在大数据环境下进行有效调查和取证的能力，以应对日益复杂的数据安全挑战。

Table of Contents

[ v ]

Chapter 8: Presenting Forensic Findings 217

Types of reports 218

Sample reports 218

Internal investigation report 219

Afdavit and declaration 220

Expert report 221

Developing the report 223

Explaining the process 223

Showing the ndings 225

Using exhibits or appendices 227

Testimony and other presentations 227

Summary 229

Index 231

www.it-ebooks.info

[ vii ]

Preface

Forensics is an important topic for law enforcement, civil litigators, corporate

investigators, academics, and other professionals who deal with complex digital

investigations. Digital forensics has played a major role in some of the largest

criminal and civil investigations of the past two decades—most notably, the Enron

investigation in the early 2000s. Forensics has been used in many different situations.

From criminal cases, to civil litigation, to organization-initiated internal investigations,

digital forensics is the way data becomes evidence—sometimes, the most important

evidence—and that evidence is how many types of modern investigations are solved.

The increased usage of Big Data solutions, such as Hadoop, has required new

approaches to how forensics is conducted, and with the rise in popularity of Big Data

across a wide number of organizations, forensic investigators need to understand how

to work with these solutions. The number of organizations who have implemented Big

Data solutions has surged in the past decade. These systems house critical information

that can provide information on an organization's operations and strategies—key areas

of interest in different types of investigations. Hadoop has been the most popular of

the Big Data solutions, and with its distributed architecture, in-memory data storage,

and voluminous data storage capabilities, performing forensics on Hadoop offers new

challenges to forensic investigators.

A new area within forensics, called Big Data forensics, focuses on the forensics of Big

Data systems. These systems are unique in their scale, how they store data, and the

practical limitations that can prevent an investigator from using traditional forensic

means. The eld of digital forensics has expanded from primarily dealing with desktop

computers and servers to include mobile devices, tablets, and large-scale data systems.

Forensic investigators have kept pace with the changes in technologies by utilizing

new techniques, software, and hardware to collect, preserve, and analyze digital

evidence. Big Data solutions, likewise, require different approaches to analyze the

collected data.

www.it-ebooks.info

Preface

[ viii ]

In this book, the processes, tools, and techniques for performing a forensic

investigation of Hadoop are described and explored in detail. Many of the concepts

covered in this book can be applied to other Big Data systems—not just Hadoop.

The processes for identifying and collecting forensic evidence are covered, and the

processes for analyzing the data as part of an investigation and presenting the ndings

are detailed. Practical examples are given by using LightHadoop and Amazon Web

Services to develop test Hadoop environments and perform forensics against them.

By the end of the book, you will be able to work with the Hadoop command line

and forensic software packages and understand the forensic process.

What this book covers

Chapter 1, Starting Out with Forensic Investigations and Big Data, is an overview of

both forensics and Big Data. This chapter covers why Big Data is important, how it

is being used, and how forensics of Big Data is different from traditional forensics.

Chapter 2, Understanding Hadoop Internals and Architecture, is a detailed explanation

of Hadoop's internals and how data is stored within a Hadoop environment.

Chapter 3, Identifying Big Data Evidence, covers the process for identifying relevant

data within Hadoop using techniques such as interviews, data sampling, and

system reviews.

Chapter 4, Collecting Hadoop Distributed File System Data, details how to collect

forensic evidence from the Hadoop Distributed File System (HDFS) using

physical and logical collection methods.

Chapter 5, Collecting Hadoop Application Data, examines the processes for collecting

evidence from Hadoop applications using logical- and query-based methods.

HBase, Hive, and Pig are covered in this chapter.

Chapter 6, Performing Hadoop Distributed File System Analysis, details how to conduct

a forensic analysis of HDFS evidence, utilizing techniques such as le carving and

keyword analysis.

Chapter 7, Analyzing Hadoop Application Data, covers how to conduct a forensic analysis

of Hadoop application data using databases and statistical analysis techniques. Topics

such as Benford's law and clustering are discussed in this chapter.

Chapter 8, Presenting Forensic Findings, shows to how to present forensic ndings

for internal investigations or legal proceedings.

www.it-ebooks.info

剩余263页未读，继续阅读

vanridin

粉丝: 108
资源: 1187

Hadoop集群取证：大数据法医分析实战

Packt - Learning iOS Forensics.2015

Python-Digital-Forensics-Cookbook:Packt发行的《 Python Digital Forensics Cookbook》

fineline-computer-forensics-timeline-tools:从 code.google.compfineline-computer-forensics-timeline-tools 自动导出

Mastering Python Forensics -- 2015 -- code.7z

Mastering Python Forensics -- 2015.pdf

Learning-Python-for-Forensics:Packt Publishing为取证学习Python

Hosmer -- Python Forensics -- 2014.pdf

Pro iOS Security and Forensics--2018

Forensics-Tools

File-Forensics-Reporter

最新资源