An Efficient Distributed Forensic System Based on Hadoop:Principle and Method - Songyang Wu; Xizhe Zhang; Xupeng Wang; Xiangxue Li (Dianxin kexue)
With the development and popularization of information technology and intelligence device, the diversity of different device making forensic analysis of existing equipment cannot meet today's networking and storage technology requirements, and exhibit complex operation, low efficiency, on high speed disk image storage and massive data correlation. An efficient distributed forensics system based on Hadoop technique, which can support multiple concurrent media scene forensics work, was designed and implemented, and through the dispatch control services would be evidence of different data storage media to a different distributed data storage server, each forensic task runtime could monopolize a forensic medium to achieve a parallel multiple media forensic analysis. Data show that responsible acknowledge duration will be 0.1 s for a 2～4 GB text file.