A forensic method for efficient file extraction in HDFS based on three-level mapping

Gao, Yuanzhao; Li, Binglong

doi:10.1007/s11859-017-1224-7

Cited by 8 publications

(5 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The experiment that is undertaken in the paper is done with the 3L mapping previously established, the authors write: "Without 3L mapping, it is difficult to overcome the problems caused by the features of cloud and HDFS to implement file extraction." [7]. This is of specific relevance to the work in this project, any analysis of RAM or processes must either mitigate or solve this issue of mapping.…”

Section: Literature Reviewmentioning

confidence: 96%

“…Gao and Li [7] put forward a three level mapping for efficient file extraction in their paper A Forensic Method for Efficient File Extraction in HDFS Based on Three-Level Mapping. They state the importance of discovering the mapping between files and nodes which can aid in the extraction of files.…”

Section: Literature Reviewmentioning

confidence: 99%

“…Leimich, et al [6] showed that RAM forensics can be a possible solution but does come with some drawbacks in the amount and accuracy of its results. Gao and Li state the importance of discovering the mapping between blocks and the DataNodes that store them [7]. The following section discusses the proposed solution to address each of these concerns.…”

Section: Literature Reviewmentioning

confidence: 99%

See 2 more Smart Citations

Forensic Investigation Using RAM Analysis on the Hadoop Distributed File System

Laing

Ludwiniak

Boudani

et al. 2023

2023 19th International Conference on the Design of Reliable Communication Networks (DRCN)

View full text Add to dashboard Cite

The usage of cloud systems is at an all-time high, and with more organizations reaching for Big Data the forensic implications must be analyzed. The Hadoop Distributed File System is widely used both as a cloud service and with organizations implementing it themselves. This paper analyzes the forensic viability of a RAM analysis method for Hadoop based investigations and compared it against targeted process data dumping through the Java heap information. The RAM analysis has been done through string searching and the use of the RAM analysis tool Volatility. This work found that RAM analysis can be a valuable tool for discovering artefacts of deleted resources from a Hadoop cluster but was unable to discover further information such as the block to node mapping. The targeted process analysis managed to provide some partial information about deleted resources and also produce important metadata on the current state of the file system.

show abstract

Section: Literature Reviewmentioning

confidence: 96%

Section: Literature Reviewmentioning

confidence: 99%

Section: Literature Reviewmentioning

confidence: 99%

See 1 more Smart Citation

Forensic Investigation Using RAM Analysis on the Hadoop Distributed File System

Laing

Ludwiniak

Boudani

et al. 2023

2023 19th International Conference on the Design of Reliable Communication Networks (DRCN)

View full text Add to dashboard Cite

show abstract

“…HDFS is a large distributed file system, which can build an efficient and stable storage cluster on personal computer. The storage mode of HDFS is partitioned storage, that is, files are partitioned into different files [18]. In addition to the above two core technologies, Hadoop architecture also includes Hive and HBase and other structures.…”

Section: Key Technologies Of the Realization Of Information Management Systemmentioning

confidence: 99%

The Use of Artificial Intelligence Combined with Cloud Computing in the Design of Education Information Management Platform

2021

Int. J. Emerg. Technol. Learn.

View full text Add to dashboard Cite

Based on cloud computing theory and service-oriented architecture (SOA) design pattern, a smart education management platform is designed by using cloud computing and artificial intelligence technology. The platform is deployed in the server cluster environment, with Hadpoop managed storage cluster as the data storage center. For the education management, education portal and remote classroom, the corresponding services are launched, which has the advantages of intelligent and efficient, massive data access and intelligent collaborative management. The test results show that the platform can be used normally in the ports of computer, mobile phone and tablet computer, and can successfully complete the basic operations such as user registration and login, educational administration, and content storage. The results of database stress test show that the total time consumption of sequential read, sequential write, random read and random write is 752s, 312s, 968s and 211s, respectively when millions of simulated data are inserted into the database, which indicates that the database can support large-scale data access. The stress test results of content storage service show that when the number of clients is adjusted to 500, 1000 and 3000, the output quantity of each read-write interface can be maintained at about 3500 pages/min in 60s, indicating that the system can still run stably under the condition of high concurrency. The management platform discussed has practical significance to promote the development of intelligent and information-based education management.

show abstract

“…There have been several studies on the collection and analysis of cloud evidence 4‐7 and all monitor cloud networks, processes, data access, and other behaviors through an API (application programming interface), and provide log information needed for evidence collection, 8 respectively discusses log monitoring models for IaaS (infrastructure as a service) and PaaS (platform as a service). Taking hadoop distributed file system (HDFS) as an example, Reference 9 proposes a forensics method based on three‐layer mapping to achieve effective file extraction. Reference 10 proposes a time correlation method for heterogeneous virtual machine event logs.…”

Section: Related Workmentioning

confidence: 99%

TamForen: A tamper‐proof cloud forensic framework

Zheng

Xiao

et al. 2020

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Cloud forensics has become increasingly critical in cloud computing security in recent years. A fundamental problem in cloud forensics is how to safely and effectively obtain, preserve, and analyze evidence. With massive cloud forensic systems and tools having been proposed over the years, we identify one challenge that is not adequately addressed in the current literature. The problem is “credibility of cloud evidence”; this is where the evidence collected in the cloud is unreliable due to its multitenancy and the multiple participants in the forensic process. In this paper, we develop a new Cloud Forensics Tamper‐Proof Framework (TamForen) for cloud forensics, which can be used in an untrusted and multitenancy cloud environment. This framework relies on the cloud forensics system independent of the daily cloud activities and is implemented based on the Multilayer Compressed Counting Bloom Filter. Unlike existing cloud forensics methods that depend on the support and trust of cloud service providers, TamForen takes into account the untrustworthiness of participants in the forensics process and conducts tamper‐proof protection of data in a decentralized way without violating users' privacy. We simulate a cloud forensics environment to evaluate TamForen, and the results show that TamForen is feasible.

show abstract

A forensic method for efficient file extraction in HDFS based on three-level mapping

Cited by 8 publications

References 13 publications

Forensic Investigation Using RAM Analysis on the Hadoop Distributed File System

Forensic Investigation Using RAM Analysis on the Hadoop Distributed File System

The Use of Artificial Intelligence Combined with Cloud Computing in the Design of Education Information Management Platform

TamForen: A tamper‐proof cloud forensic framework

Contact Info

Product

Resources

About