Digital Forensics Compute Cluster: A High Speed Distributed Computing Capability for Digital Forensics
نویسندگان
چکیده
We have developed a distributed computing capability, Digital Forensics Compute Cluster (DFORC2) to speed up the ingestion and processing of digital evidence that is resident on computer hard drives. DFORC2 parallelizes evidence ingestion and file processing steps. It can be run on a standalone computer cluster or in the Amazon Web Services (AWS) cloud. When running in a virtualized computing environment, its cluster resources can be dynamically scaled up or down using Kubernetes. DFORC2 is an open source project that uses Autopsy, Apache Spark and Kafka, and other open source software packages. It extends the proven open source digital forensics capabilities of Autopsy to compute clusters and cloud architectures, so digital forensics tasks can be accomplished efficiently by a scalable array of cluster compute nodes. In this paper, we describe DFORC2 and compare it with a standalone version of Autopsy when both are used to process evidence from hard drives of different sizes. Keywords—Cloud computing, cybersecurity, digital forensics, Kafka, Kubernetes, Spark.
منابع مشابه
Procedures for a Harmonised Digital Forensic Process in Live Forensics
Cloud computing is a novel computing paradigm that presents new research opportunities in the field of digital forensics. Cloud computing is based on the following principles: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. These principles require that cloud computing be distributed internationally. Even if the cloud is hosted locally, it ...
متن کاملMassively Threaded Digital Forensics Tools
Digital forensics comprises the set of techniques to recover, preserve, and examine digital evidence and has applications in a number of important areas, including investigation of child exploitation, identity theft, counter-terrorism, and intellectual property disputes. Digital forensics tools must exhaustively examine and interpret data at a low level, because data of evidentiary value may ha...
متن کاملDigital Forensics Evidence Acquisition and Chain of Custody in Cloud Computing
The new cloud computing concept delivers an adaptable service to many users. This is due to the fact that cloud computing offers an economic solution based on pay-per use idea. At the same time, digital forensics is a relatively new discipline born out due to the growing use of computing and digital solution. Digital forensics in cloud computing brings new technical and legal challenges (e.g. t...
متن کاملAnalyzing registry, log files, and prefetch files in finding digital evidence in graphic design applications
The products of graphic design applications leave behind traces of digital information which can be used during a digital forensic investigation in cases where counterfeit documents have been created. This paper analyzes the digital forensics involved in the creation of counterfeit documents. This is achieved by first recognizing the digital forensic artifacts left behind from the use of graphi...
متن کاملCloud forensics definitions and critical criteria for cloud forensic capability: An overview of survey results
With the rapid growth of cloud adoption in both private and public sectors globally, cloud computing environments have become a new battlefield for cyber crime. In this paper, the researchers present the results and analysis of a survey that had been widely circulated among digital forensic experts and practitioners worldwide on cloud forensics and critical criteria for cloud forensic capabilit...
متن کامل