Abstract:

With the development and popularization of information technology and intelligence device, the diversity of different device making forensic analysis of existing equipment cannot meet today's networking and storage technology requirements, and exhibit complex operation, low efficiency, on high speed disk image storage and massive data correlation. An efficient distributed forensics system based on Hadoop technique, which can support multiple concurrent media scene forensics work, was designed and implemented, and through the dispatch control services would be evidence of different data storage media to a different distributed data storage server, each forensic task runtime could monopolize a forensic medium to achieve a parallel multiple media forensic analysis. Data show that responsible acknowledge duration will be 0.1 s for a 2～4 GB text file.

Key words: Hadoop, distributed system, forensic, massive data, multiple media