Forensic Investigation on the Hadoop Distributed File System using RAM analysis

Stuart Laing; Robert Ludwiniak; Brahim El Boudani; Christos Chrysoulas; George Ubakanma; Nikolaos Pitropakis

doi:10.1109/DRCN57075.2023.10108330

Forensic Investigation on the Hadoop Distributed File System using RAM analysis

Stuart Laing, Robert Ludwiniak, Brahim El Boudani, Christos Chrysoulas, George Ubakanma, Nikolaos Pitropakis

Edinburgh Napier University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Citation (Scopus)

Abstract

The usage of cloud systems is at an all-time high, and with more organizations reaching for Big Data the forensic implications must be analyzed. The Hadoop Distributed File System is widely used both as a cloud service and with organizations implementing it themselves. This paper analyzed the forensic viability of a RAM analysis method for Hadoop based investigations and compared it against targeted process data dumping through the Java heap information. The RAM analysis was done through string searching and the use of the RAM analysis tool Volatility. This work found that RAM analysis can be a valuable tool for discovering artefacts of deleted resources from a Hadoop cluster but was unable to discover further information such as the block to node mapping. The targeted process analysis managed to provide some partial information about deleted resources and produce important metadata on the current state of the file system.

Original language	English
Title of host publication	2023 19th International Conference on the Design of Reliable Communication Networks (DRCN)
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1-7
Number of pages	7
ISBN (Electronic)	9781665475983
DOIs	https://doi.org/10.1109/DRCN57075.2023.10108330 https://doi.org/10.1109/DRCN57075.2023.10108330
Publication status	Published - 26 Apr 2023
Event	19th International Conference on the Design of Reliable Communication Networks, DRCN 2023 - Vilanova i la Geltru, Spain Duration: 17 Apr 2023 → 20 Apr 2023

Publication series

Name	2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023

Conference

Conference	19th International Conference on the Design of Reliable Communication Networks, DRCN 2023
Country/Territory	Spain
City	Vilanova i la Geltru
Period	17/04/23 → 20/04/23

Bibliographical note

Publisher Copyright:
© 2023 IEEE.

Keywords

cloud systems
forensic analysis
Hadoop
HDFS
Java Heap Analysis
RAM Analysis

Access to Document

Accepted_Manuscript

Cite this

Laing, S., Ludwiniak, R., Boudani, B. E., Chrysoulas, C., Ubakanma, G., & Pitropakis, N. (2023). Forensic Investigation on the Hadoop Distributed File System using RAM analysis. In 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN) (pp. 1-7). (2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/DRCN57075.2023.10108330, https://doi.org/10.1109/DRCN57075.2023.10108330

Laing, Stuart ; Ludwiniak, Robert ; Boudani, Brahim El et al. / Forensic Investigation on the Hadoop Distributed File System using RAM analysis. 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN). Institute of Electrical and Electronics Engineers Inc., 2023. pp. 1-7 (2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023).

@inproceedings{47d62a64a93b4f61a2a11735472b2a6d,

title = "Forensic Investigation on the Hadoop Distributed File System using RAM analysis",

abstract = "The usage of cloud systems is at an all-time high, and with more organizations reaching for Big Data the forensic implications must be analyzed. The Hadoop Distributed File System is widely used both as a cloud service and with organizations implementing it themselves. This paper analyzed the forensic viability of a RAM analysis method for Hadoop based investigations and compared it against targeted process data dumping through the Java heap information. The RAM analysis was done through string searching and the use of the RAM analysis tool Volatility. This work found that RAM analysis can be a valuable tool for discovering artefacts of deleted resources from a Hadoop cluster but was unable to discover further information such as the block to node mapping. The targeted process analysis managed to provide some partial information about deleted resources and produce important metadata on the current state of the file system.",

keywords = "cloud systems, forensic analysis, Hadoop, HDFS, Java Heap Analysis, RAM Analysis",

author = "Stuart Laing and Robert Ludwiniak and Boudani, {Brahim El} and Christos Chrysoulas and George Ubakanma and Nikolaos Pitropakis",

note = "Publisher Copyright: {\textcopyright} 2023 IEEE.; 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023 ; Conference date: 17-04-2023 Through 20-04-2023",

year = "2023",

month = apr,

day = "26",

doi = "10.1109/DRCN57075.2023.10108330",

language = "English",

series = "2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1--7",

booktitle = "2023 19th International Conference on the Design of Reliable Communication Networks (DRCN)",

address = "United States",

}

Laing, S, Ludwiniak, R, Boudani, BE, Chrysoulas, C, Ubakanma, G & Pitropakis, N 2023, Forensic Investigation on the Hadoop Distributed File System using RAM analysis. in 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN). 2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023, Institute of Electrical and Electronics Engineers Inc., pp. 1-7, 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023, Vilanova i la Geltru, Spain, 17/04/23. https://doi.org/10.1109/DRCN57075.2023.10108330, https://doi.org/10.1109/DRCN57075.2023.10108330

Forensic Investigation on the Hadoop Distributed File System using RAM analysis. / Laing, Stuart; Ludwiniak, Robert; Boudani, Brahim El et al.
2023 19th International Conference on the Design of Reliable Communication Networks (DRCN). Institute of Electrical and Electronics Engineers Inc., 2023. p. 1-7 (2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Forensic Investigation on the Hadoop Distributed File System using RAM analysis

AU - Laing, Stuart

AU - Ludwiniak, Robert

AU - Boudani, Brahim El

AU - Chrysoulas, Christos

AU - Ubakanma, George

AU - Pitropakis, Nikolaos

PY - 2023/4/26

Y1 - 2023/4/26

N2 - The usage of cloud systems is at an all-time high, and with more organizations reaching for Big Data the forensic implications must be analyzed. The Hadoop Distributed File System is widely used both as a cloud service and with organizations implementing it themselves. This paper analyzed the forensic viability of a RAM analysis method for Hadoop based investigations and compared it against targeted process data dumping through the Java heap information. The RAM analysis was done through string searching and the use of the RAM analysis tool Volatility. This work found that RAM analysis can be a valuable tool for discovering artefacts of deleted resources from a Hadoop cluster but was unable to discover further information such as the block to node mapping. The targeted process analysis managed to provide some partial information about deleted resources and produce important metadata on the current state of the file system.

AB - The usage of cloud systems is at an all-time high, and with more organizations reaching for Big Data the forensic implications must be analyzed. The Hadoop Distributed File System is widely used both as a cloud service and with organizations implementing it themselves. This paper analyzed the forensic viability of a RAM analysis method for Hadoop based investigations and compared it against targeted process data dumping through the Java heap information. The RAM analysis was done through string searching and the use of the RAM analysis tool Volatility. This work found that RAM analysis can be a valuable tool for discovering artefacts of deleted resources from a Hadoop cluster but was unable to discover further information such as the block to node mapping. The targeted process analysis managed to provide some partial information about deleted resources and produce important metadata on the current state of the file system.

KW - cloud systems

KW - forensic analysis

KW - Hadoop

KW - HDFS

KW - Java Heap Analysis

KW - RAM Analysis

UR - http://www.scopus.com/inward/record.url?scp=85159108670&partnerID=8YFLogxK

U2 - 10.1109/DRCN57075.2023.10108330

DO - 10.1109/DRCN57075.2023.10108330

M3 - Conference contribution

AN - SCOPUS:85159108670

T3 - 2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023

SP - 1

EP - 7

BT - 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN)

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023

Y2 - 17 April 2023 through 20 April 2023

ER -

Laing S, Ludwiniak R, Boudani BE, Chrysoulas C, Ubakanma G, Pitropakis N. Forensic Investigation on the Hadoop Distributed File System using RAM analysis. In 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN). Institute of Electrical and Electronics Engineers Inc. 2023. p. 1-7. (2023 19th International Conference on the Design of Reliable Communication Networks, DRCN 2023). doi: 10.1109/DRCN57075.2023.10108330, 10.1109/DRCN57075.2023.10108330

Forensic Investigation on the Hadoop Distributed File System using RAM analysis

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Cite this