Forensic Investigation Using RAM Analysis on the Hadoop Distributed File System

Laing, Stuart; Ludwiniak, Robert; El Boudani, Brahim; Chrysoulas, Christos; Ubakanma, George; Pitropakis, Nikolaos

Abstract

The usage of cloud systems is at an all-time high, and with more organizations reaching for Big Data the forensic implications must be analyzed. The Hadoop Distributed File System is widely used both as a cloud service and with organizations implementing it themselves. This paper analyzed the forensic viability of a RAM analysis method for Hadoop based investigations and compared it against targeted process data dumping through the Java heap information. The RAM analysis was done through string searching and the use of the RAM analysis tool Volatility. This work found that RAM analysis can be a valuable tool for discovering artefacts of deleted resources from a Hadoop cluster but was unable to discover further information such as the block to node mapping. The targeted process analysis managed to provide some partial information about deleted resources and produce important metadata on the current state of the file system.

• Presentation Conference Type: Conference Paper (Published)
• Conference Name: 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN)
• Start Date: Apr 17, 2023
• End Date: Apr 20, 2023
• Online Publication Date: Apr 26, 2023
• Publication Date: 2023
• Deposit Date: Mar 30, 2023
• Publicly Available Date: Jun 15, 2023
• Publisher: Institute of Electrical and Electronics Engineers
• Book Title: 2023 19th International Conference on the Design of Reliable Communication Networks (DRCN)
• DOI: https://doi.org/10.1109/DRCN57075.2023.10108330
• Keywords: cloud systems, RAM Analysis, Java Heap Analysis, Hadoop, HDFS, forensic analysis