A forensic method for efficient file extraction in HDFS based on three-level mapping

Wuhan University Journal of Natural Sciences

Volumn 22, Issue 2, 2017, Pages 114-126

  Gao, Yuanzhao ^a   Li, Binglong ^a  

^a INFORMATION ENGINEERING UNIVERSITY   (China)

Author keywords

cloud forensics; Ext4; file extraction; file recovery; metadata; the Hadoop distributed file system (HDFS) forensics; three level (3L) mapping

Indexed keywords

EID: 85014945373     PISSN: 10071202     EISSN: None     Source Type: Journal    
DOI: 10.1007/s11859-017-1224-7     Document Type: Article

References (31)

1. Auger G, Hilgers R. Public Cloud Security Final Report [R]. West Lafayette: Purdue University Research Repository, 2015.
2. Wang B, Zheng Y, Lou W, et al. DDoS attack protection in the era of cloud computing and Software-Defined Networking [C]// IEEE 22nd International Conference on Network Protocols. Research Triangle Park: IEEE Press, 2014: 624–629.
3. Zawoad S, Dutta A K, Hasan R. SecLaaS: Secure logging-as-a-service for cloud forensics [C] // 8th ACM SIGSAC symposium on Information, computer and communications security. Hangzhou: ACM Press, 2013: 219–230.
4. Federici C. Cloud data imager: A unified answer to remote acquisition of cloud storage areas [J]. Digital Investigation, 2014, 11(1): 30–42.
5. Quick D, Choo K K R. Forensic collection of cloud storage data: Does the act of collection result in changes to the data or its metadata? [J]. Digital Investigation, 2013, 10(3): 266–277.
6. Alqahtany S, Clarke N, Furnell S, et al. Cloud Forensics: A review of challenges, solutions and open problems [C]// International Conference on Cloud Computing. Riyadh: IEEE Press, 2015: 88–96.
7. van Beek H M A, van Eijk E J, van Baar R B, et al. Digital forensics as a service: Game on [J]. Digital Investigation, 2015, 15: 20–38.
8. Quick D, Choo K K R. Impacts of increasing volume of digital forensic data: A survey and future research challenges [J]. Digital Investigation, 2014, 11(4): 273–294.
9. Martini B, Choo K K R. Distributed filesystem forensics: XtreemFS as a case study [J]. Digital Investigation, 2014, 11(4): 295–313.
10. Wu L, Wang L H, Gu W D. Research on computer forensics system based on cloud computing [J]. Computer Science, 2012, 39(5): 83–85.
11. Chen L, Xu L, Yuan X, et al. Digital forensics in social networks and the cloud: Process, approaches, methods, tools, and challenges [C]// 2015 International Conference on Computing, Networking and Communications. Anaheim: IEEE Press, 2015: 1132–1136.
12. Sibiya G, Venter H S, Fogwill T. Digital forensics in the Cloud: The state of the art [C] // IST-Africa 2015 Conference. Lilongwe: IEEE Press, 2015: 1–9.
13. Pichan A, Lazarescu M, Soh S T. Cloud forensics: Technical challenges, solutions and comparative analysis [J]. Digital Investigation, 2015, 13: 38–57.
14. White T. Hadoop: The Definitive Guide [M]. Sebastopol: O’Reilly Media, Inc., 2012.
15. Shvachko K, Kuang H, Radia S, et al. The hadoop distributed file system [C] // IEEE 26th Symposium on Mass Storage Systems and Technologies. Washoe County: IEEE Press, 2010: 1–10.
16. Islam N S, Lu X, Wasi-ur-Rahman M, et al. Triple-H: A hybrid approach to accelerate HDFS on HPC clusters with heterogeneous storage architecture [C] // 15th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing. Shenzhen: IEEE Press, 2015: 101–110.
17. Changtong L. An improved HDFS for small file [C] // 18th International Conference on Advanced Communication Technology. Pyeongchang: IEEE Press, 2016: 474–477.
18. Dev D, Patgiri R. Performance evaluation of HDFS in big data management [C] // International Conference on High Performance Computing and Applications. Bhubaneswar: IEEE Press, 2014: 1–7.
19. Liu X, Han J, Zhong Y, et al. Implementing WebGIS on Hadoop: A case study of improving small file I/O performance on HDFS [C] // IEEE International Conference on Cluster Computing and Workshops. New Orleans: IEEE Press, 2009: 1–8.
20. Fairbanks K D. An analysis of Ext4 for digital forensics [J]. Digital Investigation, 2012, 9(15): S118–S130.
21. Mathur A, Cao M, Bhattacharya S, et al. The new ext4 filesystem: Current status and future plans [EB/OL].[2016-11-01]. https://www.kernel.org/doc/ols/2007/ols2007 v2-pages-21-34.pdf.
22. Fairbanks K D, Lee C P, Owen Iii H L. Forensic implications of Ext4[C]// 6th Annual Workshop on Cyber Security and Information Intelligence Research. New York: ACM Press, 2010: 1–4.
23. Google. Protocol buffer [EB/OL].[2016-05-28] http://code. google. com/apis/protocolbuffers/docs/overview.
24. Casey E. Tool review-WinHex [J]. Digital Investigation, 2004, 1(2): 114–128.
25. Apache. HDFS Architecture [EB/OL].[2016-05-28]. https: //hadoop.apache.org/docs/current/hadoop-project-dist/hado op-hdfs/HdfsDesign.html.
26. Lee S, Shon T. Improved deleted file recovery technique for Ext2/3 filesystem [J]. The Journal of Supercomputing, 2014, 70(1): 20–30.
27. Comer D. Ubiquitous B-tree [J]. ACM Computing Surveys, 1979, 11(2): 121–137.
28. Rodeh O, Bacik J, Mason C. BTRFS: The linux B-tree filesystem [EB/OL].[2016-11-01]. http://domino.research. ibm.com/library/cyberdig.nsf/papers/6E1C5B6A1B6EDD98 85257A38006B6130/File/rj10501.pdf.
29. Gansner E R. Using Graphviz as a Library (cgraph version) [EB/OL].[2016-05-28]. http:// graphviz.org/pdf/ libguide. pdf.
30. Fairbanks K D. A Technique for measuring data persistence using the Ext4 file system journal [C] // IEEE 39th Annual Computer Software and Applications Conference. Taichung: IEEE Press, 2015, 3: 18–23.
31. Barham P, Dragovic B, Fraser K, et al. Xen and the art of virtualization [J]. ACM SIGOPS Operating Systems Review, 2003, 37(5): 164–177.