Analysis
The file-level analysis is the analysis that is performed on logical files or forensic images. This analysis differs from data content analysis, because the focus of this analysis is to extract, or piece together, data containers or collect metadata information. For Big Data investigations in which nodes were individually imaged, this is the type of analysis whereby the images are analyzed and the contents of the cluster are pieced back together for further analysis.
Because no two investigations are the same, analysis techniques serve as tools in a toolbox and can be combined or run in various orders and combinations. The primary file-level analyses are:
Keyword searching
File and data carving
Metadata analysis, such as file modification timeline analysis
Cluster reconstruction
Keyword searching and file and data carving
Two methods for analyzing HDFS evidence are keyword searching and file and data carving. Keyword searching is the technique of identifying sections of data that contain...
