A scalable file based data store for forensic analysis. (March 2015)

• Record Type: Journal Article
• Authors: Cruz, Flavio; Moser, Andreas; Cohen, Michael
• Is Part Of: Digital investigation. Volume 12(2015)Supplement 1
• Page Start: S90
• Page End: S101
• Publication Date: 2015-03
• Subjects: Distributed database -- Incident response -- Sqlite -- Evidence analysis -- Distributed computing; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2015.01.016
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: In the field of remote forensics, the GRR Response Rig has been used to access and store data from thousands of enterprise machines. Handling large numbers of machines requires efficient and scalable storage mechanisms that allow concurrent data operations and efficient data access, independent of the size of the stored data and the number of machines in the network. We studied the available GRR storage mechanisms and found them lacking in both speed and scalability. In this paper, we propose a new distributed data store that partitions data into database files that can be accessed independently so that distributed forensic analysis can be done in a scalable fashion. We also show how to use the NSRL software reference database in our scalable data store to avoid wasting resources when collecting harmless files from enterprise machines.