Extrakce událostí ze souborových systémů - Návrh a implementace distribuované architektury

forensic analysis, timeline analysis, Apache Hadoop

Extraction of time-stamped events from local file systems is a key step in the reconstruction of the timeline, which tells about the use of the device (computer, USB drive, etc.) in the past. Existing event extraction tools are, without exception, designed to run on a single local computer. Due to the available capacity of current hard disks and other storage devices, the analysis of the included file systems is very time consuming. In this document, we therefore describe the design, implementation and experimental evaluation of a new, distributed solution that allows the event extraction process to be spread over a large number of computing nodes. This makes it possible to increase the efficiency of the whole process and at the same time integrate the obtained results with data from other sources into a common timeline.