Forensic Investigation on MapR Hadoop Platform

Abstract

Hadoop Platforms are progressively used by consumers, business, and government. MapR is one of the popular Hadoop Platforms, which can provide users an efficient computing paradigm with the ability to access, store, process and manage a large amount of data. The widespread usage of MapR Hadoop Platform could create the environment that is potentially conducive to malicious activities and illegal operations. The forensic investigation of MapR Hadoop Platform is the emerging field for forensic community. The retrieval of residual artifacts from MapR Hadoop Platform is a challenge in forensic investigation, due to its complex infrastructure and, lack of location knowledge about artifacts. This paper discovers the residual artifacts on MapR Hadoop Platform to trace a variety of user’s operations on the MapR Hadoop Platform. The discovered residual artifacts can assist the forensics examiners and practitioners for MapR Hadoop Platform forensics.