Large-scale digital forensic investigation for Windows registry on Apache Spark.

ABSTRACT: In this study, we investigate large-scale digital forensic investigation on Apache Spark using a Windows registry. Because the Windows registry depends on the system on which it operates, the existing forensic methods on the Windows registry have been targeted on the Windows registry in a single system. However, it is a critical issue to analyze large-scale registry data collected from several Windows systems because it allows us to detect suspiciously changed data by comparing the Windows registry in multiple systems. To this end, we devise distributed algorithms to analyze large-scale registry data collected from multiple Windows systems on the Apache Spark framework. First, we define three main scenarios in which we classify the existing registry forensic studies into them. Second, we p

SUBMITTER: Lee JH 

PROVIDER: S-EPMC9728846 | biostudies-literature | 2022

REPOSITORIES: biostudies-literature