Operational Frameworks in Data Acquisition and Incidence Handling for Cyber Forensics Exploiting BigData رسالة ماجستير

Abstract

BigData is a key component of the fourth industrial revolution and has garnered significant attention in recent years due to its ability to handle large amounts of data with speed and versatility. However, criminal investigators may face challenges when conducting digital forensics on a BigData system due to the vast volume of data stored there, the potential for various attack scenarios, and a lack of relevant research. In this thesis, we propose the Responsive BigData Digital Forensics Framework. This framework is designed to respond to forensic instances, adapt to the characteristics of the incident, and gather evidence that can be used to reconstruct digital events. It integrates the Computer Domain, Network Domain, and BigData Domain to ensure that all relevant aspects of the system are considered. The investigation process includes preserving the system, searching for and extracting digital evidence, and reconstructing digital events. Moreover, this research presents a tool that assists digital forensic investigators in decision-making and incident response processes through a stored database for a set of appropriate scenarios and tools that help speed up the investigation process.