Large-scale digital forensic investigation for Windows registry on Apache Spark.

Area of Science:

• Computer Science
• Digital Forensics
• Distributed Systems

Background:

• Existing Windows registry forensic methods are limited to single systems.
• Analyzing large-scale registry data from multiple systems is crucial for detecting suspicious changes.
• There is a need for efficient analysis of distributed Windows registry data.

Purpose of the Study:

• To devise distributed algorithms for analyzing large-scale Windows registry data on the Apache Spark framework.
• To enable efficient digital forensic investigation across multiple Windows systems.
• To address the limitations of single-system forensic approaches.

Main Methods:

• Classification of existing registry forensic studies into three main scenarios.
• Development of an algorithm to load Windows registry data into Hadoop Distributed File System (HDFS).
• Proposal of distributed algorithms for forensic scenarios using Apache Spark operations.

Main Results:

• Demonstrated efficient forensics on large-scale registry data (1.52 GB) from four computers in a distributed environment.
• Achieved up to 3.31 times reduction in processing time by scaling CPUs and worker nodes.
• Verified the efficiency and scalability of the proposed algorithms despite network and MapReduce overheads.

Conclusions:

• The proposed distributed algorithms offer an efficient and scalable solution for large-scale Windows registry forensics.
• The framework effectively analyzes registry data from multiple systems, enhancing digital investigation.
• This approach overcomes the limitations of traditional single-system forensic methods.