Large-scale digital forensic investigation for Windows registry on Apache Spark.In this study, we investigate large-scale digital forensic investigation on Apache Spark using a Windows registry.  To this end, we devise distributed algorithms to analyze large-scale registry data collected from multiple Windows systems on the Apache Spark framework.  Third, we propose a distributed algorithm for each defined forensic scenario using Apache Spark operations.  Because the distributed algorithms on Apache Spark require the inherent network and MapReduce overheads, this improvement of the processing performance verifies the efficiency and scalability of the proposed algorithms.
Apache Spark
Second, we propose an algorithm to load the Windows registry into the Hadoop distributed file system (HDFS) for subsequent forensics. 
Hadoop distributed file system (HDFS)
Large-scale digital forensic investigation for Windows registry on Apache Spark.In this study, we investigate large-scale digital forensic investigation on Apache Spark using a Windows registry.  Because the Windows registry depends on the system on which it operates, the existing forensic methods on the Windows registry have been targeted on the Windows registry in a single system.  However, it is a critical issue to analyze large-scale registry data collected from several Windows systems because it allows us to detect suspiciously changed data by comparing the Windows registry in multiple systems.  Second, we propose an algorithm to load the Windows registry into the Hadoop distributed file system (HDFS) for subsequent forensics.  Specifically, we perform forensics on 1.52 GB of Windows registry data collected from four computers and show that the proposed algorithms can reduce the processing time by up to approximately 3.31 times, as we increase the number of CPUs from 1 to 8 and the number of worker nodes from 2 to 8. 
Windows registry