Research And Implementation Of Electronic Evidence Preservation Platform Based On Hadoop

With the continuous advancement of information technology,more and more cases are related to electronic evidence,such as shopping online,telecom fraud and so on.The investigation of these cases need the support of electronic evidence.Howeveer,the laws and regulations relatd to the electronic evidence are not clear enough currently,and the electronic evidence can easily be artificially tampered or destroyed because it is digital and vulnerable.When facing to the complicated electronic evidence,ordinary people are always dazed when they need the electronic evidence,and know nothing about electronic evidence forensics and electronic evidence preservation.Non standard electronic evidence preservation is easy to cause the weakening of legal effect of evidence.In this paper,according to the characteristics of electronic evidence,the HD electronic evidence preservation platform is constructed based on Hadoop.The platform can collect,store and check the electronic data such as web links,screenshots,photos by means of the time stamp technology,Exif information extraction,message digest technology,MD5+salt algorithm and Kerberos security authentication.It is useful when the user has the burden of proof.The system realized the automatic acquisition and processing of Web links and enhanced the credibility of electronic evidence by means of the time stamp information extraction technology and Exif information extraction.In addition,the system introduces the time stamp and the SHA-1 value into the MD5 algorithm to realize the bidirectional verification of the identity of the user and the integrity of the electronic evidence.According to the characteristics of HDFS and HBase,the system put the large files into HDFS,and store the small ones with HBase.Separate storage according to size of the files can improve the processing performance of the cluster.At the same time,due to the high efficiency,flexibility,low cost and scalability of Hadoop,the cluster can start from small clusters,and gradually expand according to the amount of electronic evidence at a low cost.After the experimental verification,this system can realize the automatic processing of the link of the web page,and can quickly complete the mixed size electronic evidence file upload,Exif information extraction and HBase information writing.When the user downloads the electronic evidence,the user identity and the integrity of the electronic evidence integrity can be completed through the MD5+salt algorithm.The system provides support for the research of electronic evidence preservation industry.