Accelerating Digital Evidence Analysis Using Recent Advances In Parallel Processing

This award was competitively made in response to a proposal submitted by RAND Corporation to a National Institute of Justice FY 2014 solicitation: "New Approaches to Digital Evidence Processing and Storage". The purpose of this award is to develop a forensics compute cluster using open source software that will accelerate key forensic analyses by enabling many key tasks to be executed in parallel on multiple compute nodes. Essentially, RAND proposed a cloud-computing approach to digital forensic processing and storage. This system will greatly reduce processing times by accelerating the performance of a suite of existing proven open source forensics tools running on distributed computing and stream processing frameworks such as Apache Spark, Storm, and Hadoop. Once the full working prototype is in place, RAND will test the end-to-end speed and performance of the system on a variety of typical analytic tasks using industry standard test images. With the test data, RAND will estimate a cost-performance curve that will enable digital forensic analysts to estimate the resources required to buy or rent (e.g., private cloud, managed hosting) the appropriate level of computing capacity for their situation.

This project contains a research and/or development component, as defined in applicable law.

nca/ncf