# Digital Forensics Readiness in Big Data Networks:
## 6 Prototype Configuration and Evaluation
### IR-Script Overview  
The following discussion outlines the key features and functionalities of the IR-script.  
* OS Information Collection: The script gathers detailed information about the operating system, including OS version, kernel details, users with sudo privileges, currently logged-in users, system uptime, load averages, disc usage, partition information, network configuration, and Linux log files. These comprehensive data are essential for understanding the system's state and configuration.
* Hadoop Cluster Information: This collects specific details about the Hadoop cluster, such as Hadoop configuration files, the HDFS version, Namenodes, secondary Namenodes, Hadoop log files, cluster environment variables, detailed Hadoop metrics, running Hadoop and Java processes, and information about cluster nodes. This ensures thorough coverage of critical Hadoop-specific information relevant to forensic analysis.
* Intrusion Detection Systems (IDS): The script checks the status and logs of various IDS tools, including Snort, Suricata, and OSSEC, if they are present on the system. This provides an overview of the security monitoring tools and their current operational status.
* Rootkit Detection: The script incorporates rootkit detection capabilities using tools such as chkrootkit, rkhunter, and unhide. These scans help in identifying potential rootkit infections, which is crucial for security investigations.  
* IR-script's Structure and Usage:
* Functions:
* usage(): Displays usage instructions for the script.
* handle_error(): Manages errors by displaying an error message and exiting the script.
* command_exists(): Checks for the presence of required commands.
* get_os_info(): Retrieves and records OS-specific information.
* get_hadoop_info(): Gathers Hadoop cluster-related data.
* get_ids_info(): Provides information about installed IDS tools.
* get_rootkit_info(): Performs rootkit scans and records results.
* add_Section_header(), add_command_output(), add_csv_header(), and add_csv_row(): Functions to format and add data to output files, either as text or CSV.  
The script produces output files in both text (OS_Info.txt, Hadoop_Info.txt,) and CSV (OS_Info.csv, Hadoop_Info.csv) formats. The choice of format can be selected based on user preference or requirements. All of the script outputs are logged in script_log.txt for comprehensive documentation.  
Users must specify the output directory as an argument when running the script. For example: -/hadoop-forensics.sh /path/to/output_directory. The script then performs a systematic collection of OS information, Hadoop cluster details, IDS statuses, and rootkit detection results, concluding with a completion message.  
Figures 2 and 3 provide screenshots demonstrating the execution steps and results of the IR-script on an AWS Ubuntu Linux-Hadoop cluster for text document outputs and HDP sandbox for CSV document outputs.  
Figure 4 below illustrates a partial output of the Hadoop_Info.txt file displayed on the AWS testbed using the cat command.  
Figure 4: Hadoop_Info.txt content from the AWS testbed.  
Figure 3: HDP sandbox IR-script execution and CSV files output.  
Figure 2: AWS IR-script execution and text files output.