# Digital Forensics Readiness in Big Data Networks:
## 6 Prototype Configuration and Evaluation
### IR-Script Evaluation  
The evaluation of the IR-script was carried out using functional and usability approaches.  
Functionality in this context refers to the ability of the script to perform its intended tasks accurately and efficiently. Functionality evaluation was conducted to ensure that the script successfully collected and organised the necessary supporting forensics artefacts. A key objective was to evaluate the script's effectiveness across various Linux-Hadoop configurations, focusing on its ability to collect detailed OS and Hadoop-specific information in both TXT and CSV formats. Figure 5 below shows a partial screenshot of the importation of the Hadoop_Info.csv file generated from the Oracle VB testbed into Microsoft Excel.  
The functionality evaluation confirmed that the IR-script met 90.5% of the expected outcomes in both environments, demonstrating its robustness and reliability across different setups. During the prototype evaluation, a total of 63 artefacts were assessed for retrieval success across different testbed environments. The results are summarised as follows:  
* Successful Retrieval: In total, 57 out of 63 artefacts were fully retrieved, indicating successful extraction and validation across the testbeds (marked as \"Yes\").
* Partial Retrieval: Three artefacts were only partially retrieved, reflecting incomplete or partial extraction (marked as \"Partial\").
* Failed Retrieval: Three artefacts could not be retrieved at all, denoting a failure in the extraction process (marked as \"No\").  
The percentage of expected outcomes successfully met by the IR-script was calculated as follows:  
\[\text{Percentage met}=(57/63)\times 100=90.5\%\]  
Testbed Analysis:  
1. HDP Sandbox Testbed: Out of the three artefacts that were not retrieved (\"No\"), all were associated with the HDP sandbox. Additionally, one artefact was only partially retrieved on this testbed.
2. Oracle VB Testbed: One artefact experienced partial retrieval in the Oracle VB environment.
3. AWS Testbed: Similarly, one artefact was partially retrieved in the AWS testbed environment.  
These results highlight the relative reliability of the prototype across different test environments, with a particular focus on the HDP sandbox which exhibited the highest number of retrieval issues, as shown in Figure 3. Table 1 below summarises the results of the functional evaluation.  
Figure 5: Importing Hadoop_Info.csv data from Oracle VB testbed into Excel.  
Usability pertains to the ease with which users (investigators) can effectively utilise the script to achieve their goals. The usability evaluation of the IR-script was performed to assess how user-friendly the script is for digital forensic investigators and network administrators. The evaluation revealed that while the script is thorough in its data collection, it can only be executed via the Command Line Interface (CLI). This limitation may pose a challenge for users who are not familiar with CLI operations or who prefer graphical interfaces. Despite this, the script performed fairly well, as it organised the collected data into clear and accessible text documents.  
However, enhancing the script with a more user-friendly interface or additional guidance could improve its usability, making it more accessible to a broader range of users, including those with less technical expertise. Documents have been attached showing the usability steps and functional results of IR-script execution within the three testbeds.