## 5 Evaluation  
In this section, we evaluate the efficacy of the microservice-based architecture for digital forensics applications using real, anonymized data from the private cloud of the Hellenic Competition Commission. The following paragraphs present the setup and the results of the experiments. In the experiments, we utilized a server with an Intel Xeon Silver 4210 CPU featuring 40 cores, 64 GB RAM, and a NETGEAR NAS storage system of 4.9 TB capacity. In three VMs, we deployed a Kubernetes cluster (v1.29.0), which included the K8s  
Figure 3: A microservice-based architecture for digital forensics applications. master node and two compute nodes. To evaluate the resource scaling mechanism of the proposed architecture, we used the TOVEK Tools software (v7.7.3) [32], which provided advanced capabilities on large amounts of text data using specialized modules for the indexing of sources, context and content analysis, and generation of graphs and interactive reports. This software can be deployed on a network storage (functioning like a server) to host its knowledge management and information analysis features. The client is installed as a desktop application on the local machines of selected case handlers, enabling efficient searching and the ability to answer complex queries fast, without the need to store the entire dataset locally. The network application is containerized in a pod, while its resources are scaled up or down based on the workload demand. For evaluation purposes, we used the TOVEK Index Manager to create indexes of large datasets, which is a CPU-intensive and time-consuming task. To evaluate the resource scaling mechanism of the architecture, we considered four different resource profiles of pods. The resource profile of a pod specifies the CPU and memory resources that are recorded as the resource limits of the Deployment Descriptor. The scaling decision is based only on CPU utilization since memory utilization is stable and independent of the dataset size. For data indexing, we utilized five anonymized datasets of different sizes from the Hellenic Competition Commission, which have been used as digital evidence in a past case. Every dataset contains various types of files, such as emails, Microsoft Office files (i.e., Word, Excel, PowerPoint), images, and scanned documents. Using persistent volumes, the datasets were stored and bound with specific pods to prevent any data loss and guarantee data integrity. Table 2 includes the details of the resource profiles and datasets. Leveraging the VPA functionalities, we ran two different experimental setups to evaluate the scaling decision. For the first experimental setup, an indexing task is executed under different pods' resource profiles. For the second set of experiments, we simultaneously ran two indexing tasks within a single pod. For both cases, the performance metric is the completion time of the indexing task (indexing time). In the first set of experiments, we focus on the effect of allocated CPU cores on the completion time of a single indexing task running in the pod. Figure 4 illustrates the completion time of the indexing tasks of various datasets, which were executed in pods with different resource profiles. Initially, it is observed that the indexing time decreases as the CPU cores increase. Indicatively, the indexing time of _data-XL_ executed on an 8-core pod (_prof4_) is almost three times shorter than the completion time in a 2-core pod (_prof1_). However, it is worth mentioning that the improvement of indexing time is smaller as the allocated resources increase. As shown in Figure 4, for _data-XL_, the reduction in the indexing time for the pod with profiles _prof3_ and _prof4_ is less than 5%. This can be explained