# Digital Forensics Readiness in Big Data Networks:
## 5 Proposed Framework
### Research Question 1 Insights  
To address RQ 1, the proposed framework recommends integrating DFR on the same network where a company's BI operations are already running. Specifically, it recommends adding dedicated forensic nodes to the existing Hadoop cluster. The forensic nodes comprise DFR nodes (depending on the organisation's network) and a BI compliance node. The DFR nodes are configured to collect and securely store both record evidence and user/application evidential data [5]. This includes network and security logs from various sources, Hadoop cluster data, system event logs, database transaction logs, access control logs, application logs, audit trails, network traffic data, firewall logs, IDS logs, and SIEM data. This consolidated storage simplifies management and analysis while safeguarding sensitive information for potential investigations. It is essential to allocate sufficient storage and processing resources to accommodate the data volume. A backup of the DFR nodes in the cloud is also implemented. The BI compliance node handles logging related to security policy management and compliance within the big data environment. It tracks current and historical security policies, including those for data anonymisation, encryption, and password management. This node provides a thorough record of security measures for auditing and compliance purposes and supports forensic investigations. Additionally, it maintains an updated policy on big data collection and processing, ensuring adherence to legal and ethical standards and mitigating the risk of data breaches. To add the new forensic nodes without disrupting the big data operations as depicted in Figure 1, the following steps are followed:  
1. Begin by configuring a standby NameNode in the cloud to ensure redundancy and immediate backup capabilities. 2. Use VLANs or SDN (Software Defined Networking) to segment the network, creating separate segments for BI (BI segment) and DFR (DFR segment) operations. Ensure that  
Figure 1: A Linux–Hadoop DFR framework for big data networks. the forensic nodes are placed on their own segment, which can securely communicate with the BI segment's NameNode and the cloud-based standby NameNode. 3. Equip the forensic nodes with dedicated network interfaces that connect them directly to the BI segment. This ensures that forensic operations are prioritised within their dedicated segment and can communicate efficiently with the NameNode in the BI segment and the standby NameNode in the cloud. 4. Install Linux OS, Java, and Hadoop on the forensic nodes, set up SSH (Secure Shell) access, and update host resolution. Use automation tools like Ansible or Chef to standardise and automate the installation process, reducing configuration errors. 5. Synchronise all nodes (BI segment, DFR segment, and cloud-based standby NameNode) to a reliable NTP server to ensure consistent time settings across the cluster. This is crucial for accurate timestamping and coordination of distributed processes. 6. Implement an active-passive NameNode setup with the primary NameNode located in the BI segment and the standby NameNode in the cloud. Configure a quorum-based JournalNode cluster spanning both the BI and DFR segments. This setup ensures that all updates to the NameNode's metadata are immediately synchronised across all relevant nodes, maintaining consistency and reliability in both BI and forensic operations. 7. Set up a backup of the DFR nodes in the cloud to ensure that all forensic data are securely stored and can be recovered in case of a failure or disaster. 8. Start Hadoop services on the forensic nodes, such as DataNode and any additional services related to forensic readiness. Ensure these services are properly configured to interact with the primary NameNode in the BI segment and the cloud-based standby NameNode. 9. Conduct simulated failover tests to ensure that the forensic nodes maintain synchronisation with the BI segment's NameNode and the standby NameNode in the cloud during a failover.