## 2 What Is Big Data
### Digital Investigative Trends  
Whilst there appears little evidence in the digital forensics community concerning similarly large datasets, there do appear to be examples of very large and complex investigations. The Internet Crime Complaint Center (IC3) receives and processes internet crime reports for the USA. It has reported a growth in the number of internet crimes being reported between 2007 and 2012 as follows: 2007: 206,884; 2008: 275,284; 2009: 336,665; 2010: 303,809; 2011: 314,246; 2012: 289,874 [7]. This does not necessarily represent a dramatic increase in internet crime reporting, in fact there was a slight drop in 2010 and 2012, the general trend however seems to be an increase. The two drops in reporting can be explained by the multiple agencies to whom crime can now be reported and by users being more aware of the range of agencies available for the filing of such complaints. Similarly, the FBI has recorded a year on year growth in the number of digital investigations being conducted by them as well as a corresponding rise in the size of data being processed (Table 1 [8]). The multitude of investigations by the FBI and other law enforcement authorities represent a problem across the dimensions of volume, velocity and variety. Social media site (SMS) investigations involve data that spans large networks and includes a multitude of objects such as links, actions, pictures, video, text and associations. This is also demonstrated in large scale network investigations involving the analysis of corporate network log files such as those associated with firewall, IDS (Intrusion Detection Systems) or web servers. A typical organisational subdomain with 150 IP addresses may generate 60-70,000 IP entries in the firewall log per hour. Extend this to the whole network over the time period of a week and then across the range of log data available and this can easily reach more than 150 million entries. \begin{table}
\begin{tabular}{c c c} \hline
**Year** & **Number of e-investigations** & **Size of data processed (TB)** \\ \hline
2003 & 987 & 82.3 \\
2004 & 1304 & 229 \\
2005 & 2977 & 457 \\
2006 & 3633 & 916 \\
2007 & 4634 & 1288 \\
2008 & 4524 & 1756 \\
2009 & 6016 & 2334 \\
2010 & 6564 & 3086 \\
2011 & 7629 & 4263 \\ \hline \end{tabular}
\end{table} 
Table 1: Number of e-Investigations undertaken by the Federal Bureau of Investigation (FBI) [8]. The increasing complexity of digital investigative problems is evidenced further in a number of well-known case studies. [PERSON] and [PERSON] [9] highlight the example of the 2004 UN Oil for-food program fraud investigation. Iraq sold $64.2 billion worth of oil to 278 companies, $34.5 billion of the money was used to purchase humanitarian aid and goods from 3416 companies. The program was shrouded by allegations of bribes and fraud. The subsequent investigation involved thousands of documents and a substantial (but unstated) digital investigation. In this case, the financial scale of the fraud should not suggest that there was a correspondingly large and complex investigation, there may very well have been, however we do not have access to details relating to the investigation (as is often the case in such instances). Possibly the most well-known large scale digital investigation is that of Enron. Following the collapse of the company in 2001-2002, the US Securities and Exchange Commission (SEC) and the Federal Energy Regulatory Commission (FERC) conducted two separate independent enquiries into the scale of the fraud undertaken by the company. The email mailboxes of more than 150 executives, comprising more than 600,000 emails, were investigated. At the time this would have been a very complex investigation, particularly with 600,000 emails involved and thousands of attachments and associated e-documents.