O'Reilly logo

Big Data Forensics – Learning Hadoop Investigations by Joe Sremack

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Collecting HBase evidence

HBase differs from Hive in a number of ways. First, HBase is not a relational database. Unlike Hive, HBase does not support SQL-like queries, because SQL is a language for relational databases. Second, HBase does not have a metastore database. Instead, HBase is a nonrelational database based on Google's BigTable that works with HDFS for data storage and access. Third, HBase data is distributed to various nodes in regions, or to data blocks that store column-oriented chunks of related data. It is far easier to collect HBase evidence through HBase rather than collecting from each node due to the distributed nature of the data.

Given the complexity of carving out data from HFiles, collecting HBase evidence through the HBase ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required