Data is a kind of competitive resources for all walks of life in the future, thus how to get effective data will become a problem to be solved in the process of public security information construction. Especially with the development and application of cloud computing technology, the scale of information system applied in the various fields has enlarged, and the amount of data has also increased day by day. Internet brings to people rich information, and on the other side, promotes the network crime, which creates more work to investigators. The biggest challenge is the traditional electronic forensic technology has been unable to store and analyze massive data efficiently. Serial processing technology and single processor is hard to deal with a huge amount of data within a valid period of time, and cannot meet the demand of large dataset for physical devices as well as the demand of sharing various data. Cloud computing is highly prized for the mode of pay-on-demand, regardless of the conditions of many bottom infrastructures. As an open source cloud computing infrastructure, Hadoop is the most successful and popular big data batch processing platform so far. Based on the research of Hadoop platform, this article applies Hadoop to electronic forensic to establish a hierarchical forensic model under the big data environment. At the same time, this article provides theoretical support to achieve the reasonable scheduling of the equipment resources, and to construct the comprehensive forensic service platform for intelligence sharing of data resources.%数据是未来各行各业必争的资源，如何获取并有效利用数据将成为公安信息化建设进程中亟待解决的问题。特别是随着云计算技术的发展及应用，行业应用领域信息系统的规模日益增大，产生的数据量也急剧增加。互联网在给人们带来丰富信息的同时，网络犯罪活动也日益增多，这不仅增加了办案人员的工作量，也使传统的电子取证技术面临无法高效进行海量数据的存储和分析的挑战。串行处理技术与单处理器很难在有效时间内处理巨大的数据量，同时无法满足大规模数据集对于物理设备的需求以及数据资源的共享需求。云计算推崇的是按需付费模式，不必考虑太多底层基础设备的情况。Hadoop作为开源的云计算基础架构，是目前应用最成功和最广泛的大数据批处理平台。文章在研究Hadoop平台的基础上，将其应用于电子取证中，构建基于大数据环境的层次化取证模型，为设备资源合理调度、建设数据资源智能共享的综合取证服务平台提供理论支持。
展开▼
