Added HadoopAppRoot artifact definition

ForensicArtifacts · Sep 6, 2018 · 9dd8149 · 9dd8149
1 parent a0bacd2
commit 9dd8149
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 1 deletion.
diff --git a/artifacts/__init__.py b/artifacts/__init__.py
@@ -1,4 +1,4 @@
 # -*- coding: utf-8 -*-
 """ForensicArtifacts.com Artifact Repository."""
 
-__version__ = '20180827'
+__version__ = '20180830'
diff --git a/artifacts/definitions.py b/artifacts/definitions.py
@@ -25,6 +25,7 @@
         'Information about any user accounts e.g. username, '
         'account ID, etc.'),
     'External Media': 'Contain external media data or events e.g. USB drives.',
+    'Hadoop': 'Hadoop artifacts.',
     'IM': 'Instant Messaging / Chat applications artifacts.',
     'iOS': 'Artifacts related to iOS devices connected to the system.',
     'History Files': 'History files artifacts e.g. .bash_history.',

diff --git a/data/hadoop.yaml b/data/hadoop.yaml
@@ -0,0 +1,9 @@
+# Hadoop artifacts
+
+name: HadoopAppRoot
+doc: Location where Hadoop application files are stored
+sources:
+- type: PATH
+  attributes: {paths: ['/hadoop/yarn/system/rmstore/FSRMStateRoot/RMAppRoot/application_*/application_*']}
+labels: [Hadoop]
+supported_os: [Linux]