Implementation of digital forensics readiness in big data wireless medical networks

In recent years, both cybersecurity incidents (such as data breaches) and clinical safety incidents have increased significantly in the healthcare sector. When combined with the sensitivity of healthcare data, the vulnerability of wireless medical networks (WMNs) to cyberattacks, stringent data protection regulations, and the complexities of managing big data, these factors highlight the urgent need for proactive security measures. This need can be addressed through the implementation of robust Digital Forensics Readiness (DFR) within WMNs, enabling efficient digital investigations and supporting business continuity following security incidents. Most existing DFR frameworks for WMNs rely on centralised logging architectures, creating potential single points of failure and inadequately addressing the role of big data, particularly unstructured data, in DFR and Incident Response (IR). To address these limitations, this research proposes a novel big data WMN DFR framework supported by an automated, user-friendly Linux-Hadoop Forensics Extractor (LHFX) tool tailored for big data Linux-Hadoop environments. Two prototypes were developed: a partial implementation of the framework’s big data DFR (BdDFR) environment and a fully functional LHFX tool. The proposed framework supports the holistic management of structured, semi-structured, and unstructured evidential data, enabling the identification, collection, storage, and analysis of potential digital evidence from heterogeneous healthcare sources. The framework was evaluated using a real-world scenario-based assessment to examine its forensic applicability and evidential coherence. In addition, there was a detailed comparison with existing WMN DFR frameworks to identify its novel contributions. Furthermore, the BdDFR environment was assessed across key configuration criteria relating to decentralisation, security, and scalability, while LHFX functionality and usability were evaluated through controlled testbed deployment. The findings demonstrate that the proposed framework enables decentralised and secure evidential storage, supports scalable management of heterogeneous healthcare data, and facilitates structured forensic readiness within distributed WMN environments. The LHFX tool operationalises forensic artefact acquisition within Linux-Hadoop systems, supporting practical implementation of BdDFR concepts. Overall, the framework provides an adaptable approach for integrating forensic readiness into big data healthcare networks, thereby strengthening incident response and business continuity capabilities within WMNs and comparable distributed environments.