The big data paradigm has become an inevitable aspect of today’s digital forensics investigations. Acquiring a forensic copy of seized data mediums already takes several hours due to the increasing storage size. In addition are several other time-consuming laboratory analysis steps required, such as evidence identification, corresponding data preprocessing, analysis, linkage, and final reporting. These steps have to be repeated for every physical device examined in the criminal case. Conventional digital forensics data preprocessing and analysis methods struggle when handling the contemporary variety, variability, volume and velocity of case data.