Forensic analysis through metadata extraction

A method, comprising:

• generating, by a network storage device comprising a processor, a metadata product comprising data items associated with an architecture of a distributed file system, wherein the distributed file system comprises disks;
• in response to receiving an alert associated with a first degradation event associated with at least one disk of the disks, extracting, by the network storage device, at least one data item associated with the at least one disk from the data items of the metadata product;
• generating, by the network storage device, a report comprising the at least one data item extracted by the network storage device;
• and
• predicting, by the network storage device, at least one other disk of the disks that has an increased risk of a second degradation event as a result of the first degradation event.

A computer program product that provides information about a disk that associated with a degradation event, the computer program product comprising a non-transitory computer readable medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

• generate a metadata product having data items associated with an architecture of a distributed file system, wherein the distributed file system comprises disks;
• generate an alert in response to detecting a first degradation event associated with a first disk of the disks;
• predict a second disk of the disks that has an increased risk of a second degradation event in response to the first degradation event;
• and
• extract respective data items associated with the first disk and the second disk from the data items of the metadata product.