BATTLEFIELD DIGITAL FORENSICS

3
Statement of the Problem
Christian Braccini
3.1 Digital Intelligence and Evidence Collection
Today’s military is adapting to asymmetrical warfare and evolving real-time threat matrices that require new
approaches to military operations. Digital intelligence and evidence collection (as part of site exploitation)
represent the new approach in targeting mobile, social, virtual and collaborative threat models to process
information.
Site exploitation is composed of tactical exploitation and technical exploitation as described in ATP 3-90.15 [2].
Tactical site exploitation consists of activities performed at or near a specific spot. These activities enable
materiel at the site to be effectively detected, collected, and processed. The materiel exploitation that follows
will likely answer information requirements and facilitate future operations.
Conversely, technical exploitation is conducted off-site, in most cases. The security environment of forward
operating bases (FOB) or national-level laboratories for technical exploitation allows for the later use of
advanced processing techniques.
ATP 3-90.15 [2] further describes the use of forensic-based procedures to ensure that identification and
collection tasks support the analysis and dissemination in the targeting cycle presented in Figure 1. The
targeting cycle can quickly take apart the network of an insurgency or at least damage it to such an extent as to
make it a low-level threat.
Figure 1. The Targeting Cycle [3].
As tactical site exploitation capabilities evolve, Special Operations Forces (SOF) are challenged with more
technically advanced core activities on-site, including:
Search techniques;
Biometrics;
Forensics; and
Document and media exploitation.
11