BATTLEFIELD DIGITAL FORENSICS

From a targeting perspective, digital media found in a site potentially produce evidence indicating C2 activities
with nodes of the enemy’s network (proxies). A thorough Tactical Questioning (TQ) of detainees might provide
hints for the attribution of social media accounts operating C2 covert activities. A surveillance operation of
proxies’ location potentially produces further intelligence and a subsequent raid, which in turn provides other
evidence and more intelligence.
Site exploitation is composed of five core activities [2]:
Detect;
Collect;
Process;
Analyse; and
Disseminate.
These activities inform the methodology (triage) to adopt during the media and cell-phone collection
performed while on site, which is of specific interest in this paper. A dedicated paragraph will address the
(digital) triage in the context of site exploitation compressed operations.
3.2 The SOF Digital Challenge
The likelihood that SOF will encounter enemy computers, portable electronic equipment and digital storage
media has definitely grown since Perry [1] first stated it. One of the biggest challenges for SOF is collecting and
handling the discovered data so that it can be subjected to forensic analysis. As Perry [1] explains, ‘successfully
discovering, preserving, and assuring digital intelligence for exploitation and legal purposes is essential to
support mission assurance and national security objectives’. Digital data are inherently volatile due to the
complexity of their structure and the fragility of the digital storage; the corruption of a few bits of data might
render the information impossible to retrieve. In order not to contravene courts’ rules of admissibility, digitalbased
evidence has to be presented in a suitable way that will lead to the successful conviction of terrorists.
How can SOF conduct tactical site exploitation (from tactical entry, discovery of digital assets and the
establishment of a valid chain of custody) without endangering the lives of operators, while still assuring the
integrity of digital information?
When dealing with digital evidence, general forensics procedures should be applied:
The process of collecting, securing, and transporting digital evidence should not alter the evidence.
Digital evidence should be processed only by those qualified specifically for that purpose.
Everything done during the seizure, transportation and storage of digital evidence should be fully
documented, preserved and available for review.
Chaos and unpredictability characterise the battlefield. Force protection (FP) and prioritisation should remain
the primary consideration for responders. Assuring electronic evidence collection is therefore one of the
biggest challenges for SOF. Every team operating on the site will have to rapidly identify sources of valuable
digital information, document the findings, and secure computers and storage media. To accomplish this new
mission, SOF will consider employing a Digital Forensics Asset (DFA), ‘which basically is adding yet another skill
to SOF’s already full rucksacks’ [1].
12