BATTLEFIELD DIGITAL FORENSICS

4
The SIDSS Triage
Christian Braccini
In [1] Perry has identified a set of ‘rational and well-conceived principles to guide operators when involved in
the search and seizure of digital information and electronic devices’. The set, underpinning the scan, identify,
document and secure phases of the process, is further expanded with the sustain phase in this monograph.
Basic principles are as follows:
1. SCAN
2. IDENTIFY
3. DOCUMENT
4. SECURE
5. SUSTAIN
a. Visually scan the environment for the presence of electronic media and devices. Be aware of
hidden and obfuscated devices.
b. Scan the area for the presence of a wireless/wired network. Use the information obtained to
calculate the probable number of devices. However, be aware that fake networks may also
exist.
a. Identify electronic devices, all digital devices, media and connectors.
b. Identify devices connected to any network (local or external).
c. Examine the devices for any visible damage.
d. Identify booby-traps, kill-switches and devices using other anti-forensics techniques.
a. Log any visible physical damage.
b. Video/photographically document room(s) in which the equipment is found, the front and
back of the computer or sketch any physical evidence (including cords and connections) to be
seized, before removing.
c. Operators should generally avoid active interaction with the computer, unless planned (e.g.,
on-loading surveillance software may actually be the mission).
d. Use labels (to include the collector’s initials, date, and time), putting evidence tape on the
back of the machine.
e. List the contents of each container that is being transported, when time permits, and seal
with evidence tape.
f. Record all activities conducted and maintain a chain of custody.
a. Secure any printed material or hard-copy evidence.
b. Determine if device is on or off; if on, the screen might have content of interest (take
pictures). Otherwise, look for lights or sounds.
c. Try to access volatile data content. Be aware that anti-forensics memory techniques might
have been used to modify volatile content.
d. Power down any devices only if forced to (i.e. physical extraction of HDDs) and log the time of
the shutdown.
e. Safely secure seized electronic devices and media for transport in a hard-shell case (if
available), Faraday bag, packing foam, antistatic plastic wrap, or cotton cloth.
a. Install surveillance software if conditions allow.
13