BATTLEFIELD DIGITAL FORENSICS

set of measures (establishing the basis of the chain of custody, such as video-recording of the seizure) must be
undertaken as a minimum to avoid damaging the admissibility of evidence. Approaches might also differ if
volatile data represent the actual target. Again, first responders’ judgment will establish prioritisation.
Operators should scan the environment for the variety of computers and electronic devices capable of storing
information. Computers are not limited to desktops, laptops or notebooks, but also include rack-servers and
raid solutions, wireless NAS, media players, etc. Hand-held devices can include smartphones, tablets, PDAs, etc.
GPS, games consoles, smart televisions and printers also process and store valuable information.
Figure 2. Transparent USB drive 1 .
Operators should also look for digital storage media in the form of internal/external hard drives, thumb drives,
electronic cards and DVDs. Storage devices might be deliberately deceptive in appearance, implementing antiforensics
measures 2 and assuming the form of a Swiss knife, cork bottle stopper, transparent USB memory
drive (see Figure 2), etc. Miniaturisation enables a significant amount of information to be stored in solutions
that are almost impossible to retrieve in compressed site exploitation operations.
During the scanning, a computer network can be detected from modular RJ45 connectors plugged into network
interface cards (NIC) or a positive result from wireless signal detection devices. Discovering a wireless network,
in particular, can have a major payoff, due to the physical proximity of the connected computers and hardware:
large capacity wireless hard drives might be hidden from view but contain valuable records for intelligence
exploitation purposes. With the current forensics tools, the SOF might not be able to detect everything during
the operation. For example, scanning the number of networks to create an estimate of devices present may
give a clue to hidden devices, but it is much easier to create fake networks than to detect them. Booby-traps
and kill-switches may be present, also including hidden and obfuscated devices. In the worst case, some
electronic devices might contain bombs that are not discovered during their seizure. As the technical
exploitation begins, particular caution should be applied in case of possible usage of anti-forensics techniques,
including explosives. It is therefore important to document discovered techniques and suspicious evidence
before turning over materiel for analysis.
1 Figure from http://www.bitrebels.com/technology/polytron-transparent-usb-flash-drives/
2 Various types of devices are listed also in paragraph 7.1- ‘Data and Device Hiding‘.
15