BATTLEFIELD DIGITAL FORENSICS

More documents

Recommendations

Info

Figure 4. Faraday Cage 4 . The sustain phase represents the new frontier for intelligence-gathering purposes. In planning the mission, an accurate cyber-intelligence preparation of the battlefield (C-IPB) could reveal the presence of enemy critical information that will be difficult to extract because of device portability or accessibility; as an example, this is typical of data centres. Installing surveillance software on targeted devices and operating data exfiltration through swiftly established wireless networks may represent a valuable alternative. The challenge is composed of a combination of factors, ranging from the possibility of targeting (with malicious payloads) complex server solutions to the survivability of the deployed networks that could operate even beyond the strike duration. Chapter 9 – ‘Sustaining the Data’ covers the matter in more detail. 4 Figure Courtesy PARABEN. 17
5 Onto the Battlefield Christian Braccini The asymmetric threat environment where SOF operate includes expected or unexpected exposure to electronic devices and storage media being used by the enemy to process critical information. The opportunity to target the enemy’s Battlefield Internet of Things, either for intelligence exploitation or legal actions against illegal combatants/criminals, lies in the digital forensics capabilities of combat-compressed operations, typical of SOF. These capabilities begin with SOF operators scanning and identifying the digital assets for transport, then eventually turning them over to forensic specialists and intelligence analysts for technical exploitation [1]. Having established a proper chain of custody would be the key for any criminal prosecution. SOF will have to deal with a complex set of procedures where different variables influence the overall success of digital media collection. The triaged approach, as proposed in this monograph, aims at maximising the effectiveness of decisions to be taken in combat-compressed operations that are likely to be also technical exploitation operations. Far from turning SOF operators into IT experts, the maximum use of automation and the latest technological findings, in terms of deployable architecture supporting data extraction, show the way for SOF to achieve accuracy, agility and rapidity when it comes to digital data collection. From this narrowed approach, focused on SOF operating in the battlefield, different scenarios might be derived ranging from homeland counterterrorism to more conventional investigations. Different constraints, in terms of survivability on the ground and technological support available, might therefore require specific tailoring of digital forensics procedures as proposed in this study. The chapters that follow are intended to describe in more detail the role of technology in leading digital intelligence and evidence collection on the battlefield. Opportunities lie on both sides, the ally and the enemy, where the effectiveness of digital forensics techniques and the sophistication of supporting architectures confront the equivalent, advanced anti-forensics response of the opponents. The insights presented here aim to support the different principles constituting the SIDSS triaging model: the IT architecture estimation of the target infrastructure including anti-forensics measures potentially in place (scan); the most effective procedures for physically extracting hard disk drives; expeditionary wireless ad-hoc networks supporting a surveillance software-driven exfiltration of data (secure); and how to conduct the operation in line with the legal framework and create a chain of custody. In particular, the following chapters contain the present information: Chapter 6 – ‘Computer Forensics’ covers in detail the technical architecture supporting SOF digital forensics tasks. It also includes a description of the information statistically gatherable during analysis, providing guidance for the SOF team’s prioritisation of acquisition. Chapter 7 – ’Anti-Forensics Measures’ covers anti-forensics measures that the SOF should be aware of. It concentrates on opposing techniques used to make the scanning and identification of evidence more difficult; it also describes techniques that can be used by the enemy after the collection, for example to wipe the evidence or to destroy forensics investigation tools. Chapter 8 – ‘Exfiltration Solutions’ describes different data exfiltration scenarios for SOF digital intelligence collection operations. Simple flowcharts with explanations clarify the SOF operator’s decision on how to proceed if a specific type of device is identified. Basic mechanisms for how to secure an electronic device that represents potential evidence are included in the chapter as well. Chapter 9 – ‘Sustaining the Data’ gives an overview of requirements and possible technological alternatives for the establishment of an information channel during the sustain phase of the SIDSS triaging model. This 18
Page 1 and 2: Christian Braccini, Teemu Väisäne
Page 3 and 4: About the NATO CCD COE The NATO Coo
Page 5 and 6: Table of Contents About the NATO CC
Page 7 and 8: Figures Figure 1. The Targeting Cyc
Page 9 and 10: LED Linux LTE MANET materiel MEDEX
Page 11 and 12: properly discovered, preserved and
Page 13 and 14: From a targeting perspective, digit
Page 15 and 16: . Utilise the existing internet con
Page 17: Figure 3. A faulty laptop explosive
Page 21 and 22: 6 Computer Forensics Agostino Panic
Page 23 and 24: In a wireless ad-hoc network, all t
Page 25 and 26: However, this solution is impossibl
Page 27 and 28: Connection Backup: The vector shoul
Page 29 and 30: The goal of this statistical approa
Page 31 and 32: 7 Anti-Forensics Measures Teemu Vä
Page 33 and 34: Recommendation: When designing and
Page 35 and 36: As presented by Azadegan, Liu, Sist
Page 37 and 38: Recommendation: Be aware that harml
Page 39 and 40: security for smartphones are descri
Page 41 and 42: If any marks of explosives are dete
Page 43 and 44: 8 Exfiltration Solutions Michal Sad
Page 45 and 46: Portable device found Laptop Type o
Page 47 and 48: As with other portable devices (suc
Page 49 and 50: Devices might be found in different
Page 51 and 52: 4. Remove the drive from the drive
Page 53 and 54: items of the evidence, typically on
Page 55 and 56: 9.1 Surveillance Software Installat
Page 57 and 58: A communication channel to satellit
Page 59 and 60: Figure 21. ABSOLUTE System Architec
Page 61 and 62: 10 Chain of Custody Kris van der Me
Page 63 and 64: police or other official investigat
Page 65 and 66: [15] E. Imsand and J. A. Hamilton,
Page 67 and 68: [46] J. M. Kahn, R. H. Katz, and K.
Page 69:
13 Acknowledgements Authors of the
show all

BATTLEFIELD DIGITAL FORENSICS

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?