BATTLEFIELD DIGITAL FORENSICS

prior to the operation, gather needed tools and a supply of packaging materials that will help to assure the
safe removal of the digital devices and media;
define the technical architecture supporting a data exfiltration operation;
prepare any preliminary paperwork;
brief personnel on any expected digital evidence or information that might be recovered;
designate at least one forensics computer specialist to be in charge of prioritisation of the acquisition;
identify computer and electronic devices and media;
avoid interacting with the computer or executing any programs based on instinct;
document computer and electronic evidence by labelling, photographing, or sketching after the action;
package all electronic devices, media and other transportable evidence to be exfiltrated;
remove and transport evidence and protect the physical integrity of the components.
6.2 (SOF)DFA and (IT)Target Infrastructure (ITTI)
The previous paragraph has introduced the basic requirements needed for the acquisition of digital forensics
evidence in a hostile environment; this operation should be supported by an infrastructure designed with this
scope in mind. This paragraph will describe an overall architecture that can be used to address this problem. At
the moment there is no technical solution specific for this, so this document provides a possible
implementation, highlighting the limitations that can be faced. First of all, the technical infrastructure
supporting the SIDSS process should be defined.
(SOF)DFA: (Special Operation Forces) digital forensics asset. This term includes the set of DF trained operators,
the technology used and the procedures adopted to achieve the specific task of digital information collection
during the strike. The analogy that comes to mind is the medical asset present in any military operation: in the
same way, the forensic asset should allow operators to perform a correct triaging process based on the SIDSS
model explained in the previous pages.
ITTI: Information technology target infrastructure. This term describes the IT Infrastructure present in the
environment to be targeted, which is heterogeneous and unpredictable in nature. The first statements of these
environments will be covered in the following part of this chapter, by using real case scenarios, as detailed in
Chapter 8 – ‘Exfiltration Solutions’.
6.2.1 (SOF)DFA
The technical architecture supporting the SOF team can be implemented in many different ways, using
different types of technology. This paragraph analyses some possible implementations, classifying them based
on the connectivity linking the operators.
6.2.1.1 Ad-hoc Mobile File System
The first method is based on a project in development at La Sapienza, University of Rome, which is a work in
progress but is relevant to the object of this infrastructure.
The proposed infrastructure is based on an ad-hoc mobile file system, which can be used to support the data
exfiltration operation and also to guarantee the intra-team data backup that is one of the basic requirements
of the DFA module of the SOF Team. More information about related file distribution research can be found
from [5][6][7][20].
Unlike the conventional infrastructure-based wireless network, an ad-hoc network, as a distributed wireless
network, is a set of mobile wireless terminals communicating with each other without any pre-existing fixed
infrastructure. The mobile wireless ad-hoc network has several unique features that challenge the network
operation, such as the routing algorithm, attack vectors, quality of service (QoS), resource utilisation, etc.
21