BATTLEFIELD DIGITAL FORENSICS

This system communicates with operators on the ground equipped with proper exfiltration vectors. The
evaluation of the possible compatible vectors will be explained in the following paragraph.
6.2.1.2 Stand-alone Exfiltration Point
Another potential infrastructure implementation is the stand-alone exfiltration point.
This option is obviously the cheapest and easier to implement from a technological point of view, but from a
tactical perspective it represents a big issue: the acquired information is stored in a single point, aka the
exfiltration vector, which is also the single point of failure of the acquisition chain. All the vectors that are
compatible with this option will be described in the following paragraphs.
6.2.1.3 Vector Options
As mentioned above, one of the critical parts of the entire infrastructure is the vector used by the operator,
which should have some particular characteristics, such as portability, cross-platform architecture, plug-andplay
solution (as simple as possible). This part of the study presents ways for the vector to be implemented,
which need to fit in the overall DFA:
USB: the simplest way to choose is, without any doubt, a simple USB drive. This solution is the easiest to
implement but is also the one that represent the biggest point of failure, because it fits with the standalone
exfiltration point given to the operator; however, the USB should be able to connect with a number
of heterogeneous devices, and should execute code capable of a forensic acquisition of volatile data on a
lot of platforms, with minimum interaction from the SOF operator.
USB+: this solution is based on the USB but goes a step further; it represents the minimum requirement to
support the ad-hoc mobile file system and guarantee intra-team backup, in such a way as to avoid the
single point of failure of the simple USB drive. This solution should be able to communicate with the
exfiltration infrastructure with a main channel, which can be a Wi-Fi connection, and a backup channel
such as Infrared or Bluetooth. As well as having all the characteristics of the USB described above, the
USB+ should also implement some anti-forensics techniques (as described in Chapter 7 – ’Anti-Forensics
Measures’), to limit the amount of information that the enemy can eventually gather from (SOF)DFA
infrastructure. This requirement is mandatory because, as will be shown in paragraph 6.3 on statistical
gatherable information, the implementation of anti-forensics techniques drastically reduces the
information that can be acquired. Another aspect that should be covered is the opportunity of the sustain
part of the triage as will be explained in Chapter 9 – ‘Sustaining the Data’: this solution is intended to
deploy the malware used to create persistence in the network.
Wearable Options - Battlefield Internet of Things: The last option described is a cutting-edge version of the
common wearable technology: this option should be able to meet all the requirements including physical
ones. This option can fit the Smart Dust Sensor solution, covered in Chapter 9 – ‘Sustaining the Data’.
6.2.1.4 (Architectural) Minimum Technical Prerequisites
The previous part of the chapter described some options to build the architecture to support the DFA in SOF
operation. This paragraph summarises the minimum technical requirements, whatever technology is being
used:
Intra-team backup: The information acquired is invaluable and can help future missions and save many
lives; for this reason it is essential to have the capability to store information not in a single point, but in
the infrastructure itself. Using a DTN-based Mobile Ad-hoc Network (MANET) can be the best option.
Easy to Use: The timeframe of the SOF raid is limited, meaning there is no time for troubleshooting.
Architecture should be stable and the exfiltration vector should privilege maximum automatism.
25