BATTLEFIELD DIGITAL FORENSICS

In order to achieve this goal, the following part of this chapter covers the statistical analysis of the information
present on different kind of devices. It should be underlined that the approach is based on empirical data
mixed with a statistical overview, and the results can change if correlated with information-gathering about the
ITTI.
When collecting evidence, it is recommended to proceed from the volatile to the less volatile. This is an
example of order of volatility for a typical system:
registers, cache;
routing table, address resolution protocol (ARP) cache, process table, kernel statistics, memory;
temporary file systems;
disk;
remote logging and monitoring data that is relevant to the system in question;
physical configuration, network topology;
archival media.
The goal in this study is to assure, statistically, that the gathered information is the most comprehensive
possible, in a way that can lead further operations.
To reach this goal, an algorithm to assist in determining the major possibility of information gathering is
needed.
For this algorithm the following information is needed in order to carry out the statistical analysis:
Effectiveness: in percentage terms, the likelihood of the device containing useful information;
Level of effort / resources: estimated time to perform prioritisation based on small, medium and large
estimates;
Compatibility of toolsets: the amount of time in minutes to adjust or install the prerequisites for this
device;
Familiarity with devices and this toolset: based on descriptions of novice, experienced, and expert.
The first step to take in addressing the statistical analysis is to obtain the needed parameters, defined as
follows:
Effectiveness: this parameter should cover how effective an acquisition of a different type of device can
be;
Acquisition time for dataset size: this parameter should address the amount of data that can be acquired in
the mission amount of time;
Additional costs are ‘converted’ to minutes to adjust methods that require an additional set-up time or
resources: this parameter should cover the troubleshooting time needed in case of tools failure;
Power status: this parameter should cover the power status of the device, in case of a portable device this
parameter is critical, but the risk can be reduced using an external power supply;
Connectivity: this parameter should cover the connectivity status of the device, this evaluation should be
done before the acquisition, also because, as explained in Chapter 8 – ‘Exfiltration Solutions, the acquired
device should be stored in a ‘safe place’ to avoid enemy interaction with it;
Anti-forensics measures: this parameter should take into account the statistical degradation of information
if an anti-forensics measure is in place, to understand and recognise anti-forensics measures (see Chapter
7 – ’Anti-Forensics Measures’ ).
The study starts by addressing which kind of device is most likely collectable from the operators on the ground,
as the first step of the analysis. From this algorithm, the statistical gatherable intelligence is calculated.
27