BATTLEFIELD DIGITAL FORENSICS

Table 1. Statistical Gatherable Intelligence Table, based on Chapter 8.
Statistical Gatherable Intelligence
O.S. Power Connectivity Anti-Forensic
ON OFF ON ON
Laptop - Overall 67.7% 59.2% 74.9% 33.6%
Windows 72,0% 63.1% 75.3% 35.1%
Linux/Unix 68,0% 59.2% 70.2% 32.9%
MacOSX 63,0% 55.4% 79.1% 32.9%
Phone - Overall 83.2% 77.6% 93.8% 42.4%
Android 93.2% 83.2% 96.3% 45.5%
iOS 81.2% 78.1% 93.2% 42.1%
Windows 75.1% 71.6% 91.8% 39.8%
Tablet - Overall 83.0% 76.8% 91.5% 41.9%
Android 91.4% 79.1% 93.1% 43.9%
iOS 80.3% 82.3% 92.3% 42.5%
Windows 77.4% 69.1% 89.1% 39.3%
Desktop 67.7% 57.2% 83.7% 34.8%
Windows 72.0% 63.1% 82.7% 36.3%
Linux/Unix 68.0% 59.2% 79.1% 34.4%
MacOSX 63.0% 49.4% 89.3% 33.6%
GPS 55.8% 52.8% 72.5% 23.3%
Server
Difficult to evaluate. The information is valuable, however these devices are
more effective if used as foothold for the sustaining phase (Chapter 9)
Storage
Wearables 91.2% 85.6% 95.3% 52.7%
IoT 82.8% 81.7% 95.3% 51.8%
6.4 Summarising the Technical Requirements
This paragraph focuses on final requirements that the DFA Infrastructure and the SOF Operator should consider
to optimise the intelligence collection:
Intra-team backup capabilities, based on ad-hoc mobile connections;
Understanding of the basic concept of intelligence gatherable from devices based on the statistical analysis
and experience;
Understanding of the basic functionalities of the vector used;
Understanding of the SIDSS process and the entire digital forensics process;
Understanding the importance of documentation after action, to support the Digital Forensics Analyst.
Knowledge of the basic anti-forensics measures that can be in place, and how to recognise them.
29