BATTLEFIELD DIGITAL FORENSICS

configuring automated tools for gathering evidence, for example from computers. Data can be hidden in
various locations (such as memory, slack space, hidden directories, bad blocks, alternate data streams, or
hidden partitions) in a computer system. Because of this, it should be remembered that automatic tools only
capture common user document folders, and some hidden but useful data is possibly left behind.
During special operations there is no time for analysing possible anti-forensics data hiding techniques; however
there might be time to consider physical hiding. Storage media and small computers can be physically hidden
anywhere. This might be more useful information for the SOF than data hiding techniques. For example, USB
flash drives can be in the form of food, toys, 9 jewellery, or tools. A transparent USB flash drive is shown in
Figure 2.
One anti-forensics technique presented by Michael Perklin [16] is dummy HDD, which means a computer with
an HDD that is not actually used. The actual OS can be booted from an USB flash disk. It is possible to still write
to the HDD so that it looks as if it has been used; however, during a special operation there is no time for such
analysis with the available forensics tools. Perklin gives guidelines for mitigating dummy HDDs: two usable
techniques are checking USB flash drives in USB slots (and pending time availability, also on motherboards, see
Figure 7) and monitoring network traffic before seizure to detect remote drive locations. 10
Figure 7. Example USB slot in a motherboard 11 .
A ‘redundant array of independent disks’ (RAID) is used in storage systems to prevent data loss in case of
hardware defects on a hard disk and to improve I/O performance [17]. When using RAID 0, only the latter can
be achieved. If the enemy is using only data stripping with RAID 0, all the disks used in the setup need to be
collected. With other RAID types providing fault tolerance, capturing all disks might not be required. Because of
this, the enemy could use physically distributed and/or hidden RAID disks to make analysis in the laboratory
harder or impossible. It is worth noting that RAID also causes other challenges, for example if specific drivers or
controllers have been used to create custom RAIDs. 12 In such cases, it might be easier to collect the full
computer; however, if this is not possible, tools can be used to detect parameters to reassemble the logical
RAID volume. 13
Recommendation: Be aware that computing devices do not necessarily look like computers (the scan and
identify parts of triage).
9 For example Lego bricks, rocks, lamps, beverage coolers, coffee warmers, and other desktop toys may contain a USB plug and have the
capacity to store information.
10 The third one is checking if the OS was paging and if the Pagefile on USB flash drive points to network locations.
11 Figure from http://www.howtogeek.com/201493/ask-htg-can-i-plug-a-usb-device-right-into-my-motherboard/
12 In [16], Michael Perklin described using custom RAID parameters as an effective anti-forensics technique.
13 An approach to automatically detect all parameters based on block level entropy measurement and generic heuristic is presented in [17].
31