BATTLEFIELD DIGITAL FORENSICS

Recommendation: When designing and configuring tools, be aware of the possibility of various data hiding
techniques.
Recommendation: If possible, try to do live imaging of storage media and RAM instead of only seizing them
(secure). Note that this might take too much time to be accomplished during the special operation;
however it could be possible to use additional devices and techniques as presented in Chapter 9 –
‘Sustaining the Data‘ to transfer the live images after the special operation.
Recommendation: If data is collected wirelessly during and after the operation via specific extractors, it
should be possible to physically destroy them remotely when wanted or automatically after the data
collection.
Recommendation: Be aware that hard drives or SSD disks might be encrypted, so if possible, try to capture
computers ‘as is’, without shutting them down or removing any storage media (secure).
7.2 Artefact Wiping
Artefact wiping means techniques for automatically or manually eliminating particular data, files or entire file
systems, usually permanently. 14 It includes data erasure (also referred to as data clearing or data wiping), and
disk degaussing and destruction 15 techniques. As mentioned in [18], artefact wiping tools make analysis more
difficult for forensics examiners, but they are not perfect. This chapter describes artefact wiping techniques
that the (SOF)DFA should be aware of.
If the (SOF)DFA is able to login to the OS or access an unlocked screen, and assess that destructive processes
are running, the device should be immediately turned off by removing power cord or its battery including
connected devices. The following example terms can indicate the destruction: ‘wipe’, ‘delete’, ‘format’,
‘remove’; however, the system’s language may not be English and destructive processes can also be done
stealthily. Still, it is important to check screens during the seizure, because it is possible that a destructive
technique such as data wiping is started after the forensics tools are connected to the device.
7.2.1 Wiping Data Remotely and Self-Destruction
In a normal situation, artefact wiping is done by specific cleaning tools. 16 In such situations there is no need to
do it fast, but during (or after) the operation, the enemy may use faster, more automated, and remotely
working techniques. This chapter describes self-destruction techniques and techniques usable for remotely
wiping the data.
As described by Jane Wakefield in [19], criminals have used remote wiping functions to wipe mobile devices
that were seized by police officers and secured in police stations. Because of this, it is important to store
devices properly immediately after capturing them. For this, anything providing the functionality of a Faraday
cage is suitable. 17 However, it is good to remember that kill-switch software exists, which wipes the device if it
cannot be connected or connect to a certain location in a certain amount of time. Self-destruction can be
implemented in smart phones, for example, by using specific clients that connect to the management server,
and if there is no connectivity, the smartphone will be wiped. Use of self-destruction functionality is not
14 Even if the purpose is to eliminate data permanently, in some cases and with specific tools it might be possible to get information about
it. See, for example, cases where formatting a disk once has not been enough.
15 It is possible to send remote commands to disks to destroy them physically, or to use booby-traps.
16 One cleaning tool is CCleaner, which is downloadable from https://www.piriform.com/ccleaner.
17 Military and intelligence agencies use Faraday bags to prevent unwanted applications being invoked remotely or data altered after
devices are seized. More details about Faraday bags can be found in Chapter 4 ‘The SIDSS Triage’.
32