BATTLEFIELD DIGITAL FORENSICS

common, as it could also wipe the data during accidents such as power loss in cell towers. Storage media 18 and
other devices also exist which can be destructed physically via an SMS and have a self-destruct functionality
(that is launched if the device is put into a Faraday cage).
Recommendation: Check the number of wireless connections and devices with specific equipment to
discover if storage media have integrated GSM receivers (scan and identify).
Recommendation: Mark devices that have wireless connections (document). Seal the captured devices into
Faraday bags or similar (secure).
o Be aware that some of the devices might wipe themselves when they lose Internet/GSM
connectivity (secure). However, because it is rare, use the Faraday bag from these two options.
Figure 8. Autothysis128t 19
In addition to remote commands via SMSs, Autothysis128t SSD (shown in Figure 8) provides some other means
of self-destruction. When the computer or the SSD is put into a Faraday cage, the SSD will self-destruct after a
set number of hours of GSM starvation. It is also possible to set it up so that the self-destruct is triggered when
it is removed from the SATA III interface.
Before turning any device off, it is good to be aware that the enemy might have manipulated a ‘graceful
shutdown’ process to prevent evidence recovery. As Lance Cleghorn writes [21], many technology professionals
feel compelled to shut down the computer in question through a graceful shutdown rather than remove power
from the system and risk data corruption or loss of volatile data not committed to permanent storage.
However, it is possible to modify the graceful shutdown process with anti-forensics techniques so that
evidences can be disrupted or destroyed. This is one reason why the shutdown of the device should always be
done by pulling the power plug and/or removing the battery from the device.
7.2.2 Wiping Data When Use of Forensics Tools Is Detected
This chapter presents techniques that can be used to wipe the data when the system detects the use of digital
forensic investigation tools.
18 One such approach is presented by SecureDrives. Autothysis128t SSD, presented in Figure 8, has a GSM based remote control allowing
for data destruction and physical fragmentation of the NAND-Flash storage on demand.
19 Figure from http://securedrives.co.uk.
33