BATTLEFIELD DIGITAL FORENSICS

Recommendation: Be aware that harmless-looking devices may actually include several important devices
containing possible evidences (scan and identify).
In many OSs, it is possible to change the outlook of the GUI so that it seems to be some other OS. One example
of a Gnome theme looking like Windows XP is presented in Figure 12. There are different procedures and
specific tools that can be used only in certain OS. Because of this, tools that work in several environments could
be used.
Recommendation: Try to identify fake evidence (scan and identify). Use custom wireless scanners to detect
real and fake networks.
Recommendation: If there is no time, try not to capture obviously fake evidence (secure).
Recommendation: Use specific tools to check OS type and version before using tools that work only in
certain OSs.
7.4 Exfiltration
Figure 12. CinnXP-Luna theme in Linux; it looks similar to Microsoft Windows XP 24 .
Data exfiltration can be defined as unauthorised transfer of data from a computer. This includes techniques to
evade security monitoring tools, but also techniques that can used for obfuscation, such as steganography. The
same techniques can often be used for other purposes, such as for creating stealthy channels for remote
controlling of devices. This chapter describes exfiltration techniques that are relevant and important to know
during special operations or after them. However, after inserting the captured devices into Faraday bags, there
is no need to worry about them until the actual investigation.
It is possible that some of the captured USB flash drives are actually human interface devices (HIDs). Any USB
device claiming to be a Keyboard HID will usually be automatically detected and accepted by most modern OSs.
24 Figure from http://gnome-look.org/.
36