BATTLEFIELD DIGITAL FORENSICS

One infamous example is USB Rubber Ducky 25 . Automated scripts and malware inserted into captured devices
might, for example, call home.
Recommendation: Be aware that USB flash drives might contain malware or automated unwanted scripts
(after the strike). Because of this, content in the captured devices must be analysed in machines that have
no Internet connectivity (to prevent exfiltration and calling home).
7.5 Attacks against Forensics Tools
This chapter describes detection and attacks against digital forensic investigation tools.
As described in paragraph 7.2.2, ‘Wiping Data When Use of Forensics Tools Is Detected’, it is possible to create
software which detects the usage of forensics tools, memory analysis, etc. Scenarios presented by Azadegan et
al. in [22] only contain modifying and destroying data from the smartphone; however, it is possible that the
enemy may use the same ideas and hide or leave behind booby-trapped devices with electronic detonators and
explosives. 26 These devices would then explode when connected into specific detected forensics tools, or taken
to certain locations. Other destructive anti-forensics techniques, such as USB drives destroying (burning)
hardware in computers, can also be categorised under booby-traps. More information about one example can
be read in paragraph 7.6.3 – ‘USB Killer‘. USB flash disks acting as HIDs can be also used to attack against
forensics tools. During the special operations that this study covers, it is unlikely to find hidden explosives
inside electronic devices; they might be present in strikes related to counterterrorism.
Recommendation: Before opening any device or connecting the forensics tools to it, first analyse devices
to detect if they contain any explosives, for example by using colorimetric test kits, or dogs (secure).
o Leave devices containing any marks of explosives behind. Follow SOF’s procedures for handling
explosives.
Recommendation: After the operation and before connecting the forensics tools to the device, first
analyse collected devices to detect if they contain any explosives, for example by using colorimetric test
kits, dogs, or x-ray machines (after the strike).
7.6 Booby-Traps
A booby-trap can be a software, device, configuration of a system, or combination of these with an intent to
kill, harm, or surprise a person, or to make the forensics process more difficult. This chapter describes
examples of booby-traps using IT devices that SOF members should be aware of.
7.6.1 Proximity Sensors and Tags
This chapter describes how different type of proximity sensors and tags can be used as anti-forensics measures
and for creating booby-traps. In addition to proximity sensors, normal wireless sensor network may be present
for detecting approaching people, vehicles and other devices. More about this and using them for preserving
the data from the theatre can be read in Chapter 9 – ‘Sustaining the Data‘.
If the authorised user goes too far from the used device, such as a smartphone or PC, 27 it is possible to protect
them by locking or shutting them down or encrypting all their content. Such examples for providing additional
25 More information about Rubber Ducky can be found from http://hakshop.myshopify.com/products/usb-rubber-ducky-deluxe.
26 Liscouski and McGann describe in [25] how it has been possible to insert a bomb inside a laptop.
27 Some PC motherboards have a functionality to wake up and standby when user’s smartphone (or other Bluetooth device) is close or far
enough.
37