BATTLEFIELD DIGITAL FORENSICS

e observed. However, solutions for preventing the enemy from pulling out an USB flash drive from the
computer might be limited.
7.6.3 USB Killer
A ‘USB Killer’ is a USB device for ‘frying’ a computer it is plugged into. As described by Adarsh Verma in [26],
version 2.0 of the USB Killer dumps 220 volts directly onto the USB signal wires. Such a voltage can destroy the
motherboard of the computer. By hiding these kinds of devices or leaving them behind, the enemy could
destroy computers used for investigation, or at least make the forensics process slower. An example soldering
of a USB Killer by hand is presented in Figure 13. If one of these is inserted into a regular USB flash drive case,
obfuscation detection without opening the case is basically impossible.
Figure 13. a) Hand-soldered example of USB Killer and b) the same device obfuscated to look like a regular
USB flash drive. 31
Recommendation: After the collection, open USB flash drives and other USB devices to discover if they
include any strange soldering, circuit boards or parts (after the strike).
Recommendation: After the collection, do not connect USB devices into expensive forensic analysis
devices, but first try them with testing computers which do not contain anything crucial (after the strike).
7.7 Summary of Anti-Forensics Techniques
In the scan phase, it is important to scan the number of networks to make an estimate of the devices present.
This should be compared later to the number of identified devices. However, it is possible to create a large
number of fake wireless networks, so normal scanning tools may not provide good enough information. This
means that the SOF(DFA) should have a tool (in a handheld device) for automatically scanning and analysing
the wireless traffic, and not only for discovering Wi-Fi or Bluetooth APs or devices. To decrease the number of
(fake) wireless networks, it would be possible to use handheld short-range wireless jammers.
In the identify phase, the SOF(DFA) should discover and identify possible booby-traps, kill-switches, and hidden
and obfuscated devices before starting the identification process presented in Chapter 8 – ‘Exfiltration
Solutions‘.
Flowchart 2 presents the SIDSS triage mitigation in case of anti-forensics measures detected: even though
some arrows in the flowchart go through the document phase, this does not mean that related evidence would
not be documented. In the document phase, all identified devices and anti-forensics techniques should be
documented, provided there is enough time.
In the secure phase, the normal procedures presented in Chapter 8 – ‘Exfiltration Solutions‘ should be followed.
For example, if the device is turned on and stored in a Faraday bag, a battery must be provided. Exceptions
may arise if booby-traps or kill-switches have already been discovered in the identify phase.
31 Figures from http://kukuruku.co/hub/diy/usb-killer.
39