BATTLEFIELD DIGITAL FORENSICS

Scan networks.
Calculate amount of networks.
Scan how much traffic networks have (custom tools needed).
Detect suspicious networks.
NO
Networks visible?
YES
NO
SCAN
Fake or suspicious
networks present?
NO
YES
Jam wireless networks
Detect fake wired networks
Identify standalone device.
See and proceed with flowcharts of Section 6.3.
In addition: Identify hidden and obfuscated devices,
booby-traps and kill-switches (and their type) from
standalone devices.
Identify connections.
See and proceed with flowcharts of Section 6.3.
In addition: Identify wireless networks and
devices used for booby-traps and kill-switches,
and wired booby-traps and kill-switches.
Booby-traps or killswitches
identified?
NO
NO
Booby-traps or killswitches
identified?
IDENTIFY
YES. Wireless booby-traps
or kill-switches identified
YES. Wired booby-traps
or kill-switches identified
Identify the device type.
See and proceed with ‘Exfiltration process’ flowchart of Section 6.3.
In addition: Identify suspicious, obfuscated and hidden devices.
YES. Wired booby-traps or
kill-switches identified
YES. Wireless booby-traps or
kill-switches identified.
Document all discovered anti-forensics techniques, and suspicous connections and devices. See
Sections 6.3 and 6.5.
DOCUMENT
Do not remove wired kill-switches or devices.
Capture the setup as is, if possible.
See and proceed with ‘Device collection process’ flowcharts of Appendix C.
SECURE
Secure wireless devices into faraday bags.
Use same bags for devices connected to each other wirelessly.
See and proceed with ‘Device collection process’ flowcharts of Section 6.3.
Use techniques described in Section 6.4, especially for servers.
SUSTAIN
Be aware of AF-techniques able to destroy forensics analysis
equipment or make forensics otherwise more difficult
AFTER THE STRIKE
Flowchart 2. Anti-forensics mapped to SIDSS.
41