BATTLEFIELD DIGITAL FORENSICS

If the system is off, do not turn it on! If possible, remove the battery from the device and prepare it for
transportation (package the device using a bag).
Figure 14. How to remove battery from a laptop (example). 33
If the system is on, do not type or click the mouse. If the screen is blank or a screen saver is present, a short
movement of the mouse or touchpad should restore the screen or reveal that the screen saver is password
protected. If the screen restores, photograph or video record it. If the operating system is not locked or a user
is logged in, try to execute volatile data acquisition. The volatile data or memory dump collection process has
to be automatised as much as possible, to avoid any reaction delay in the operation. If the OS is not locked or
the user is logged in, and it is possible to see from the screen that destructive processes 34 are running, the
power cord or battery should be removed from the back of the computer and connected devices. This is an
exception to the procedure for powered on systems. More information about destructive processes can be
found in Chapter 7 – ‘Anti-Forensics Measures‘. If the system is on but the screen is locked, check the presence
of a FireWire port on the device (see Figure 15). With the right equipment, 35 it is possible to acquire the
content of the RAM by using Direct Memory Access (DMA). 36 Finally, support a charging of the laptop and
prepare it for transportation.
Figure 15. a) Firewire port on the laptop (port in the middle) [29] and b) two Firewire ports [30].
33 Figure from http://www.computerhowtoguide.com/2011/09/how-to-take-care-of-your-laptop-battery.html
34 Destructive processes can be any functions intended for example to wipe evidence from storage media. Terms like ‘format’, ‘delete’,
‘remove’, and ‘wipe’ can be indicators of destructive processes [31]. However, these may be in a foreign language.
35 One example tool is CaptureGUARD Gateway, provided by Windows Scope [32], which allows access to locked Windows computers.
36 FireWire interface is an example high-speed expansion port providing an option for a DMA attack [33]. An example open source library
for performing memory forensics over that interface can be found from GitHub [34].
45