BATTLEFIELD DIGITAL FORENSICS

More documents

Recommendations

Info

2. Open the desktop computer case. Use a cordless screwdriver to increase the speed of opening the case, if the case is closed with fixed screws. Be aware of locks that prevent opening the case: if these are present, additional tools providing capability to cut metal might be needed. Figure 16. Locating computer’s drive bay with the hard drive [36]. 3. Locate the computer’s drive bay with the hard drive, as shown in Figure 16. Check if there are any marks of hard drives and/or cables being removed many times, as they might be the result of a RAID-0 or other antiforensics setup. Figure 17. Removing the drive from the drive bay [36]. Figure 18. Removing the drive from the drive bay [36]. 49
4. Remove the drive from the drive bay, as shown in Figure 17 and Figure 18. Note that sometimes it is easier to first remove the whole drive bay from the case, and then take the drives out of the removed drive bay. Figure 19. Unplugging data cable and power cable [36]. 5. Unplug the data cable and remove the power cable from the hard drive. This is shown in Figure 19. Document drives which are missing some or all required cables, as they may be part of anti-forensics setup using for example RAID-0. b) Remove the SSD disk (step-by-step instructions). Note: This guide applies to most SSDs. A cordless electric screwdriver is usually needed to open the desktop (server) case and handle the drive if it is fixed. 1. Make sure the computer is powered off and the power cable is disconnected. 2. Open the desktop computer case. 3. Locate the computer’s drive bay with the SSD drive. Figure 20. Unplugging the SATA data cable and SATA power cable from the SSD 40 drive [37]. 4. Unplug the SATA data cable and SATA power cable from the SSD drive, as in Figure 20. 40 Original photo by Simon Wüllhorst https://www.flickr.com/photos/descilla/3377031204. 50
Page 1 and 2: Christian Braccini, Teemu Väisäne
Page 3 and 4: About the NATO CCD COE The NATO Coo
Page 5 and 6: Table of Contents About the NATO CC
Page 7 and 8: Figures Figure 1. The Targeting Cyc
Page 9 and 10: LED Linux LTE MANET materiel MEDEX
Page 11 and 12: properly discovered, preserved and
Page 13 and 14: From a targeting perspective, digit
Page 15 and 16: . Utilise the existing internet con
Page 17 and 18: Figure 3. A faulty laptop explosive
Page 19 and 20: 5 Onto the Battlefield Christian Br
Page 21 and 22: 6 Computer Forensics Agostino Panic
Page 23 and 24: In a wireless ad-hoc network, all t
Page 25 and 26: However, this solution is impossibl
Page 27 and 28: Connection Backup: The vector shoul
Page 29 and 30: The goal of this statistical approa
Page 31 and 32: 7 Anti-Forensics Measures Teemu Vä
Page 33 and 34: Recommendation: When designing and
Page 35 and 36: As presented by Azadegan, Liu, Sist
Page 37 and 38: Recommendation: Be aware that harml
Page 39 and 40: security for smartphones are descri
Page 41 and 42: If any marks of explosives are dete
Page 43 and 44: 8 Exfiltration Solutions Michal Sad
Page 45 and 46: Portable device found Laptop Type o
Page 47 and 48: As with other portable devices (suc
Page 49: Devices might be found in different
Page 53 and 54: items of the evidence, typically on
Page 55 and 56: 9.1 Surveillance Software Installat
Page 57 and 58: A communication channel to satellit
Page 59 and 60: Figure 21. ABSOLUTE System Architec
Page 61 and 62: 10 Chain of Custody Kris van der Me
Page 63 and 64: police or other official investigat
Page 65 and 66: [15] E. Imsand and J. A. Hamilton,
Page 67 and 68: [46] J. M. Kahn, R. H. Katz, and K.
Page 69: 13 Acknowledgements Authors of the

BATTLEFIELD DIGITAL FORENSICS

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?