BATTLEFIELD DIGITAL FORENSICS

5. Remove the drive from the drive bay with care. Follow the safety notes: 41
Handle the SSD with care, keep it in the protective anti-static sleeve
Do not touch connectors on the SSD drive
To minimise static electricity, touch the desktop case before handling the SSD.
8.5 Equipment and Tools Required
The following equipment and tools are needed:
Portable battery chargers
Antistatic bags, antistatic bubble wrap, Faraday bags/boxes, cable ties, evidence bags, evidence tape,
packing materials (avoid materials that can produce static electricity), markers
Pliers, electric screwdrivers with various heads.
8.6 Document Phase
8.6.1 Photographing/Recording the Scene
Photographing or video recording 42 is the crucial part of the document phase. It should be the first step taken
by the SOF operator on arrival (together with the scan phase). This will also accurately depict the condition of
the scene prior to any evidence collection or disruption that will probably happen during processing [28].
Ideally, video recording goes from the overall scene down to the smallest pieces of the evidence. As mentioned
before in this chapter, do not forget to record the status of the monitor screen. 43 Photographs or video should
also be taken of the rear of information processing equipment, to accurately display how the cables are
connected. It is helpful even if the equipment is not to be seized: as it is present, it should be recorded.
As described in paragraph 10.3 – ‘Documentation of Evidence’, photographing and recording the scene are
important. Cameras providing a 360° picture could be helpful, not only for documenting the scene, but also for
scanning and identifying devices. If a convenient video streaming can be originated 44 from the tactical site
towards the tactical operations centre (TOC), forensics experts can remotely advice SOF operators. The video
streaming should also prevent any form of operators’ identification by using blurring techniques, as explained
in Chapter 10 – ‘Chain of Custody.
8.6.2 Packaging and Labelling
All evidence collected should be marked as exhibits so that they can be easily identified at a later date [39]. All
exhibits must be properly seized, labelled, transported, and handled for evidence recovery purposes. The
labelling or marking of the evidence begins the chain of custody of the items of evidence (see Chapter 10 –
‘Chain of Custody‘). The label should contain at least the following information [38]: description of the item,
date, location of collection, operator name or identifier, and brand name. The labels must be affixed to all
41 SanDisk [40] provides an installation guide with safety notes for handling SSD drives.
42 It should be completed prior to any evidence seizure but within the short timeframe of the SOF strike it can be done parallel [28].
43 If a screen saver is being used, press the down arrow key to redisplay the open file or the password-protected login screen.
44 Chapter 9 – ‘Sustaining the Data‘ covers techniques to create communication channels; yet convenient bandwidth for high quality video
streaming is a challenging requirement, so most likely only 360° images can be provided.
51