BATTLEFIELD DIGITAL FORENSICS

9
Sustaining the Data
Hayretdin Bahşi
In the limited time-frame of an operation, SOF operators may not have the opportunity to collect all the
devices. One alternative way of obtaining information from the devices may be to install surveillance software
on the target devices and set up an information channel based on the existing internet connection or a network
which can be swiftly established in the theatre during the operation. This information channel may enable
collection of the data to begin during the operation. The collection phase may even continue after the
completion of the mission, depending on the survivability of the channel.
In this chapter, existing technology and research projects are investigated for the preliminary analysis of gaps
between current technology and the solutions required specifically for battlefield digital forensics. Using an
existing internet connection for data extraction is a widely known scenario which can be executed using
existing tools and technology. Thus, this chapter does not cover detailed discussion of data exfiltration via the
internet, but focuses on establishing an additional network infrastructure.
In cases where an internet connection is not available, SOF operators may apply two approaches for data
collection. The first approach is to establish a temporary wireless local area network (WLAN) in the site area
and place a data collection server in this network, which remains in the area only during the operation. The
data collector server acts as the computer that stores the obtained digital forensics data. A helicopter can be
included in the WLAN so that it can host the data collector, which eliminates the need for carrying an additional
device. In this approach, all the network components are removed from the site after the completion of the
mission, which means that collection of the forensics data is only enabled during the operation time. However,
the local area network may provide a high data transfer rate.
The second approach is to establish a connection to a satellite or a drone (UAV) from the theatre, which will
still remain after the operation. In this approach, the forensics data is transferred with lower data transfer
rates, but the connection continues until the related network devices run out of battery or the enemy destroys
the connection infrastructure. If the position of the UAV enables it to be part of a WLAN, higher data transfer
rates may be possible. The data collector can be located in a secured site, which can be accessible over satellite
or UAV; it may even be integral to the UAV itself. The main drawback of this approach is that it requires leaving
network devices in the theatre after the operation, which may cause higher operation costs or create room for
the enemy to carry out forensics analysis on the devices and conduct cyber-attacks against the data collector.
Regardless of the alternative chosen, the relevant network infrastructure should be designed according to the
inherent limits of operations. The first requirement is that the devices of this network should be easily
deployable and require only a small amount of configuration during the setup. This configuration should be
possible for non-technical people to do in a short time. Secondly, all the installation equipment and network
devices should be portable and should not exceed the carriage limits. Thirdly, network devices with lower
energy consumption and higher bandwidth capacities are preferable in order to increase the amount of
forensics data that can be obtained from the site. Lastly, environmental and structural factors such as the
existence of walls and signal blocking materials, and the weather situation, should be carefully considered
during the network establishment phase.
The analysis given in this chapter focuses on establishing wireless networks due to their easy deployment.
Therefore, digital devices which already have wireless interfaces can be chosen as targets for the data
extraction. The SOF operators may also insert wireless USB adapters to the relevant targets that have no
wireless interfaces.
53