Digital Battlefield Forensics Eric S. Imsand John A. Hamilton, Jr. Department of Computer Science & Software Engineering

Introduction To most people, “information warfare” equals cyber-space, plasma screens, and high-tech command centers. This vision does not mirror reality.

Introduction In reality, digital devices are prevalent on modern battlefields Soldiers on both sides may be carrying any/all of the following: Cell phone PDA “Smart” phone Computer Etc.

Introduction Digital devices recovered on the battlefield could store highly valuable information Challenge: How do we train our combat forces to seize digital evidence without damaging it?

Summary of Auburn Solution Auburn has embarked on a two-prong solution to this challenge Training “wounded warriors” that are being discharged to function as digital forensic investigators Developing training for current soldiers to seize digital evidence on the battlefield in a forensically sound manner

“Wounded Warrior” Training Partnership with Mississippi State University and Tuskegee University Funding from the National Science Foundation

“Wounded Warrior” Training Overview: Modern medicine has made previously-fatal injuries survivable Result: Many more injured service members than in prior conflicts Many of these service-members are no longer able to serve in the armed forces and have to find new careers

“Wounded Warrior” Training Overview (cont): At the same time, severe shortage of digital forensic investigators across the country Goal: Train injured service members in digital forensics Allow these soldiers to continue to serve their country Fill a vital need faced by our nation

“Wounded Warrior” Training Class format: 40 total hours of instruction Two class formats: One week, 8 hours / day Two weeks, 4 hours / day Chosen class format depends on the needs of the base Some bases cannot support the one week format. Other installations prefer the one week format.

“Wounded Warrior” Training Class format (cont.): Auburn provides all of the necessary course equipment and software Ship a “portable lab” to the site Free of charge to the students, the base, and the service (i.e. Army, Navy, etc.)

“Wounded Warrior” Training Basic Curriculum: Basic Computer Usage For warriors who are not well versed on using a computer Overview of Computer Hardware Hard disks, CPUs, Motherboards, etc. Writing a Business Plan / Small Business Advertising How to advertise your services in the private sector; how to form an investigative firm (if desired) Introduction to Cybercrime What types of crime are being committed?

“Wounded Warrior” Training Basic Curriculum (cont.) Introduction to Forensic Tools Overview of Digital Forensic Search and Seizure Procedures How to properly seize digital evidence so that admissibility is preserved Introduction to Imaging & Hashing Overview of Digital Storage Magnetic vs. optical vs. flash storage

“Wounded Warrior” Training Basic Curriculum (cont.) Introduction to Digital Evidence When is evidence recoverable? When is it gone? Introduction to File Systems Overview of file system concepts

“Wounded Warrior” Training Results Thus far, Auburn has offered 8 classes at bases around the country.

“Wounded Warrior” Training Results Preliminary Findings: These courses have increased… The number of soldiers considering a career in digital forensics Technical skill and proficiency (self-reported by students) Awareness of digital information and its “permanence”

“Wounded Warrior” Training: What Next? Currently exploring ways to get the course to a larger number of students Ex: Online training?

Battlefield Forensics What is “Battlefield Forensics”? Our term for the use of forensicly sound recovery techniques on digital devices seized on the battlefield. i.e. seizing captured devices

Battlefield Forensics Why “Battlefield Forensics”? Increasing number of digital devices found on battlefield Anti-forensic technologies becoming more widespread, easier to use, and more effective Result: The initial window immediately after seizure may represent best case for recovering useable information

Battlefield Forensics and Anti-forensic Technologies In the future, it is likely that devices seized from terrorists or combatants will… … be “booby-trapped” such that improper handling may destroy the desired information. … be encrypted, making future recovery of information unlikely … be damaged by over-eager field commanders searching for intelligence they can leverage in the field. The answer to all of these problems is to increase awareness of the proper handling of digital evidence

Battlefield Forensics: Proposed Curriculum Auburn is developing course materials targeted for ground forces to solve this problem Course format is a small, two-three day course (8 hours of instruction per day). Course is targeted at laypeople. The following is a listing of the topics that are currently included in the curriculum

Battlefield Forensics: Proposed Curriculum Proposed topics: Computer organization (i.e. parts of a computer) System analysis (i.e. identifying OS, encryption software, etc.) Persistence of data Introduction to Cryptography Anti-forensic technologies System cracking

Battlefield Forensics: Ethical and Practical Concerns Many of the techniques in this curriculum can be considered offensive (i.e. “hacker” techniques) Our goal is not to train soldiers to “hack” Trainees must be selected judiciously. Not every soldier/sailor/airman/marine needs this training Ultimately this training is no different than other skills taught to service members: when abused they can cause harm Still, we will not teach “Internet” based attacks 

Summary Traditional combat is being impacted by digital devices These digital devices carry potentially valuable information Auburn University is helping to address this need through a two-prong approach: Training injured veterans in digital forensics Designing courses for current soldiers to help them seize digital information securely

Acknowledgements This work is supported by the National Science Foundation, grant number # NSF-OCI-0753305. Our Lab Manager, Mr. James R. Thompson has played a major role in this program. Mr. Thompson is an NSF Scholarship for Service scholar and will join the US Civil Service upon completion of his graduate studies at Auburn University.

Questions?