GCN LAB IMPRESSIONS

How Navy SEALs extract data in the field

The lab looks at some of the tech used to quickly, and stealthily, collect data

This article has been updated from its original version to clear up a refernce to the type of technology the SEALs likely used.

The raid on Osama Bin Laden’s compound had a primary goal: to capture or kill the terrorist responsible for the attacks of Sep. 11, 2001. But there were other goals that in the long run might prove even more important. The Navy SEALs who conducted the raid were looking for information and records that could shed light on ongoing plots of other attacks.

And they scored big in that department, by all reports, scooping up five computers, 10 hard drives, 100 portable storage devices and reams of printed paper. 

It seems they carried most of the electronic equipment out with them. However, they didn’t need to grab everything because of a technology called battlefield exploitation.

Battlefield exploitation gives soldiers or police the ability to clone or take data without actually having to remove a device from its location. In most cases physical contact is needed, but only briefly.

There are several reasons why taking a computer back to your base of operations might not be feasible. You know that popular TV commercial now where the family comes home and everything in their house (even, somehow, their furniture) is missing, yet they are surprised that “they didn’t take the computer?” A bunch of computers might simply be too much to carry, especially if you have limited time and a room full of desktop PCs or servers to search.

The other main reason, although this was not the case in the bin Laden raid, is that investigators may not want a suspect knowing that their data has been compromised. The suspect could still be under surveillance, and law enforcement officers may want them to continue their normal activities while their data is examined.

What are these battlefield exploitation devices, and how do they work?

Although I don't know specifically what the SEALs were packing, we've seen this type of technology demonstrated in the lab, and tested and reviewed a few of the products over the years. An early model of one such unit, called the Image MASSter Solo 2 Forensic Kit could perfectly copy an entire hard drive from a desktop system without even cracking the case open.

An investigator simply needs access to a parallel port. And this gets around even a BIOS or biometric password, because the copying process occurs in a pre-boot state. You get in, copy the data, and get back out unobserved.

Many crooks or terrorists might feel their data is safe because of front-end passwords, but those are easily bypassed. If a drive is encrypted, you will still need to deal with that, but the data is yours to poke and prod at your leisure.

For cell phones and more portable devices, there are tools such as the ManTech Crowbar, which can crack the password on an SD chip in just a few minutes.

Using a combination of dictionary attacks and rainbow tables (large data pools containing every possible permutation of a cryptographic key), it will grant access to data stored on the chip as if the actual owner had entered his password.

As a bonus, the Crowbar allows different languages to be loaded into memory for the dictionary attack phase. In the case of the Bin Laden raid, my guess would be that similar devices came packing Arabic. Something small like a phone could simply be confiscated, but even so, a device like the Crowbar could be used later to crack the password and get into the data.

Most of the cutting-edge devices in this field that the lab has seen have been similar in function, with faster processors and more input options such as USB or Firewire. Some have been ruggedized for work in harsh conditions, such as rappelling out of choppers.

So even though there is likely a lot of work to do in sifting though all the data from the recent raid, rest assured that the technology exists to ensure that no byte was left behind.

 

Reader Comments

Mon, May 23, 2011 BillRM Maimi, FL

Agree the time element alone would defeat such tools and then if they had ATA locks and Bio locks that would slow you down also. Ripping the hard drives out of the desktops seem far faster then copying them. I find it strange terrorists seem not to had taken precautions up to the truecrypt level.

Mon, May 16, 2011 Steve Porter

There is no way anyone in the field on a time critical mission like the one described in this article is going to use the tool described above. Cloning a typical 120GB drive can take about 30 minutes under optimum conditions. Cloning through the parallel port would be about 20 times slower! In today's world of 3TB hard drives cloning is going to go by the wayside not only because of the speed but also storage space.

Fri, May 13, 2011 Weston Virginia

Question, do these tools only get sold to law enforcement and the SEALs? Because I would like to get one to see what is on my teenange daughter's laptop.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above