Cyber Forensics: A Military Operations Perspective

This paper discusses some of the unique military requirements and challenges in Cyber Forensics. A definition of Cyber Forensics is presented in a military context. Capabilities needed to perform cyber forensic analysis in a networked environment are discussed, along with a list of current shortcomings in providing these capabilities and a technology needs list. Finally, it is shown how these technologies and capabilities are transferable to civilian law enforcement, critical infrastructure protection, and industry. Introduction In the common vernacular, cyber forensics has been best understood to be a discipline belonging to the Law Enforcement community. In fact, most academic research and commercial tool development in this field have focused on assisting the police investigator in a post facto evidence-gathering process to meet the perceived minimal evidentiary requirements. The investigative process and its requisite tools require the physical seizing and imaging of the suspect’s storage media and related hardware with emphasis placed on completeness and data integrity favored over timeliness of analysis in recovering and presenting the digital information, which routinely takes months to complete. Furthermore, many automated data recovery and analysis tools assume most crimes committed with computers are to enhance