Navy SEALS carried tools to extract data during raid

The raid on Osama bin Laden’s compound had a primary goal: to capture or kill the terrorist responsible for the attacks of Sept. 11, 2001. But there were other goals that in the long run might prove even more important. The Navy SEALs who conducted the raid were looking for information and records that could shed light on ongoing plots of other attacks.

And they scored big in that department, by all reports, scooping up five computers, 10 hard drives, 100 portable storage devices and reams of printed paper. 

It seems they carried most of the electronic equipment out with them. However, they didn’t need to grab everything because of a technology called battlefield exploitation.

Battlefield exploitation gives soldiers or police the ability to clone or take data without actually having to remove a device from its location. In most cases physical contact is needed, but only briefly.

There are several reasons why taking a computer back to your base of operations might not be feasible. You know that popular TV commercial now where the family comes home and everything in their house (even, somehow, their furniture) is missing, yet they are surprised that “they didn’t take the computer?” A bunch of computers might simply be too much to carry, especially if you have limited time and a room full of desktop PCs or servers to search.

The other main reason, although this was not the case in the bin Laden raid, is that investigators may not want a suspect knowing that their data has been compromised. The suspect could still be under surveillance, and law enforcement officers may want them to continue their normal activities while their data is examined.

What are these battlefield exploitation devices, and how do they work?

The lab has reviewed a few of them over the years. An early model of one such unit, called the Image MASSter Solo 2 Forensic Kit could perfectly copy an entire hard drive from a desktop system without even cracking the case open.

An investigator simply needs access to a parallel port. And this gets around even a BIOS or biometric password, because the copying process occurs in a pre-boot state. You get in, copy the data, and get back out unobserved.

Many crooks or terrorists might feel their data is safe because of front-end passwords, but those are easily bypassed. If a drive is encrypted, you will still need to deal with that, but the data is yours to poke and prod at your leisure.

For cell phones and more portable devices, there are tools such as the ManTech Crowbar, which can crack the password on an SD chip in just a few minutes.

Using a combination of dictionary attacks and rainbow tables (large data pools containing every possible permutation of a cryptographic key), it will grant access to data stored on the chip as if the actual owner had entered his password.

As a bonus, the Crowbar allows different languages to be loaded into memory for the dictionary attack phase. In the case of the bin Laden raid, my guess would be that similar devices came packing Arabic. Something small like a phone could simply be confiscated, but even so, a device like the Crowbar could be used later to crack the password and get into the data.

Most of the cutting-edge devices in this field that the lab has seen have been similar in function, with faster processors and more input options such as USB or Firewire. Some have been ruggedized for work in harsh conditions, such as rappelling out of choppers.

So even though there is likely a lot of work to do in sifting though all the data from the recent raid, rest assured that the technology exists to ensure that no byte was left behind.