Link Analysis of Computers and Media with Reachback Signals

Procedures and equipment are needed to associate storage media with an individual disk drive and an individual computer. This capability was accomplished using modulation signals within the computer. Additionally, the capability was developed to forensically link a target computer (e.g., a laptop, desktop, or network server) to an attempted or actual penetration of a U.S. Government computer network. These techniques established the capability to classify and identify the individual characteristics of a computer or storage media to form a link between the questioned and known equipment. Requests for additional information should be sent to isfsubgroup@tswg.gov.