Det tysta vittnet: En loggbok ingen ser : Ett offline Intrusion Logging System (ILS) för forensisk loggning av trådlös aktivitet

Sammanfattning

Wireless communication technologies such as Wi-Fi (IEEE 802.11) and Bluetooth Low Energy (BLE) continuously transmit metadata that can passively be observed. The purpose of the study was to investigate whether an offline and passive system called Intrusion Logging System (ILS) can be designed to collect, store and protect metadata in accordance with forensic and legal requirements for data integrity and proportionality. The study was conducted as an experimental method where a prototype was created. The prototype was implemented using a Raspberry Pi 5 as a base, an external Wi-Fi antenna, a case with a fan and an M.2 NVMe SSD card. Then two Python scripts were created that utilize the program Kismet to retrieve log data and listen to devices when being completely offline in monitoring mode as well as encrypt and create a smooth transfer of the collected data. The data collection was divided into three tests followed by a final test phase. They were carried out in an isolated environment. The results show that the prototype was able to passively collect metadata such as MAC-addresses, device type, signal strength, channel and timestamp from both Wi-Fi and BLE devices. MAC-address randomization limited the identification of individual devices, while some devices during active Bluetooth search mode exposed the real MAC-address of the device. Through block encryption (AES-256-GCM) at data generation, whitelisted USB-sticks, SHA-256 hashing and automatic 30-day deletion, the Chain of Custody was maintained from data generation to data transfer. The conclusion is that an ILS can serve as an evidence complement in IT-forensic investigations by providing an independent and privacy protected timeline of wireless activity.