Events display
Mobile Badger is designed to run in full headless mode (without monitor, and without auto-logging on local console).
However, there is a way to control its activities - it supports some LED/LCD displays:
- Adafruit PiTFT 2.2/2.8 inch LCD (for Raspberry Pi devices)
- Bakebit NanoHat OLED (for NanoPi-NEO2 devices)
- Pimoroni Blinkt! (for Raspberry Pi devices)
- Pimoroni Scroll HAT Mini (for Raspberry Pi devices)
- Waveshare 1.44inch LCD HAT (for Raspberry Pi devices)
- Waveshare RGB LED HAT (for Raspberry Pi devices)
Here you will find a repository containing the current list of drivers, along with their documentation.
Support for at least 2 more display devices is planned. Stay tuned for updates.
Data exfiltration takes time, especially when run on relatively slow device, instead on a normal computer. Therefore it is crucial to know, what is actually happening with this device:
- was the attached target drive properly recognized?
- was the user drive properly recognized and decrypted?
- is the exfiltration still running, or already finished?
- any other important events?
The easiest way to handle this, especially in the field use, is to use simple LED interface, that will show such event using multiple LED colors, eg.:
There are a few types of events:
- global events (ready, shutdown etc.)
- events regarding target drives (partition UUID registered in
/etc/drivebadger/drives/target.listfile) - events regarding MTP/PTP devices
- events linked to partition numbers
Global events, and events related to target drives