Digital Forensics in Small Devices: RFID Tag Investigation

4.1.2 Data Generation or Attack Case Scenario
There were a few errors that were fixed during the data generation in the pilot tests of
the research experiment. For instance; reading the RFID tag injected with the
malicious code by using RFID scanner was unsuccessful in a pilot test as only 62
Bytes of the tag data (see Figure 4.4) could be collected by the customized RFID
middleware. Hence, the size of inserted malicious code was adjusted to 56 bytes as
stated in Section 3.3.2.
Figure 4.4: Only 62 Bytes of on-tag data can be read by the scanner
4.1.3 Investigation Case Scenario
The investigation scenario was the same, as stated in Section 3.3.3.
4.1.4 Data Collection
A few changes were made during the data collection stage. For instance, the incorrect
syntax error was returned when the investigator recorded the details information
regarding connection session to the backend database SQL Server instance before
shutting down the Server instance. The correct syntax for recording the connection
session details on the compromised system can be seen in the Section 4.2.3.5.
Furthermore, a few problems were encountered during the preparation stages
before collecting evidence data such as forensically wiping the USB flash drive for
the storage of collected data by EnCase (Figure 4.5), initial connection to the backend
85