Digital Forensics in Small Devices: RFID Tag Investigation

The live acquisitions of all collected evidence data were performed due to the
volatilities of the potential evidence data. The outputs of the collected evidence data
were also saved into a sterilized USB flash drive, which was forensically wiped.
Hence, the forensic investigator placed the customized Helix_RFID_IR tool into the
victim‟s DVD drive to commence the artefact acquisition.
Figure 4.12: Helix_RFID_IR tool in action on the compromised machine
4.2.1 Live Memory (Random Access Memory) Acquisition of POS Host Station
For the purpose of the random access memory (RAM) evidence collection of the
target POS host station, winen.exe memory acquisition tool provided by Guidance
Software was used. The winen.exe was located in the customized Helix_RFID_IR
tool and run from the trusted command prompt, D:\IR\xp\cmd.exe (as shown in
Figure 4.13). Hence, the POS RAM was successfully collected and saved on the
evidence collection flash drive (E:\).
Figure 4.13: Live memory acquisition of RAM in action
89