Digital Forensics in Small Devices: RFID Tag Investigation

4.2.3 SQL 2005 Server Data
The SQL Server data related to the scope of investigation were collected in a
forensically sound manner. The artefacts collection methods involved using the
customized Windows Forensic Toolchest (WFT) from Helix_RFID_IR, the
executions of ad hoc SQL commands, and the like. Hence, the trusted SQLCMD
from Helix_RFID_IR was also used for connection to the victim server to collect the
SQL Server related data. For example, the connection to the SQL Server instance was
completed by using the following syntax (Figure 4.16).
Figure 4.16: Connection to the SQL Server instance
Once the connection was established, the output returned a list of active sessions
which were stored within the file named E:\sessions.txt. Then, the md5deep utility
was used to create MD5 hash value of the file.
The hashing techniques used in the acquisitions of all SQL Server artefacts
during the forensic investigation were summarized the tables of Appendix 1. As a
result of the acquired artefacts have their own MD5 hash values, these hash values
can later be used for integrity checking of the collected artefacts in the analysis
section. Hence, the preservation of the artefacts is maintained during the forensic
investigation.
Furthermore, as stated in the data processing (Section 3.3.5), the acquired data
presented in this section were formatted in the customized style in which some of the
irrelevant columns and rows from the acquired artefacts are excluded due to the
limitations of the page layout.
91