Digital Forensics in Small Devices: RFID Tag Investigation

4.2.3.2 Ad Hoc Artefact Collection by using Trusted SQLCMD
In order to perform interactive ad hoc artefact collection, the trusted SQLCMD
binary for SQL Server 2005 from HELIX_RFID_IR tool was used. However,
the connection establishment to victim‟s SQL server was firstly done by using
the following syntax.
Figure 4.20: Connection to the Victim’s Server for ad hoc data acquisition
Then, all the actions performed on the victim‟s system by using SQLCMD
binary was directed to the output file by using the following command.
:out E:\InitialConnection.txt
However, the results of executed Database Console Commands (DBCC) were
required to redirect to the above mentioned output file from the SQL Server log
(Fowler, 2009). The following syntax, in which the trace flag 3604 was
enabled, was used to direct DBCC results.
DBCC TRACEON(3604)
GO
After enabling the connection session, the session would remain effective even
the investigator switch database contexts during the investigation (Fowler,
2009).
4.2.3.3 Volatile SQL Server Evidence
(Fowler, 2009, p. 182)
The potential evidence could be presented in the volatile SQL Server artefacts.
The important part of the investigation was to acquire the volatile SQL Server
data as early as possible due to the volatile data from the on-disk server data
94