Digital Forensics in Small Devices: RFID Tag Investigation

file, such as the transaction log file, could be lost when the server instance was
shut down or restarted (Fowler, 2009). Hence, the volatile SQL Server artefacts
were acquired and preserved by using different collection methods for different
purposes in order to help the investigation (see Table A1. 1 in Appendix 1).
Even though, most of the volatile server evidence was acquired by
running the automated WFT, which was stated in the previous section; hence,
the active virtual log files (VLFs) and ring buffer data were collected by ad hoc
artefacts collection method.
The acquisition of VLFs containing the crucial volatile information such
as Data Manipulation Language (DML) and Data Definition Language (DL)
statements were performed early in the stage of volatile artefacts acquisition.
However, the current state of physical database transaction log files was
determined by executing the following syntax through SQLCMD within the
RFID_test database before performing the active VLF data (Fowler, 2009).
:out E:\DBSE_LGNF.txt
DBCC loginfo
GO
According to the result output (Figure 4.21); the only physical database
transaction log was associated with RFID_test database (FileId = 2). The values
of StartOffset for active (Status = 2) and inactive (Status = 0) VLFs could later
be useful in order to carve inactive VLF data from the transaction log (Folwer,
2009).
Figure 4.21: Database Console Commands (DBCC) loginfo command results
95