Digital Forensics in Small Devices: RFID Tag Investigation

The acquisition result of ring buffer security error was as shown in the figure
below.
Figure 4.24: Ring Buffer security error results from sys.dm_os_ring_buffers
After acquiring all the volatile SQL Server evidence, the forensic investigator
must perform the acquisition of non-volatile server evidence.
4.2.3.4 Non-volatile SQL Server Evidence
As stated in Section 3.1.3, the traditional digital forensic investigation approach
of acquiring the evidence is firstly to collect the volatile data while the system
is running and then unplug or disconnect the power cable to collect non-volatile
data. However, Fowler (2009) mentions that the traditional investigation
approach cannot be applied to the acquisition of non-volatile SQL Server
artefact as the artefacts such as server logins, database users and the like cannot
be collected when the Server is down. Hence, the non-volatile SQL Server
artefacts were also acquired and preserved by using different collection
methods for different purposes in order to help the investigation (see Table A1.
2 in Appendix 1). For instance, the different non-volatile server collection
methods included using the extended WFT tool, which was integrated in
Helix_RFID_IR toolkit (see Appendix 2), and ad hoc acquisition method. The
findings of these artefacts are presented in the following.
4.2.3.4.1 Authentication Settings of the Backend Database Server
Brainard et al., (2006) has mentioned that the user authentication in a
computing system can be accomplished through three factors such as what you
do know (e.g., a password), what you do have (e.g., an ID badge) and who you
really are (e.g., a fingerprint). Hence, the SQL Server authentication is a
process in which the server verifies and manages login requests and the
authentication mode (e.g., Windows, or SQL Server and Windows
98