Digital Forensics in Small Devices: RFID Tag Investigation

syntax was used to acquire a server role membership list and the result output
could be seen in Figure 4.29.
:out E:\ServerRoleMembers.txt
Select * from Sys.Server_Role_Members
GO
Figure 4.29: Acquired evidence of server role membership information
4.2.3.4.3 Database-Level Authorization Data (DLAD)
Object & Statement Permissions: DLAD could be collected by viewing
SYS.DATABASE_PERMISSIONS and SYS.DATABASE_PRINCIPALS to verify
the access level of database user within a given database. By using the
following syntaxes, the list of permissions for each user and the list of database
users, roles, or groups within a given database could be collected (Fowler,
2009).
:out E\SystemDatabasePermissions.txt
SELECT * from sys.database_permissions
GO
:out E:\SystemDatabasePrincipals.txt
SELECT * from sys.database_principals
GO
After executing the above syntaxes, the acquired results of system database
permissions and database principals were saved in the designated evidence
collection drive (E:\).
The result of the backend SQL Server system database user permissions
(Figure 4.19) was similar to that of the result output in the Figure 4.30. Hence,
102