Digital Forensics in Small Devices: RFID Tag Investigation

However, according to Fowler (2009, p. 204), the Histogram encloses “a
snapshot of actual data values that were taken at the time of the last statistics
update”, and it was the significant data to acquire during a forensic
investigation. Histogram information of the compromised database
(RFID_test.mdf) was explicitly retrieved by using the following commands for
all the columns and tables of interest.
Once the preceding syntaxes were run, the Histogram information results
(Figure 4.34, 4.35 and 4.36) against the specific columns of interest were sent
to the designated output files of the evidence collection device.
Figure 4.34: Acquired statistics histogram information against Tag column of
RFID_test.mdf
106