Digital Forensics in Small Devices: RFID Tag Investigation

components of database were enabled or disabled. Hence, the following syntax
(Figure 4.45) was used for the acquisition of SAC information, the security
hardening status of the SQL Server 2005.
Figure 4.45: Syntax used for the acquisition of SAC information
The output result of acquired data was as shown in the Figure 4.46 below and
the result should be checked against the default status of SAC objects
documented by Microsoft (http://msdn.microsoft.com/en-
us/library/ms183753.aspx) to identify whether the malicious hacker or
unauthorized user had used such settings to compromise the SQL Server.
Figure 4.46: Surface Area Configuration results by running
sys.system_components_surface_area_configuration
4.2.3.5 Record of SQLCMD Disconnection and SQL Server Service
Shutdown
Once the acquisition of all volatile and non-volatile data from the running SQL
Server, the residual artefacts could be collected while the SQL Server instance
was shut down. However, it was significant to note that the all volatile data
should be acquired before stopping the SQL Server instance. Similarly, the
114