Digital Forensics in Small Devices: RFID Tag Investigation

The record of shutting down the server service was recorded in the output file
(E:\ServiceShutDown.txt) within the acquisition device as “Server shut down
by request from login arkar”.
4.2.3.6 Residual Non-Volatile SQL Server Data
The residual non-volatile SQL Server data were also acquired during the
investigation. These included the acquisitions of physical data file, the reusable
virtual log files (VLFs) command language runtime (CLR) libraries, trace file,
the SQL Server error logs and system event logs by using dcfldd tool from the
forensic USB toolkit which was attached to the compromised system via a
hardware write blocker (Tableau Forensic USB Bridge).
4.2.3.6.1 Data Files
The deleted data from the data file of the SQL Server could be either partially
or completely retrieved as the traces of previously deleted data normally store
within multiple areas of a database (Fowler, 2009). To acquire the physical
database files, the exact locations of the database files were needed to find out
firstly. These database files locations could be found in the result of previously
executed SSFA_Databases.sql IR script (Figure 4.48).
Figure 4.48: Physical data file locations from the result of SSFA_Databases.sql
116
script
According to the above mentioned Figure 4.48, the physical locations of
FRID_test database and transaction log data files were determined. The