Digital Forensics in Small Devices: RFID Tag Investigation

evidence data during analysis. Likewise, the use of write blockers during analysis
could prevent changes to the original acquired data. Thus, the Tableau forensic
hardware write blocker was used to connect to the forensic workstation via USB
connection during analysis in order to maintain the preservation of the collected data.
Figure 4.55: Tableau forensic USB bridge
(http://www.tableau.com/images/products/t8_r2_front_hi_res.jpg)
The data analysis was performed by using two different forensic test-stations in the
laboratory. One of the forensic test-stations was installed with EnCase for imaging
the collected data, and analysis of RFID Reader‟s memory, POS station‟s memory,
and the physical drive image. The second forensic test-station was installed with a
SQL Server 2005 and used to analyze the collected SQL artefacts.
4.3.1 Analysis of RFID Reader’s Memory
After acquiring the bit-to-bit image of the logs from RFID reader‟s memory (Section
4.2.2), its image copy on the forensic test-station was analyzed by using EnCase
Forensic Training software. As stated in Section 3.3.2, the fake tag (ID:
E0040000E90A4302) was used as a keyword to look for the malicious transaction in
the image copy when analyzing. Hence, the notable evidence of the malicious
transaction was found along with the tag ID, date and timestamp (as shown in the
Figure 4.56).
123