Digital Forensics in Small Devices: RFID Tag Investigation

e re-written for other items within 7 days. Thus, by scanning the tags in the
repository; the investigator could find the physical evidence of the fake tag (injected
with SQL poisoning code) used by the thief/perpetrator.
4.3.6 Analysis of CCTV Images and Interviews with the Employees
According to the timestamps acquired from analyzing the collected data above, the
investigator could further perform the forensic investigation of the incident by
analyzing the recorded images of the CCTV (Closed Circuit Television) monitoring
system in the retail shop. Likewise, the forensic investigator could interview the
employees who were on duty on the day of the incident occurred in the shop to get
more information leading to the investigation and reconstruction of the activity in real
time.
However, the analysis of CCTV images and interviewing the employees were not
in the research scope as previously stated in the limitation section of Chapter 3
(Section 3.4).
4.4 CONCLUSION
This Chapter 4 has reported the findings from the laboratory testing of a business
system that was designed to simulate the use of RFID tags in a retail shop. The results
show that the extraction of all evidence left after a security breach is complex, time
consuming and requires the use of an extended set of Digital Forensic tools.
Nevertheless, the research reports the precise expectations an investigator may
have for undertaking such an investigation. The next Chapter (5) will now discuss
these findings in relation to the research question, sub questions and hypotheses.
127