Digital Forensics in Small Devices: RFID Tag Investigation

Figure 4.3: Error encountered during Tripwire baseline integrity checking software ..... 84
Figure 4.4: Only 62 Bytes of on-tag data can be read by the scanner ............................. 85
Figure 4.5: Error during wiping the USB flash drive ...................................................... 86
Figure 4.6: Error during wiping the USB flash drive ...................................................... 86
Figure 4.7: Connection to the backend server for data collection ................................... 86
Figure 4.8: Problem running WFT from
xv
Helix_RFID_IR toolkit during pilot test ........................................................ 87
Figure 4.9: Pilot data acquisition was unsuccessful due to unmatched hash value in
Wftsql.cfg file ................................................................................................ 87
Figure 4.10: Error when running WFT batch file ............................................................ 87
Figure 4.11: The version of the FTK Imager ................................................................... 88
Figure 4.12: Helix_RFID_IR tool in action on the compromised machine ..................... 89
Figure 4.13: Live memory acquisition of RAM in action ................................................ 89
Figure 4.14: Hashing reader’s memory log by using md5deep ....................................... 90
Figure 4.15: Memory log from RFID reader was saved on the collection drive ............. 90
Figure 4.16: Connection to the SQL Server instance ....................................................... 91
Figure 4.17: Running the SQL Server IR scripts from the Extended WFT ..................... 92
Figure 4.18: SQL Server Version of the Victim’s System from the Result of
SSFA_DbSrvInfo.sql .................................................................................. 93
Figure 4.19: Acquired Evidence of Victim’s Server Configurations ............................... 93
Figure 4.20: Connection to the Victim’s Server for ad hoc data acquisition ................... 94
Figure 4.21: Database Console Commands (DBCC) loginfo command results .............. 95
Figure 4.22: Fragment of active VLF data from transaction log ..................................... 96
Figure 4.23: Fragment of Ring Buffer data results from sys.dm_os_ring_buffers .......... 97
Figure 4.24: Ring Buffer security error results from sys.dm_os_ring_buffers ................ 98
Figure 4.25: Authentication mode used by the backend database server ........................ 99
Figure 4.26: Locations of the authorization data ............................................................. 99
Figure 4.27: Acquired evidence of server level authorization data by using
sys.server_permissions ............................................................................... 100
Figure 4.28: Acquired evidence of server principals information by using
sys.server_principals ................................................................................. 101
Figure 4.29: Acquired evidence of server role membership information ...................... 102
Figure 4.30: Fragment of acquired backend server database user permissions ............. 103