Digital Forensics in Small Devices: RFID Tag Investigation

the attack.
Hypothesis 4: There will be transaction traces in the POS/Server’s memory after
the attack.
Hypothesis 5: There will be transaction traces in the SQL Server transaction logs
after the attack.
Hypothesis 6: There will be transaction traces in the SQL Server error logs after
the attack.
Hypothesis 7: The malicious tag can be found at the crime scene.
ARGUMENT FOR:
As stated in the “argument for” in Table
5.1 above, the significant evidence was
found in each entity of RFID BS.
Hence the significant evidence was
found in the logs of RFID reader’s
memory, POS RAM, and transaction
logs of backend SQL Server.
In the simulation experiment, a fake tag
was also found and preserved as a proof
of the theft of SI.
ARGUMENT AGAINST:
The significant evidence in RFID
reader might not be found if the buffer
of the reader’s memory was full when
the malicious tag was scanned.
As a result of the firmware used, the
RFID reader (Tracient Padl-R UF
Reader) deployed in the experiment can
currently read not only the upper limit
of 15000 tags if the data (TagID)
logging is turned off, but also the lower
limit of 900 TagIDs and timestamps if
the data logging is turned on. However,
different tags have different tad ID
length and thus there is a small amount
of difference. Hence, when the reader’s
memory buffer is full due to the
maximum tags read; it will continue to
read and transmit data from the tag via
USB to the backend server. But, no
more data will be written to the reader’s
memory log.
133