Digital Forensics in Small Devices: RFID Tag Investigation

all the collected digital evidence data
was in order to maintain and security of
the evidence. Finally, the hash values
before and after analysis were
compared and found exactly the same
(see Appendix 22). Hence, the
preservation of the digital evidence data
was done in a forensically sound
manner during the research experiment
as the hash values were not changed.
SUMMARY:
The acquisition and analysis methods of the potential evidence were performed
and documented in a forensically sound manner, as stated in Section 4.2 and
Section 4.3. MD5 hashing on the acquired data was done by using different
forensic tools and techniques. The acquired evidence is credible, reliable and
repeatable and acceptable to the court of law as the hash values of collected
evidence before and after analysis are precisely the same. Although there are
some limitations as stated in the above mentioned argument against, the
arguments made for and against prove the hypothesis 9 is to be accepted in this
research experiment.
Table 5.4: Secondary Research Question 4 and Tested Hypothesis
Secondary Question 4: What are the methods to analyze the acquired evidence?
Hypothesis 8: The significant evidence can be extracted by analyzing collected
data with EnCase forensic software, Windows Forensic Toolchest (WFT), and a
hardware write blocker (Tableau Forensic USB Bridge).
ARGUMENT FOR:
Forensic copy of the collected data was
performed by using a hardware write
blocker connected to the USP port of
the forensic work-station installed with
EnCase forensic software (see
Appendix 12). Hence, the integrity of
ARGUMENT AGAINST:
Physical evidence could also be found
at the POS given the Tag repository
(assuming the poison Tag had not yet
been rewritten).
Further investigation of the business
136