Digital Forensics in Small Devices: RFID Tag Investigation

the collected data was maintained by
forensically analysing on the forensic
image copy of the collected data.
Analyses of bit-to-bit image copy of the
logs from RFID reader’s memory and
POS RAM were done by using EnCase.
The significant finding results included
fake tag ID, timestamp, and malicious
code (see Sections 4.3.1 and 4.3.2).
The image copy of collected SQL data
was analyzed by using text viewer,
notepad++ text and source code editor,
Microsoft Excel to which the SQL
Server data collected by WFT tool was
exported, and the like (Section 4.3.3,
Appendices 23 and 24). The notable
findings included fake tag ID, the
current values of stock items,
timestamp and malicious SQL
poisoning code in order to prove the
theft of SI in a RFID based retail shop.
SUMMARY:
system by interviewing the human
participants and reviewing CCTV.
In the real world business context, the
evidence extracted from the server logs
and the POS and scanner/reader logs
could be utilised to speed the search of
CCTV frames.
The dates and time that are located in
the logs can be matched against frames
of visual surveillance and witness
statements.
Further research needs to be conducted
in a real world business context, as the
evidence from CCVT and interviewing
human participants can lead to identify
and prosecute the malicious attacker or
SI thief.
For further research, the potential evidence such as frames of visual surveillance
and human participants could be analysed to prosecute the malicious attacker.
However the significant evidence to prove the theft of SI were able to be
extracted by analyzing collected data with EnCase forensic software, Windows
Forensic Toolchest, a hardware write blocker (Tableau Forensic USB Bridge),
and the like in this research experiment. The finding results after the analysis
proved that the theft of SI was taken place in a RFID BS. Hence, the arguments
made for and against prove the hypothesis 8 is to be accepted.
137