Digital Forensics in Small Devices: RFID Tag Investigation

xvi
Figure 4.31: Fragment of the acquired backend server
database principals information ................................................................ 103
Figure 4.32: Acquired evidence of server database role membership ........................... 104
Figure 4.33: Fragment of the table statistics data .......................................................... 105
Figure 4.34: Acquired statistics histogram information against Tag column of
RFID_test.mdf .......................................................................................... 106
Figure 4.35: Acquired statistics histogram information against Value column of
RFID_test.mdf .......................................................................................... 107
Figure 4.36: Acquired statistics histogram information against Date column of
RFID_test.mdf .......................................................................................... 107
Figure 4.37: Acquired current table data of RFID_test.mdf database ........................... 108
Figure 4.38: Acquired statistics histogram information against Tag column of
RFID_test_log.ldf ..................................................................................... 109
Figure 4.39: Acquired statistics histogram information against Value column of
RFID_test_log.ldf ...................................................................................... 109
Figure 4.40: Acquired statistics histogram information against Date column of
RFID_test_log.ldf ...................................................................................... 110
Figure 4.41: Acquired current table data of RFID_test_log.ldf database ...................... 110
Figure 4.42: Fragment of the acquired collation settings and data types of backend
SQL Server 2005 ....................................................................................... 111
Figure 4.43: Fragment of the acquired data page allocations of backend SQL
Server 2005 ............................................................................................... 112
Figure 4.44: Collected SQL Server logins ..................................................................... 113
Figure 4.45: Syntax used for acquisition of SAC Information ...................................... 114
Figure 4.46: Surface Area Configuration results by running
sys.system_components_surface_area_configuration .............................. 114
Figure 4.47: SQL Server connection details of the forensic investigator ...................... 115
Figure 4.48: Physical data file locations from the
result of SSFA_Database.sql script ........................................................... 116
Figure 4.49: Registered CLR libraries from the output of SSFA_CLR.sql script ......... 118
Figure 4.50: Screenshot of the last modification dates of a trace file ............................ 119
Figure 4.51: Acquisitions of the trace files using dcfldd tool ....................................... 119
Figure 4.52: Acquisitions of backend SQL Server error logs by using dcfldd tool ....... 120