Digital Forensics in Small Devices: RFID Tag Investigation

The storage drive (USB flash drive) for
the digital evidence data was prepared
in a forensically sound manner for the
purpose of the investigation (see
Appendix 11).
An authorized administrator account to
the compromised was acquired from the
system administrator.
The potential evidence was identified,
collected (according to the volatility)
and saved into the trusted USB flash
drive by using pre-developed RFID_IR
and forensic USB toolkits from the
compromised RFID BS (Section 4.2).
Hardware write blocker (Tableau
Forensic USB Bridge) was deployed
during the data acquisition, processing
and analysis phases (Section 3.3.4,
Section 3.3.5, and Section 3.3.6
respectively) in order to maintain the
integrity of the evidence.
As stated in Table 5.4, the collected
data (Section 4.2) were analysed
(Section 4.3) and preservation of the
digital evidence was accomplished
(Table 5.3).
Hash values comparison of the
The arguments against are similar to
that of Table 5.1 and 5.5 above. The
evidence from CCVT and interviewing
human participants can lead to identify
and prosecute the malicious attacker or
SI thief. On the other hand, the
malicious tag can be re-written for
another SI on the same day if there is
no proper policy of re-writing the tag in
the retail shop.
141