Digital Forensics in Small Devices: RFID Tag Investigation

forensic work-station (Appendix 10) was used as a main forensic analysis tool
during the investigation. Initially a visual scan of the Master Server Log was made
to quickly identify where SI values had been changed. For instance, it was quick
to find out the malicious traces in entries all SIs values of $600 in the acquired
current table of RFID_test.mdf database (see Figure 4.37 in Section 4.2.3.4.4).
Likewise the fake tag ID, malicious SQL poisoning code and the time stamp were
also easily identified (see Figure 4.41 in Section 4.2.3.4.4). Moreover, the
acquisition results of current table data of log file - RFID_test_log.ldf (see Figure
4.41) showed the significant evidence of the attack in which the malicious SQL
poisoning code was found and the SI (Tag IDs starting with E004) were updated
to the values $600 at 06:39:48pm on the 12 October 2010. At this point in the
analysis enough evidence had been discovered so that the analysis of the RAM,
Tag and Scanner would be for verification and exception evidence.
Then, the fake tag ID was used as a keyword to look for the malicious
transaction in the image copy of scanner memory and POS RAM (Section 4.3.1
and Section 4.3.2 respectively) when analysing with EnCase. The significant
evidence such as malicious tag ID, time stamp, and SQL poisoning code were also
discovered. However, in a real business search; the technique to query the
transaction logs in the Master Server Log would have been more complex and
time consuming. Such a search can be bench marked from stock controls and the
legitimate time stamps of value alterations. The time stamp identified was then
used as a keyword search in the other images. In a real search the existence of
evidence in these subsystems would be a bonus given the volatile state.
Nevertheless, in the simulation experiment; the evidence was present in each of
the subsystems and it was searched for time stamp and ID strings. The Tag also
contained the malicious code that can be signature matched for identification of
potential sources.
As stated in Section 3.3.5, the comparison of the MD5 hash values before
and after the analysis (in order to find out whether the evidence has been modified
during analysis and acquisition) was performed as part of preservation. The MD5
hash values were the same as before and after analysis. Thus, the evidence files
are not tempered during the analysis phase and the integrity is still intact.
However, in the real world investigation; the limitations (Section 3.4) such as
interviewing human participants, securing and transporting the acquired evidence
146