Digital Forensics in Small Devices: RFID Tag Investigation

safely, chain of custody, CCTV analysis might also be conducted during the
forensic examination. Otherwise, the forensic examination of a compromised
RFID based stock management system would not be complete and comprehensive.
Thus, the perpetrator or theft or malicious attacker would not be able to be
prosecuted.
5.3 DISCUSSION OF RECOMMENDATIONS: BEST PRACTICES
The previously discussed sections and the findings of the research experiment
(Chapter 4) have guided the forensic investigators in such a way in which the
knowledge of the digital forensic practices or procedures in RFID based Business
System (RFID BS) need to be broadened. Especially, the digital forensic
procedure in the processes of investigation preparedness, artefact acquisition or
extraction, analysis and presentation of the theft of SI in a compromised RFID BS
was investigated. Hence, the knowledge acquired during the research experiment
will now be discussed as the recommendations for forensic investigation related to
RFID BS. In addition, the potential evidence can be acquired from RFID BS will
be outlined and the recommendations for digital forensic best practices concerned
with investigation preparedness, incident response, acquisition, preservation,
analysis of a compromised RFID stock management system.
5.3.1 Managing Investigation Output and Investigation Preparedness: Best
Practices
Managing the outputs of investigation is significant to any forensic investigator in
order to preserve the integrity of collected evidence data, as saving collected
evidence on the victim system will compromise the integrity of the evidence. Thus,
the collected evidence should be saved in a trusted location. The trusted location
could be either on forensic workstation/laptop or on the locally connected external
storage media, depending on whether the investigation is conducted interactively
on the victim system or via remote connection. However, attaching the storage
media for investigation outputs directly to the target victim system will change the
system state. Thus, the investigator must document the drive letter representative,
connection and drive letter creation time, disconnection time of the output storage
media. After documenting the information in detail, the investigator could exclude
these changes in the investigation. Similarly, the forensic tools required and
147