Digital Forensics in Small Devices: RFID Tag Investigation

� Limiting the use of memory residents such as temporary
tables and variables during investigation would restrict an
effect on the SQL Server buffer pool.
� By avoiding the changes in permissions on database
objects could help the investigator not to overwrite
previous permission assignments on database objects and
not to generate various log entries during investigation.
� To avoid the unpleasant affects on the victim system’s
SQL syntax or logic errors, the executions of required SQL
statements for investigation should be initially tested on
the test station as a small error in SQL syntax could have
catastrophic consequences on the database server.
5.3.4 Identification, Acquisition and Preservation: Best Practices
As previously stated (Section 5.2.4; Sections 3.3.4 and 3.3.5 in Chapter 3), the
evidential search of a compromised RFID BS should be preceded by preserving
the evidence of the volatile entities and subsystems. Forensic imaging would
usually proceed from the most volatile to the least. However, in the real world
RFID BS; the key evidence could be located in priority from the Web server,
backend database server, the POS and the SI. If the SI evidence had been lost on
account of volatility then the Server Image should contain sufficient detail from
which to fully investigate the system. Hence the SI and POS could be isolated
(define system first) and the Servers imaged as a priority. Human actors or CCTV
dimensions must also be considered as the sources of evidence. The evidence
from these sources would normally be imaged and documented at the same time.
The acquisition of potential evidence data from a compromised RFID BS
should be treated carefully, as the volatile data could be vanished if the backend
SQL Server was down. The forensic investigator must deploy a forensically sound
methodology of collecting potential evidence data in order to preserve the
integrity of the collected data. For instance, saving the collected data into a trusted
location, using hardware write blocker during acquisition and analysis, and
acquiring and analysing the potential evidence from a compromised system with
149