Digital Forensics in Small Devices: RFID Tag Investigation

the trusted forensic toolkits. In addition, all the forensic tools used and steps
performed during the investigation should be documented in order to track the
activities performed by the forensic investigator. Moreover, the comparison of
hash values (example: Appendix 22) of collected data before and after should also
be done in order to verify the integrity of the evidence and preserve the evidence.
Securing the crime scene (Section 3.3.4), transporting the collected evidence
(Section 3.3.4), chain of custody (Section 3.1.5) and analysing the forensic image
copy on a specific forensic workstation are also the most important
factors/forensic processes to maintain the integrity of the collected evidence.
5.3.5 Analysis of the Acquired Data: Best Practices
In analysis of the acquired data from a compromised RFID BS, the ID and time
stamps from the related sources are significant to speed the extraction of relevant
evidence to the theft of SI from the acquired artefacts. Similarly, the analysis
phase may also lead to a second round of human interviews. In addition, POS
evidence such as CCTV and interview evidence from human participants (Chapter
3; Section 3.4) must also be acquired, analysed and documented in the real world.
Moreover, proper forensic tools used (such as EnCase, FTK, Tableau forensic
hardware write blocker) and the steps taken during the forensic examination must
be documented.
5.4 CONCLUSION
In this chapter, the discussion of findings from the research experiment presented
in Chapter 4 was made. The answers to the proposed research questions from the
methodology chapter (Section 3.2.6) were discussed in relation to the asserted
hypotheses (Section 3.2.7) and a conclusion was reached with regard to the
validity of the anticipated hypotheses. Likewise, the findings after the
investigation of a compromised RFID system were also discussed and evaluated.
Furthermore, the issues related to the investigation were stated.
The main research question was a focal point to prove the theft of SI in a
RFID BS and the phases of research model (Section 3.2.5) were established. The
tested system design (Section 3.3.1) was also set up based on the main research
question. The findings (Chapter 4) after a complete forensic examination were
able to prove the theft of SI in a simulated RFID based stock management system.
150