Digital Forensics in Small Devices: RFID Tag Investigation

Appendix 2: Steps for Creating Radio Frequency Identification (RFID)
Incident Response DVD Toolkit
Nowadays, as stated by Fowler (2009), hundreds of free and commercial forensic
tools are available. For instances, First Responders Evidence Disk (FRED),
Computer Online Forensic Evidence (COFEE), Windows Forensic Toolchest
(WFT) and Incident Response Collection Report (IRCR) are popular Windows
incident response toolkits available today. However, these available forensic tools
are designed to carry out specific purposes and are not precisely suitable for
investigation of a compromised RFID Business System (RFID BS). Thus, in this
research project, a customized RFID Incident Response (Helix_RFID_IR) DVD
toolkit is created as part of the investigation preparedness for forensic
investigation of a compromised RFID BS. The idea to create Helix_RFID_IR is
based on the creation of a customized “SQL Server forensic incident response
toolkit” (Fowler, 2009, p.108 -138) and “Real digital forensics: computer security
and incident response” (Jones et al., 2006b). Hence, the steps for creating RFID
IR toolkit are as follow:
1. Download freely available Helix3.iso (version: 2009R1) from e-fense:
https://www.e-fense.com/store/index.php?_a=viewProd&productId=11
MD5 hash value of Helix3.iso, 3ac2ca7d8d1dcc494ef5124c1cf37f7c, was
noted.
2. Check the hash value by using WinMD5.exe after downloading the Helix3
in order to find out whether there was an error during the download. Hence,
the MD5 hash values were the same.
3. Mount the Helix3 with DAEMON Tools Lite (http://www.disc-
tools.com/download/daemon).
4. Create the folder “IR” on the desktop of a computer in the lab.
5. Copy the wft folder from Helix3 to “IR” folder.
6. Copy the trusted Extended WFT Executables.
5