Digital Forensics in Small Devices: RFID Tag Investigation

of potential evidence after an event, to analyse the collected potential evidence
and to recommend best practice for both system security and forensic
investigation based on the findings of the experiment. A laboratory simulation is
set up to replicate previously published security violations of RFID systems, and
then the Business System is forensically investigated in order to locate potential
evidence. The simulation context is the retail environments of clothing and
electronic goods. In both environments, SI can vary in price from a few dollars to
tens of thousands of dollars. The environments are high intensity with large
numbers of SI, high transaction rates, many entry level sales assistants, high staff
turnover, and generic brand systems architectures. The Read/Write RFID tag is
often deployed to SI in these environments by press clip attachment (with optional
band extension) (Jones, Hoare, Dontharaju, Shenchih, Sprang, Fazekas, Cain, &
Mickle, 2006). The attachments are released at the POS with a design tool for
future re-writing and re-attachment to another SI. The business process is cost
effective and the Business System integrity is theoretically maintained (Jeng,
Chang, & Wei, 2009).
The thesis is structured to first define a RFID tag Business System (RFID
BS) and then to elaborate on the specific security risks associated with this
Business System (Rotter, 2008). The Business System is defined (in Table 2.5 in
Chapter 2) and the potential for system violation is identified between the
Business System entities, within the entities (for instance: tag cloning), and
through social engineering (Figure 2.14 in Chapter 2). It is assumed the Business
System is closed so that the event of an item being thrown out of a window
undetected or breaking and entering are excluded from the study. The case of a
Business System is violated by SQL injection attack through the Read/Write
RFID Tag is replicated (Haines, 2006b; Rieback, Crispo, & Tanenbaum, 2006b).
The RFID BS is investigated for evidence remaining after the attack and
suggestions made for where to look for evidence, how to extract evidence, how to
preserve and analyse the evidence (Michael, & McCathie, 2005; Masters, &
Turner, 2007; Harrill, & Mislan, 2007; Khannaa, Mikkilinenia, Martonea, Alia,
Chiub, Allebacha, & Delpa, 2006; Martone, Mikkilineni, & Delp, 2006).
Therefore the relevant research question is: What should the forensic investigator
do in order to perform the complete and accurate forensic examination of a
compromised RFID stock management system in the retail sector?
4