Digital Forensics in Small Devices: RFID Tag Investigation

1.3 FINDINGS OF THE RESEARCH
The research summarizes findings relevant to the digital forensic investigation of
a compromised RFID based stock management system. The findings from the
investigation prove that the theft of SI has occurred in a RFID based retail system.
Hence, the perpetrator could be identified and later be prosecuted according to the
court of law if more evidence (which are the limitations of this research; see
Section 3.4 in Chapter 3) such as images from the Closed Circuit Television
(CCTV) monitoring system and the interview evidence from human participants
are taken into consideration during the investigation.
In order to investigate the presence of digital evidence after theft of SI, a
prototype of stabilized commercial retail environment using RFID stock
management system is constructed in the laboratory according to the proposed
system design (Section 3.3.1). As part of the proposed system design, a
customized RFID middleware software (source code can be seen in Appendix 4)
is developed based on the Software Development Kit (SDK) of RFID reader’s
manufacturing company. The developed programme allows users to configure the
RFID reader, to collect the tag data, and write the tag data to the backend database.
Basically, it enables reading and writing the tag data from the RFID scanner to the
BIS SQL 2005 Server (and vice versa). By design, one real and one poisoned
RFID Read/Write tags are also applied in a stabilized system. The Tripwire for
Servers (Version 4.8) and Tripwire Managers (Version 4.8) are utilised to
establish the baseline of a stabilized/trusted system in operation. Hence, the
previous studies such as compromising the backend database by using a RFID tag
as an attack vector (Section 3.1.2), and the acquisition of backend SQL server
artefacts methods (Sections 3.1.3 and 3.1.4) are replicated in this simulated
research. Subsequently, SQL poisoning attack (Section 3.3.2) is initiated via a
fake tag to compromise the backend database of the stock management system
and then each entity in the RFID BS (see Table 2.5 in Chapter 2) such as the tag,
POS, scanner, and the backend SQL Server are investigated for evidence of the SI
theft. Thus, the evidence is collected from the tag, the scanner, the POS and the
backend SQL server. However, the ReaderLogExtraction tool (see Appendix 3) is
developed based on SDK of RFID reader’s manufacturing company in order to
acquire bit-to-bit evidence data from the RFID reader’s memory during the
5