Digital Forensics in Small Devices: RFID Tag Investigation

investigation. Likewise, all the required software forensic tools for data collection
(such as ReaderLogExtraction tool, WinEn, extended WFT, and the like) are
integrated into the customized Helix_RFID_IncidentResonse (Helix_RFID_IR
DVD) toolkit (see Appendix 2 for steps in creating Helix_RFID_IR toolkit) and
the live data acquisition is performed by placing RIFD_IR into the compromised
machine’s DVD drive in order to avoid any modifications or affect minimum
impact to the original evidence during the acquisition phase (Jones, Bejtlich, &
Rose, 2006b; Jones, 2007; Fowler, 2007, 2009). Hence, the details of the tools and
techniques used to collect the digital evidence, findings and analysis of collected
data are presented in (Chapter 4).
During the simulation experiment, the traces of evidence after the attack
are able to be identified, acquired, preserved and analysed according to the digital
forensic principles and guidelines for handling the digital evidence. Hence, the
evidence of values of the original stock items are changed in the backend database
during the investigation (see Figure 4.37 in Section 4.2.3.4.4). Likewise, the
evidence of malicious transaction traces including the tag ID, date and timestamp
are found in logs of the RFID reader’s memory (Section 4.3.1) and in the memory
of the POS station (POS RAM) (Section 4.3.2). Similarly, significant evidence is
found in the acquired current table data of the stock management database (Figure
4.37) from the backend SQL Server. Moreover, the acquisition result of current
table data of transaction log file - RFID_test_log.ldf (see Figure 4.41) shows the
significant evidence of the attack in which the malicious SQL poisoning code is
found and the SI (Tag IDs starting with E004) are updated to the values $600 at
06:39:48pm on the 12 October 2010. Hence, a fake tag is also found and
preserved as proof of the theft of SI, in the simulation experiment.
1.4 CONCLUSION (STRUCTURE OF THE THESIS)
In conclusion, Chapter 1 introduces the motivational factors in connection with
the study of the digital forensic investigation in a compromised RFID tag based
stock management system in the retail environment. It also reviews the motivation
of the research and emphasizes the gap in the digital forensic research area.
Chapter 2 includes a literature review of relevant research. For instance,
the three-tier model of a RFID system such as the material layer (Section 2.1), the
6