Digital Forensics in Small Devices: RFID Tag Investigation

defines different types of malware that are available for RFID attack and advises
middleware developers to proceed in a considerate fashion. Each of these
references has guidance for research and specific details of small device forensic
techniques.
The literature reviewed shows that research is leading towards
knowledge of better system architectures and to better best practice guidance
knowledge for digital investigators. For example, Chalasani et al., (2005)
discusses possible improvements in network designs and Chalasani et al., (2007)
investigates improving the data architectures of the RFID transaction system.
The National Institute of Justice (NIJ) Report (2005) also continues the theme
by specifying best forensic investigator practice for small devices – but does not
report RFID chip practice. This appears to be a gap in the current professional
literature. Jeong and Kim (2005) provide guidance for RFID architectures in
ubiquitous environments. Much of the knowledge of RFID systems comes from
papers reporting security problems and architectures for RFID systems. The
security analysts have interrogated RFID systems to understand the risks and
vulnerabilities of the systems. As a consequence, the technical definition and
scope are made explicit. For example Li et al., (2008) proposes a cross-layer
architecture to protect the system and user privacy. Others have taken up the
challenge to ask the forensic question of RFID systems. For example, Khanna et
al., (2006) spelled out a general method of inquiry for physical devices, and Kim
et al., (2007) for RFID systems in particular. Martone et al., (2006) go a step
further and examine current forensic identification techniques for data
verification in RFID systems.
The proposed study will look at the identification of all possible data
storage locations in a RFID system. Also recommendations for digital forensic
investigators working on RFID systems for best practice will be made. Thus, the
literature review chapter is firstly organized into a three-tier model of the RFID
system in the retail sector including a material level (Section 2.1). Different types
of tags, readers, the hosts and information system (Section 2.2) are reviewed. For
example, where the data on tag is stored, the way in which the data is captured by
the reader and transferred to the backend database servers or enterprise
applications and business processes of a RFID system (Section 2.3). Then, the
10