Digital Forensics in Small Devices: RFID Tag Investigation

14. Similar to the step (11), once “Finish” button was clicked; the forensic
software EnCase started acquiring the original collected data from the
flash drive B to the output folder (C:\Program
Files\EnCase6\ArKar\Evidences_RFID).
Figure 12.12: Screenshot of the acquisition process by EnCase
Astonishingly, the time taken to acquire the collected evidences from the
flash drive by using the data compression method (“Good”) was almost
the same as that of the method used without compression.
The forensic image acquisition was completed. The MD5 hash
value of the acquired data, the time taken to acquire the original evidence
from the flash drive, and the location of the image copy can be found in
the completion result (Figure A12.13).
Figure A12.13: Screenshot of the Completed Acquisition
112