Digital Forensics in Small Devices: RFID Tag Investigation

(EEPROM), ferroelectric random access memory (FRAM) which is a non-volatile
memory that uses ferroelectric film as a capacitor for storing data, and static
random access memory (SRAM).
In RFID tags, RAM is used for the temporary storage of data during the
interrogation zone of the readers. The stored data in RAM in passive tags will be
lost when the power supply is off. Unlike the passive tags, RAM in the active tags
with on-tag power supply can store the data for a longer period. Similarly,
EEPROM which uses inductive coupling for data transmission (such as to read
data from and write data to the tag) can store the data for several years without a
power supply. But, the tags using SRAM technology, in which the data
transmission method is ether inductive coupling or backscattering, require a
constant power to preserve the stored data (Finkenzeller, 2003). The comparison
of different memory types for RFID tags can been referred in the Table 2.3.
Roussos and Kostakos (2009) discuss the memory layout of EPC Class 1
Gen 2 as an example of the modern RFID tag‟s memory (as shown in Figure 2.10
below). The chip‟s non-volatile memory is partitioned into four areas including
reserved, EPC, tag identification (TID) and the user memory bank areas.
Figure 2.10: Memory layout of EPC Gen 2 Tag (Source: Roussos &
Kostakos, 2009, p. 115)
The 64-bit reserved memory bank contains an access password to gain access to
the tag‟s content and destroy or kill-password to disable the tag permanently. The
EPC memory bank is composed of a session identification (SID) or protocol
control (PC) which is similar to the media access control (MAC) address and used
23