Digital Forensics in Small Devices: RFID Tag Investigation

Appendix 24: Analysis of Acquired SQL Server Artefacts
1. Analysis of Volatile and Non-Volatile SQL Server
According to the acquired evidence of the compromised server configuration, the
attacker or unauthorized user could not perform the system table updates during
the attack as the value of allowing system table updates was still set to “0” (Figure
4.19).
The notable results from acquired ring buffer gave the timestamp of each
buffer entry and the record of SQL Server events (Figure 4.23). Likewise, the
acquired results in ring buffer security error could lead the security related errors
such as login failures and events related to the security. But, the attacker did not
perform the theft of SI by logging on the system directly as there were no errors in
ring buffer security error (Figure 4.24).
As stated in Section 4.2.3.4.4, table statistics are useful for comparing against the
present state of data within a table to identify the values that have been changed or
updated. Hence, the last updated time of the table statistics was critical during the
forensic data acquisition. However, according to the statistic information findings
from the results of acquired Histogram (actual data values that were taken when
the last statistics updated) against RFID Tag (Figure 4.34), Value (Figure 4.35)
and Date (Figure 4.36) columns of the compromised database (RFID_test.mdf) in
Section 4.2.3.4.4; the table statistics were updated before the time of investigation.
Hence, the notable result of acquired current table data of the stock management
database (Figure 4.37) showed that all the SI values were $600 and confirmed the
database was obviously compromised.
Moreover, the acquisition results of current table data of log file -
RFID_test_log.ldf (see Figure 4.41) showed the significant evidence of the attack
in which the malicious SQL poisoning code was found and the SI (Tag IDs
starting with E004) were updated to the values $600 at 06:39:48pm on the 12
October 2010.
The finding information related to the collation setting and data types of
SQL Server (Figure 4.42) could lead to determination of how data was stored and
290