Digital Forensics in Small Devices: RFID Tag Investigation

processed. Likewise, the acquired result of the compromised server’s data page
allocation (Figure 4.43) was also useful for forensic investigation. Hence, these
finding results could be very valuable in analysing the transaction log and so
forth.
According to the finding results of SAC of the backend server (Figure 4.46
in Section 4.2.3.4.7), it was found that the attacker or unauthorized user had not
gained access to SI management database by using the weak point of server
security configuration, as only the extended stored procedures such as Server
Management Objects and Distributed Management Objects (SMO and DMO XPs)
were set the value to “1 (the default value)”.
2. Analysis of Residual Non-Volatile SQL Server Data
The physical database files (RFID_test.mdf and RFID_test_log.ldf) were
identified (Figure 4.48 in Section 4.2.3.6.1) and collected in Section 4.2.3.6.2 as
part of preservation of evidences during the investigation. Likewise the bit-to-bit
POS/Server’s physical hard drive was acquired for the purpose of the preservation
of evidence (Section 4.2.4).
Additionally, the results of volatile active VLF data from transaction log
(Figure 4.22 in Section 4.2.3.3.1), ring buffer data (Figure 4.23 and Figure 4.24 in
Section 4.2.3.3.2), and reusable VLFs data (Section 4.2.3.6.2) were useful for
recovering the original data. However, the data recovery was not in the scope of
this research project.
Even though the results of CLR libraries were important for reconstruction
of activity, there were no registered CLR libraries according to the findings in
Section 4.2.3.6.3 (Figure 4.49).
As stated in Section 4.2.3.6.4, the trace files artefacts which contained data
within the investigation scope were acquired and analysed from the forensic copy
of the victim system in order to prevent the changes in the last accessed times of
the trace file. However, the acquired trace files artefacts could not be analysed as
the SQL Server Express instance was used in the experiment system.
Furthermore, these SQL Server default trace files could only be opened and
291