Digital Forensics in Small Devices: RFID Tag Investigation

analysed with SQL Server Profiler. Hence, the analyses of the default trace files
are out of the scope of this research.
The acquired seven SQL Server error logs (Section 4.2.3.6.5) are analysed
by using notepad++ version 5.0.3, which is an open source text and source code
editor for Windows system (see Appendix 23). Even though these server error
logs are useful for determining the information related to authentication, notable
results concerned with the malicious attack cannot find in all the error logs within
the scope of the attack except the following finding in the error log file
(errorlog.1).
Figure 24A.1: Suspicious trace in errorlog.1
However, the malicious attack cannot be judged with the only suspicious trace
found in the SQL Server error log file.
In addition to trace file logs and the error logs of the SQL Server, system
event logs such as application, system, and security logs could give the potential
evidence related to the investigation.
After analysing the acquired system event logs by exporting them into
Microsoft Excel spreadsheets, it is noted that the findings (see Figures 24.2, 24.3,
and 24.4) are not much convincible traces to prove the theft of SI in the
compromised RFID stock management system.
Figure 24A.2: A snippet of a suspicious trace in acquired Application Log
292