Digital Forensics in Small Devices: RFID Tag Investigation

SQL statement from the SQL injection attack code in order to verify which specific
Server data was compromised. To conclude, the forensic investigator could be able to
verify that any SQL Server data was undisclosed by utilizing SQL Server forensics.
In the second case scenario, Fowler (2009) gives an example of a malicious
employee who made unauthorized changes in a company‟s database (500 gigabytes
capacity). The changes are considered to be done within the online sales database,
especially on “the billing amounts of the customer’s order” and hence “the
traditional forensic investigation is performed” (Fowler, 2009, p. 52). After
investigation, the forensic examiner concludes that the unhappy employee logs on to
the database server after office hours for a few nights and the transactions done
during that time seems to be abnormal. But, the investigator cannot verify whether
the modification of data by a suspicious employee is authorized and what the extent
of the incident is. Thus, Fowler (2009) mentions that the forensic investigator who
initiates SQL Server forensics can verify that a breach of security incident has
happend, prove the malicious activity causing database changes without authorized
permission, and confirm the user who carried out those changes. However, the
investigator has to apply “the data reduction principles to reduce the amount of data
to be acquired and analysed” due to the large capacity of the database (Fowler, 2009,
p. 52).
Figure 3.3: Scenario 2 illustration (Fowler, 2009, p. 53)
43