Digital Forensics in Small Devices: RFID Tag Investigation

Unlike SQL Server forensics, the traditional Windows digital forensic investigation
generally targets on “the volatile and non-volatile operating system, and selected
application data”, and often ignores the database (Fowler, 2009, p. 50). As the
database is overlooked, the decision on whether a database is compromised or not
during an incident is very hard for a forensic investigator. Nevertheless, the two case
scenarios explained in this book chapter demonstrate that the application of SQL
Server forensics can discover additional important data beyond the scope of a
traditional Windows forensic investigation (Fowler, 2009).
Fourthly, the author explains three different acquisition methods that can be
performed during forensic investigations such as live acquisition, dead acquisition,
and hybrid acquisition. All SQL Server data, volatile and non-volatile, can be
identified and acquired by using the live acquisition method. On the other hand, the
live acquisition method can solve the problem of taking a SQL Server offline for an
investigation as the business companies may not allow the forensic investigator to
take the server offline (Fowler, 2009). Furthermore, the author points out some
benefits of live acquisition. For instance, the forensic investigator can perform
“investigation on identified data repositories without needing to forensically
duplicate the entire logical or physical disk drives” as live forensics is more and
more realistic due to the ever growing storage capacity of the computers (Fowler,
2009, p. 54). In fact, the investigator can save time and easily focus on the database
artifacts that are mainly related to the investigation by using the live acquisition
method. Then, the author mentions two connection methods, interactive and remote
connections, to a SQL Server to perform live acquisition. In an interactive
connection, the investigator can either access the SQL server onsite or use a remote
desktop protocol (RDP) to log onto the SQL Server and utilize the tools from an
incident response-compact disc (IR-CD) to acquire SQL artifacts. Then, the acquired
output can be transferred to a reliable storage location by using tools such as Netcat
or Cryptcat. Instead, a universal serial bus (USB) flash or external hard drive can be
connected to the target SQL Server to store the acquired output. Unlike an interaction
connection, Fowler (2009) mentions the investigator can employ a computer that can
be connected to a compromised network in order to remotely connect a target live
44