Digital Forensics in Small Devices: RFID Tag Investigation

server and use IR tools to collect the artifacts. But, these connections depend on the
“system and database libraries, and dynamic management objects (DMOs) on the
SQL Server” (Fowler, 2009, p. 57).
The dead acquisition method is the way in which the power connection of the
SQL Server is forcefully shutdown. However, the potential evidence from the volatile
data will be lost when the server‟s power is down even though the analysis results can
easily be repeated for later verification. But, the actual SQL data alterations have
normally happened in the memory and are recorded in the database transaction log.
Likewise, on-disk data pages are only updated “during the start-up and shutdown of
the SQL Server service”, and when “the regularly scheduled checkpoint process runs
which then flushes the modified data pages to disk” (Fowler, 2009, pp. 58-59). Thus,
the author does not recommend dead acquisition as the SQL Server utilizes as much
system memory as possible.
In hybrid acquisition, the live acquisition of volatile data from a target system
is initially performed and then followed by dead acquisition. Hence, the hybrid
acquisition allows the forensic investigator to manage the relative proportions of live
and dead acquisitions according to his or her needs (Fowler, 2009).
Figure 3.4).
Finally, the author explains a methodology of SQL Server forensics (see
Investigation
Preparedness
Incident
Verification
Figure 3.4: SQL Server forensic methodology (Fowler, 2009, p. 60)
Despite the fact that there are many different forensic methodologies which can be
found in literature, every phase of any methodology must be performed correctly by
the forensic investigator. Otherwise, the results of the investigation as evidence may
not be possibly accepted by the court (Fowler, 2009). For instance, the integrity of the
digital evidence must be maintained by producing digital hashes on all the acquired
artifacts during the investigation.
For Investigation Preparedness (IP), the first phase of the SQL Server
forensic methodology, the author mentions that the IR toolkit must be created, a
45
Artifact
Collection
Artifact
Analysis