Digital Forensics in Small Devices: RFID Tag Investigation

can also be found not only in the database‟s cache and procedure cache, but also can
be traced in the memory. Referring to the Microsoft SQL Server Book online,
“SQL Server logs certain system events and user-defined events to the
SQL Server error log and the Microsoft Windows application log.
Both logs automatically timestamp all recorded events. Use the
information in the SQL Server error log to troubleshoot problems
related to SQL Server.
The Windows application log provides an overall picture of events
that occur on the Windows operating system, as well as events in the
SQL Server and SQL Server Agent....” (http://msdn.microsoft.com/en-
us/library/ms191202.aspx; 2010, p. 1)
The researchers mention that the valuable information to the forensic investigator can
be found in the SQL Server error logs and the Windows application logs, although
the duplication of log data exist in those two locations. However, the log in the SQL
Server can easily be erased by the users who have got the administrative rights or
privileges. Even though there are events such as failed login attempts, some database
console commands (DBCC) captured by the SQL Server error and Windows
application logs, more evidence is required for the forensic investigation that has to
be found somewhere in order to identify the structure of the database, the changes
that are made to the data and the like. In addition to error and application logs, the
SQL default trace and transaction logs are critical components of finding evidence in
a potential data breach, as data modifications made by every transaction are recorded
with timestamps. But Cerrudo (2009) also states that the extended stored procedure
executions, SELECT and DBCC statements cannot be found in the transaction log.
But in some cases, the critical evidence can also be found in the contents of the SQL
server memory (data and procedure caches).
Finally, Cerrudo (2009) discusses “SQL server anti-forensic techniques”, the
protection of an audit trail and evidence when the system is compromised.
52