Digital Forensics in Small Devices: RFID Tag Investigation

e investigated for evidence of the theft. Hence, the forensic analysis of the SQL
Server related to previous works (Sections 3.1.3 and 3.1.4) should be revised. As
stated in Section 3.1.3, Fowler (2009) discussed the differences among traditional
forensics and the SQL Server forensics by giving two fictitious scenarios in which the
attack of the first scenario was originated via the Web and the latter was caused by an
unhappy employee. Then, Fowler (2009) explained the ways in which the
investigation should be performed on the SQL Server related incidents in a
forensically sound manner. In addition, the ways in which the phases of forensic
methodology performed in the SQL Server forensics could be utilized to identify a
database security breach. On the other hand in Section 3.1.4, the research conducted
by Fowler (2007) described how to perform a forensic analysis of a Microsoft SQL
Server 2005 by using a real world security incident scenario. The values of the
articles (Fowler, 2007; Fowler 2009) were to highlight malicious attacks on SQL
Servers could come from not only the Web, but also from a malicious employee. In
addition, it is important to note that a live forensic analysis has to be performed on a
SQL Server in order to acquire all volatile and non-volatile SQL Server artefacts (see
Appendix 1). With the exception of the ways in which a forensics investigation of a
SQL Server incident is conducted, none of the papers written by Fowler (2007, 2009)
were related to the forensic investigation of a compromised RFID BS as a whole and
the malicious attack compromised the SQL Server from the web. However, the idea
of creating IRCD (Incident Response CD) and the application of SQL forensic
methodology would be replicated for developing a customized
Helix_RFID_IncidentResponse (Helix_RFID_IR) toolkit (see Appendix 2) and
investigating the backend database server respectively.
As stated in Section 3.1.5, Wang et al., (2009) proposed a live physical
memory forensic method of a target or compromised host (workstation or server). In
fact, important potential evidence can be acquired from the physical memory of a
running workstation or server. Otherwise, the evidence of a compromised RFID BS
will not be complete and the volatile evidence from the memory will be lost when the
power supply of the target host is turned off. Additionally, most business companies
may not permit a forensic investigator to take the server offline (Fowler, 2009). Thus,
58