Digital Forensics in Small Devices: RFID Tag Investigation

software (see Appendix 4) that can read and write the tag data from the RFID scanner
to the BIS SQL 2005 Server (vice versa) will be developed, so as the Tripwire for
Servers (version 4.8), and the Tripwire Manager (version 4.8.0.246) that allows to
manage Tripwire for Servers from a central location in graphical user interface (GUI)
mode will also be installed on the POS test-station (see Appendix 5 for Tripwire
setup, and Appendix 9 for TEST-STATION information in detail).
Figure 3.11: Test-Station Setup (Fake tag is read by the RFID reader)
According to the experimental requirement, only two (one real and one poisoned)
RFID Read/Write tags will be applied in a stabilized BS. These RFID tags are EPC
Gen 2/ 18000-6B standards and operate in the frequency range of 860MHz to
960MHz (see Table 2.2 in Section 2.1.4). The size of the user memory is 1728 bit
(216 bytes) and 64 bits ID size, according to the information sheet provided by the
RFID tag manufacturer, SkyeTek.
In addition, the two databases will be created in the backend database SQL
Server. The primary data file named RFID_test.mdf is used for storing stock item (SI)
values according the RFID tags. Likewise, the transaction log file named
RFID_test_log.ldf is used for storing the reader logs to the backend SQL Server.
Then, all the fictitious product values and tag IDs will be pre-keyed into the
database files (see Appendix 7). For instance, the insertion of the fictitious values into
the primary data and log files are as follows.
70