Digital Forensics in Small Devices: RFID Tag Investigation

After analyzing the report on the 12 th of October 2010, the administrator finds out the
product database has been changed, according to the changes in MD5 hashes of the
databases and all the values of SI are changed to $600.00. Thus, the changes on the
values of SI are unusual as different products in the shop are tagged with different
prices (see Section 3.3.1 and Appendix 8).
So, the administrator escalates the event‟s priority and reports it to the
incident response team. Then, the report is reviewed and the forensic investigation is
initiated by the first responder or forensic investigator.
3.3.4 Data Collection
Generally, the main digital evidence can be collected from the target system of
interest as the digital evidence can be found in several different areas of target system
(Zhang & Lin, 2010). The very first step needs to be performed by the first responder
or forensic investigator is to identify and acquire the evidence. There are various
procedures that need to be followed. The procedures are followed in such a way that
the evidence is acceptable to court of law. For instance, the potential evidence must
be identified and located. Similarly, the crime scene must be secured. So, the
potential evidence of the compromised RFID BS will not be altered. Likewise, Britz
(2009) stated that the preservation is also a part of seizing the evidence such as
obtaining the warrant, planning the seizure, securing the crime scene, identifying,
locating, documentation and transportation of the evidence, in the real world.
As stated in Section 3.2.1, the live forensic acquisition method will be used to
collect all the potential evidence from the compromised RFID BS of the retail shop.
Hence, the potential evidence data will be identified and acquired from several
different locations such as the services, entities and sub-systems of the Business
System architecture (see Table 2.5 in Section 2.3) of a compromised RFID stock
management system.
Therefore, after the identification of the evidence at the crime scene during the
investigation; the investigator will acquire the log files including reader‟s memory
logs, server transaction logs, volatile and non-volatile artifacts of the SQL Server
data, random access memory (RAM) of POS and the like on the live target operation
73