Digital Forensics in Small Devices: RFID Tag Investigation

Software‟s EnCase Forensics Training (Version 6.16.1) software on the forensic test-
station. By doing so, the integrity of the original evidence will not be compromised
due to the residual data from the flash drive. Hence the preservation of the artefacts
will be maintained during the data collection phase.
Figure 3.12: An Example of Using the Trusted md5deep Hashing Algorithm for
3.3.5 Data Processing
Preservation
After the collection of potential evidence data from the entities of compromised RFID
BS, the investigator has to transport and stored the acquired evidence in a secured
location in order to maintain the integrity, reliability, and creditability (Ieong, 2006;
Zhang & Lin, 2010).
Similarly, as part of the data processing; all the acquired data (Section 3.3.4)
will be copied in a forensically sound manner by using the hardware write blocker
(Tableau Forensic USB Bridge) that will be attached to the forensic workstation in
order to preserve the integrity of the collected evidence data during the forensic
investigation. In fact, the investigator will only use a forensic copy of the acquired
digital evidence during analysis phase of the investigation. Only the way in which
performing analysis on a forensic copy of acquired digital evidence data can maintain
the integrity and security of the evidence.
Furthermore, the format conversion of the original collected evidence files will be
done if required. For instance, as stated in Section 3.1.4; the transaction log files and
75