Digital Forensics in Small Devices: RFID Tag Investigation

other collected evidence data by using WFT (Fowler, 2007, 2009) will be imported to
Microsoft Excel on the forensic workstation using the same code page acquired from
the target compromised SQL Server. Likewise, the value conversions of hexadecimal
to decimal from Rowlog0 (on disk value prior to transaction) and Rowlog1
(committed transaction value) of the transaction log will be performed if necessary
during the analysis of the collected data (Section 3.1.4). However, only target
columns relevant to the investigation will be examined as there are more than 100
columns in a SQL Server 2005 transaction log (Fowler, 2007).
Then, the MD5 hash values of all the collected artefacts before and after
analysis will have to be compared to check the integrity of the evidence in order to
confirm there is no alternation on the digital evidence during the analysis phase
(Vacca, 2005). Hence, the evidence can be reliable, repeatable and acceptable to the
court of law (Britz, 2009; Jone et al., 2006b).
3.3.6 Data Analysis
The forensic data analysis phase of the research will mainly focus on each artifact
extracted from the three entities of the simulated RFID based BS (see Figure 3.10 in
Section 3.3).
Reith, Carr and Gunsch (2002, pp. 6-7) stated the data analysis phase is to
“determine significance, reconstruct fragments of data and draw conclusions based
on evidence found”. As a result, in the data analysis phase of the research; all the
forensic copies of the collected evidence copies (Section 3.3.5) will be combined and
analyzed on the forensic workstation by using different analysis techniques and
forensic tools. For instance, the analysis of collected volatile memory artefacts of
POS/Server and RFID reader will be performed by using EnCase forensic software in
order to extract the valid evidence. Likewise, as stated in Section 3.1.3, the collected
data concerned with volatile and non-volatile backend SQL Server data will also be
analyzed in order to find the notable events irregular database activities and other
potential evidence to proof the theft of SI. Then, the important evidence will be
extracted and included into the timeline of investigation (Fowler, 2009). In addition
to using commercial forensic tool like EnCase, the manual search of the notable
evidence on collected artifact (example: the SQL Server artifact collected by using
76