Digital Forensics in Small Devices: RFID Tag Investigation

WFT tool and ad-hoc acquisition method) may be involved in the data analysis phase.
However, only the collected data in the range of investigation timeline will be
analyzed and evidence recovered or analysis results will be stored on the forensic
workstation.
Moreover, as stated in Section 3.3.5; the comparison of the hash values before
and after the analysis will also be performed for evidence integrity checking. One of
the critical parts of data analysis is documentation, as Britz (2009) mentioned, which
is very significant in any forensic investigation although computer crime
investigations may not be the same. Hence, all the process of analyzing collected data
and evidence recovered will be documented and those documented analysis events
will later be useful for integrity checking and presenting the evidence related to the
theft of SI in the court. Consequently, the evidence recovered will be used to
reconstruct the timeline when the attack occurs, to determine how the backend server
data is manipulated, and so forth in order to answer the research question mentioned
in Section 3.2.6. Thus, the forensic analysis of digital evidence is an important phase
of digital forensic investigation.
3.3.7 Data Presentation
After analyzing and documenting the evidence related to the theft of SI in a simulated
RFID BS, the evidence recovered will be presenting in the table or diagram formats
as part of the data presentation phase in the forensic investigation.
The data presentation phase will involve the results of analysis of collected
artefacts, the reasons why the tools and procedures are chosen to perform the
investigation, hashing comparison of the evidence files before and after analysis for
evidence reliability and integrity (as stated in Section 3.3.5), and the like.
Furthermore, the correlation of the evidence examined will also be presented in order
to reconstruct the malicious activity to proof the theft of SI. For instance, the table or
diagram of volatile data in relation to the reconstruction of malicious attack and non-
volatile data in relation to the reconstruction of the malicious attack will be presented.
Likewise, the grouping the analysis results of collected artefacts towards the purpose
of investigation will be presented. For example, the contributions of the analysis
results of database users, authentication and authorization settings of non-volatile
77