{'fraction_non_alphanumeric': 0.021199819576003608, 'fraction_numerical': 0.0, 'mean_word_length': 5.043596730245231, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Digital Forensics in small devices: RFID tag investigation

Read/Write Radio Frequency Identification (R/W RFID) chips are commonly used to tag stock in retail shops. The security risk of RFID has been well established in the literature and hence there is potential for fraudulent use of RFID networks in commercial settings. This study proposes the identification of all possible data storage locations in a RFID system, a method for forensic extraction of the data, preservation, analysis and best practice recommendations for digital forensic investigators working on RFID systems. The research shows that it is possible to identify theft from a RFID business system (RIFD BS) after a tag poisoning attack. In order to conduct the proposed research, a trial system was set up in the lab to simulate a commercial retail situation where theft occurred. The normal operation of the trial system was documented as the trusted operation of a stable RFID retail system. The simulation context was the retail environment of clothing and electronic goods, as in such environments Stock Items (SI) could vary in price from a few dollars to tens of thousands of dollars. Hence, the stabilized BS was stressed by using a malicious poisoning attack to change the value of the stock item from the backend SQL Server. Then the entities of BS such as SI, point of sale (POS), business information system (BIS) were investigated in order to locate the potential evidence for the theft of the SI. The methodology used in a simulated environment was based on descriptive methods in which the case scenario of the replicated SQL poisoning attack through a R/W RFID Tag was initiated. To investigate the presence of digital evidence after the theft of a SI, a customized RFID middleware and ReaderLogExtraction tool (to acquire bit-to-bit evidence from RFID reader’s memory) were developed based on Software Development Kit (SDK) of the RFID reader’s manufacturing company. Live forensic investigation was performed by using customized incident response toolkits (Helix_RFID_IR and dcfldd toolkits) and a hardware write-blocker. The descriptive methodology allowed the elaboration of precise details relevant to the research question.