The need for Internet of Things digital forensic black‐boxes

Abstract

In our interconnected cyber-physical world, the types and number of Internet of Things (IoT) will also increase. Such devices are also generally capable of capturing a broad range of information, including digital artifacts that can facilitate a digital investigation during a cyber security incident (e.g., data breach). In other words, IoT devices are potential evidence acquisition sources. We posit the importance of having a digital forensic black-box, conceptually similar to the cockpit voice recorder (also known as a flight recorder) on aircrafts, to facilitate digital investigations. Using a smart home comprising many different IoT devices (e.g., smart home devices, smart vehicles, and smart wearables) as an example, we discuss where such a black-box can reside and what sort of artifacts can be collected. This black-box can also complement other existing digital forensic readiness strategies, such as those described in ISO/IEC 27043:2015. We also explore the associated design requirements such as data provenance. There are changes required to the organization's current computing architecture in order to deploy our proposed black-box, as explained in this paper. In addition, we will explore the potential privacy implications and potential research opportunities (e.g., blockchain-based digital forensic black-box).

Forensic Analysis of IoT File Systems for Linux-Compatible Platforms

“…In addition, other studies investigated various devices to which IoT technology can be applied and analyzed the problems facing IoT forensics. Through this, it was possible to identify devices to which IoT forensics can apply and to gauge the direction in which forensics technology should go [16,17].…”