13 IoT Forensics
223
Samsung SmartThings hub and an IPTime network switch. Finding all these
devices required effort and knowledge given by the police officers who were
on the scene. In this case they missed the smart power outlet.
• Data extraction/image creation: Getting relevant data from the devices in a
forensically sound manner depends on the type of the device. Creating an image
of a mobile phone can be challenging without credentials. Since a Raspberry
Pi holds all its data on its SD memory card, imaging it is not difficult. IoT
devices like the wristband and the sensors usually do not store any data. Data
they generate can be found on the mobile phones used to control them, in
the cloud of the smart service provider, or in a network traffic dump. Data
collected from the Amazon Echo device can be obtained partly from the device
and partly from the cloud. Access to the cloud data here was possible as the
victim’s husband provided the password. In some other cases, the password
might not be available and cloud data would be more difficult to get. Network
traffic is usually not logged on a permanent basis. In this case it was possible to
obtain a diagnostic report from the OnHub AP/router in Google’s protocol buffer
specification format and a SmartHome network traffic dump for a period of one
relevant hour.
• Encryption: It was not an issue in this case since the credentials for the devices
and the accounts were available. In general, in the case of encrypted data on
devices, or network dumps of encrypted traffic, collection of data in readable
format might be impossible.
• Multiple data locations: Data was saved on multiple locations: devices and
clouds.
• Crime scene preservation: Police arrived at the crime scene a short time after
the relevant event. Data was collected in a timely manner and there was no need
for additional crime scene preservation.
The practical issues of evidence analysis and correlation (Sect. 13.3.3) in this case
are explained next.
• Physical world data expertise: There was no need for expertise on the data
collected from the physical world. All events were simple (opening, closing,
motion, steps) and were easy to interpret. That should be expected in current
home automation, but in an industrial environment or a smart city this would
have been different.
• Amount of data: The total amount of compressed data was over 6 GB. It was
only a small household of two persons and a relatively short period of time. One
can only imagine the data amount expected in a case involving an open space in
a smart city.
• Correlation/time-line: The analyzed data was from six different devices and
locations. For analysis, knowledge was required on how each of the devices and
services, which were sources of data, worked and what the collected data meant.
Significant effort was required to establish how the devices were connected and
how all the data correlated. The time-line was a little easier to establish since all
the devices had working and fairly synchronized clocks.
223
Samsung SmartThings hub and an IPTime network switch. Finding all these
devices required effort and knowledge given by the police officers who were
on the scene. In this case they missed the smart power outlet.
• Data extraction/image creation: Getting relevant data from the devices in a
forensically sound manner depends on the type of the device. Creating an image
of a mobile phone can be challenging without credentials. Since a Raspberry
Pi holds all its data on its SD memory card, imaging it is not difficult. IoT
devices like the wristband and the sensors usually do not store any data. Data
they generate can be found on the mobile phones used to control them, in
the cloud of the smart service provider, or in a network traffic dump. Data
collected from the Amazon Echo device can be obtained partly from the device
and partly from the cloud. Access to the cloud data here was possible as the
victim’s husband provided the password. In some other cases, the password
might not be available and cloud data would be more difficult to get. Network
traffic is usually not logged on a permanent basis. In this case it was possible to
obtain a diagnostic report from the OnHub AP/router in Google’s protocol buffer
specification format and a SmartHome network traffic dump for a period of one
relevant hour.
• Encryption: It was not an issue in this case since the credentials for the devices
and the accounts were available. In general, in the case of encrypted data on
devices, or network dumps of encrypted traffic, collection of data in readable
format might be impossible.
• Multiple data locations: Data was saved on multiple locations: devices and
clouds.
• Crime scene preservation: Police arrived at the crime scene a short time after
the relevant event. Data was collected in a timely manner and there was no need
for additional crime scene preservation.
The practical issues of evidence analysis and correlation (Sect. 13.3.3) in this case
are explained next.
• Physical world data expertise: There was no need for expertise on the data
collected from the physical world. All events were simple (opening, closing,
motion, steps) and were easy to interpret. That should be expected in current
home automation, but in an industrial environment or a smart city this would
have been different.
• Amount of data: The total amount of compressed data was over 6 GB. It was
only a small household of two persons and a relatively short period of time. One
can only imagine the data amount expected in a case involving an open space in
a smart city.
• Correlation/time-line: The analyzed data was from six different devices and
locations. For analysis, knowledge was required on how each of the devices and
services, which were sources of data, worked and what the collected data meant.
Significant effort was required to establish how the devices were connected and
how all the data correlated. The time-line was a little easier to establish since all
the devices had working and fairly synchronized clocks.