224
S. Mrdovic
• Privacy: Analysis revealed a lot of personal data on the victim and her husband.
The history of their phone usage, which included messages, application usage,
locations visited, and health data collected from the health devices, among
other information, was available to the investigators. Some of their physical
conversations, the commands they gave to their smart devices, their movement
through the home, and their TV viewing habits were also disclosed. Some data,
such as the victim’s phone messages and Echo-recorded conversations, were
crucial for the investigation, but some, such as the husband’s TV viewing habits,
were not.
• Effort needed: The challenge was open for 3 months. Even after that period,
none of the four teams that submitted solutions could be certain that their
explanation of the events was completely correct. In total 18 highly skilled
professionals worked for 3 months. It was a significant effort and as it was
a murder case a human life was at stake. In real life, it is hard to imagine
having so many experts available for an investigation. In the author’s opinion,
that fact might be the biggest practical problem of IoT forensics. Real forensic
investigations are not like the CSI program we see on TV.
The challenges of how IoT forensics can present findings, as described in
Sect. 13.3.4, are described below for this particular case. The details of the solutions
that the competing teams provided were very technical. They were difficult to
read and understand for non-experts. They were not written for the court, but for
an expert panel. In reality, an additional effort would be needed to prepare the
case presentation in front of a judge and jury. In this case it should have been
possible to explain to the general public the sequence of events established after the
forensic investigation. Technical details need to be kept to a minimum and should
be presented as an appendix to the written report.
This case clearly shows the opportunities that IoT forensics can bring. Without
IoT forensics the main, and probably only, evidence would have come from
eyewitnesses. There might not have been any eyewitnesses, or they could have been
hard to find. The case would have had to rely on memories that might have been
incomplete, unreliable and subject to change.
IoT forensics enabled the collection of more reliable evidence. That evidence
was used to reconstruct the sequence of events that led to the murder. The sensors
provided data on door opening and movement. That data enabled investigators to
establish the presence of a third person. The smart loudspeaker data contained parts
of relevant conversation that confirmed the presence of a third person arguing with
the victim. The victim’s phone data showed unfriendly conversation between the
victim and the coworker she seems to have been having an affair with. That enabled
us to establish the identity of a suspect. Data from the smart TV confirmed that the
husband was watching TV at the time of the attack on his wife.
S. Mrdovic
• Privacy: Analysis revealed a lot of personal data on the victim and her husband.
The history of their phone usage, which included messages, application usage,
locations visited, and health data collected from the health devices, among
other information, was available to the investigators. Some of their physical
conversations, the commands they gave to their smart devices, their movement
through the home, and their TV viewing habits were also disclosed. Some data,
such as the victim’s phone messages and Echo-recorded conversations, were
crucial for the investigation, but some, such as the husband’s TV viewing habits,
were not.
• Effort needed: The challenge was open for 3 months. Even after that period,
none of the four teams that submitted solutions could be certain that their
explanation of the events was completely correct. In total 18 highly skilled
professionals worked for 3 months. It was a significant effort and as it was
a murder case a human life was at stake. In real life, it is hard to imagine
having so many experts available for an investigation. In the author’s opinion,
that fact might be the biggest practical problem of IoT forensics. Real forensic
investigations are not like the CSI program we see on TV.
The challenges of how IoT forensics can present findings, as described in
Sect. 13.3.4, are described below for this particular case. The details of the solutions
that the competing teams provided were very technical. They were difficult to
read and understand for non-experts. They were not written for the court, but for
an expert panel. In reality, an additional effort would be needed to prepare the
case presentation in front of a judge and jury. In this case it should have been
possible to explain to the general public the sequence of events established after the
forensic investigation. Technical details need to be kept to a minimum and should
be presented as an appendix to the written report.
This case clearly shows the opportunities that IoT forensics can bring. Without
IoT forensics the main, and probably only, evidence would have come from
eyewitnesses. There might not have been any eyewitnesses, or they could have been
hard to find. The case would have had to rely on memories that might have been
incomplete, unreliable and subject to change.
IoT forensics enabled the collection of more reliable evidence. That evidence
was used to reconstruct the sequence of events that led to the murder. The sensors
provided data on door opening and movement. That data enabled investigators to
establish the presence of a third person. The smart loudspeaker data contained parts
of relevant conversation that confirmed the presence of a third person arguing with
the victim. The victim’s phone data showed unfriendly conversation between the
victim and the coworker she seems to have been having an affair with. That enabled
us to establish the identity of a suspect. Data from the smart TV confirmed that the
husband was watching TV at the time of the attack on his wife.