Search

The weakness of the security measures implemented on Internet of Things (IoT) devices, added to the sensitivity of the data that they handle, has created an attractive environment for cybercriminals to carry out attacks. This has caused a substantial increase in the number of cyberincidents, requiring the opening of digital investigations in order to shed light on what has occurred. However, the characteristics of this new environment, such as its variety of contexts, make it impossible to use the methodology followed until now in conventional analysis. Therefore, a new common procedure is needed to ensure that IoT examinations are carried out in a complete and efficient manner. In this article, after reviewing the methodological requirements of IoT forensics, and studying the suggestions made by the research community, a methodology to perform investigations in a certain context of the IoT environment is proposed. In addition, its practicality is evaluated in three different security incident scenarios, proving its effectiveness and appropriateness to be used in future cases. [ABSTRACT FROM AUTHOR]

The adaptation of digital forensics solutions to the requirements and characteristics of the Internet of Things (IoT) is an ongoing process which has turn out to be quite demanding due to the novelty of this environment. The differences between the IoT and conventional scenarios in which forensic investigations used to took place, namely the desktop and the smart phone, are too great to be able to address IoT examinations by following a common approach. However, developing brand new solutions does not seem the best approach to follow either, since there are not many IoT-centered tools, and a drastic change might hinder the use of this new proposals in a court of law. Therefore, the development of solutions to ensure that IoT investigations are carried out in a complete and efficient manner might need to be performed by adapting the widely-accepted conventional ones to this new scenario. In this sense, this article proposes a concept methodology for conducting IoT investigations which uses a generic forensic model as a reference. [ABSTRACT FROM AUTHOR]

The increase in the number of cybersecurity incidents in which internet of things (IoT) devices are involved has called for an improvement in the field of computer forensics, which needs to provide techniques in order to perform complete and efficient investigations in this new environment. With the aim of doing so, new devices and systems are being studied in order to offer guidelines for investigators on how to examine them. This papers follows this approach and presents a forensic analysis of the non-volatile memory of Windows 10 IoT Core. It details how the investigation should be performed and highlights the relevant information that can be extracted from storage. In addition, a tool for the automation of the retrieval of the pieces of evidence detected is provided. [ABSTRACT FROM AUTHOR]