The need for Internet of Things digital forensic black‐boxes.

In our interconnected cyber‐physical world, the types and number of Internet of Things (IoT) will also increase. Such devices are also generally capable of capturing a broad range of information, including digital artifacts that can facilitate a digital investigation during a cyber security incident (e.g., data breach). In other words, IoT devices are potential evidence acquisition sources. We posit the importance of having a digital forensic black‐box, conceptually similar to the cockpit voice recorder (also known as a flight recorder) on aircrafts, to facilitate digital investigations. Using a smart home comprising many different IoT devices (e.g., smart home devices, smart vehicles, and smart wearables) as an example, we discuss where such a black‐box can reside and what sort of artifacts can be collected. This black‐box can also complement other existing digital forensic readiness strategies, such as those described in ISO/IEC 27043:2015. We also explore the associated design requirements such as data provenance. There are changes required to the organization's current computing architecture in order to deploy our proposed black‐box, as explained in this paper. In addition, we will explore the potential privacy implications and potential research opportunities (e.g., blockchain‐based digital forensic black‐box). This article is categorized under:Digital and Multimedia Science > Cloud ForensicsDigital and Multimedia Science > IoT Forensics [ABSTRACT FROM AUTHOR]