Understanding the Meaning and Purpose of IoT Forensics

Cybercrime is a serious threat to any organization, with data breach costs reaching over USD 4 million on average (Mack, 2021). Companies today face many potential cyber risks each year, and the results can be catastrophic.

Since Internet of Things (IoT) devices often face attacks as soon as 5 minutes after connecting, they can present a severe vulnerability (Jovanović, 2022). The number of devices connected to the internet has skyrocketed and now includes many medical devices, smart home components, and even e-cigarettes.

With the increase in IoT devices, IoT-related cyberattacks have also grown, giving rise to the field of IoT forensics. What does digital forensics mean in the IoT context, and what is its purpose?

What Is IoT Forensics?

IoT forensics is the practice of analyzing IoT devices to investigate crimes. Organizations or law enforcement may hire experts to gather and preserve data when investigating whether hackers used internet-connected devices to commit cybercrimes or examining the source of a security breach.

In some instances, breaches occur due to malicious intent. In other cases, they may result from human error—for example, if an employee shares sensitive information due to a phishing attack. The employee may have had no intention to steal data or harm the company, yet the results of sharing that data accidentally can be just as catastrophic. These phishing attacks cause nearly nine out of 10 data breaches (Cisco Umbrella, 2021).

Cyber forensics can help determine the exact intent and extent of a breach and much more. Typical IoT-related cyberthreats may include:

◉ Malware, including ransomware

◉ Botnets and Distributed Denial-of-Service (DDoS) attacks

◉ Data theft

IoT forensics does not just involve the investigation of cybercrimes. Even on-site crimes like burglaries may produce data on various devices that can assist in an investigation. However, the investigation process will vary depending on whether the device is smart or not, which brings us to the difference between IoT forensics and digital forensics.

IoT Forensics vs. Digital Forensics

In short, digital forensics is any forensic investigation dealing with digital evidence, while IoT forensics is a more specialized branch of digital forensics focused on devices connected to the internet.

Connection to the internet provides unfortunate opportunities for data corruption or misplacement, but it also ensures that most data is readily available for legal review by an expert. IoT forensics experts use various methods to find digital evidence.

Extracting Data from IoT Devices

IoT forensics relies on sensors placed in various devices, such as smart kitchen appliances or wearables like fitness trackers. These sensors collect data that the device then transfers to the cloud, where it can be stored, analyzed, or otherwise made available to intended recipients (Joseph, 2021). This is where cloud forensics and IoT forensics intersect: the retrieval of data that has been transferred from IoT devices to the cloud.

Since data travels through various networks and multiple sources, there can be considerable differences in the methods used for locating crucial digital evidence. Any computer forensics investigation must include provisions for multiple standards and data formats.

Challenges in IoT Forensics

Some data is heavily encrypted, and in some cases, decryption may be highly problematic—for example, if the decryption token has been lost or corrupted or if the encryption method is unusual or error prone. Often, data suffers from corruption during transfer or as vendors store it over extended periods.

Thankfully, many companies have policies for preserving data throughout a specific period. However, providers also typically protect data from access except when someone can prove a legal right to access the data. This means that data forensics may require legal action and many special permissions that can be difficult to obtain, depending on the individual policy of the storage provider.

In summary, the challenges facing cyber forensics investigations of IoT devices include:

◉ Lack of data standardization across vendors

◉ Difficulty in decryption

◉ Data corruption

◉ Restrictions related to data protection and privacy laws

Locating Data Traces

Maintaining data quality in evidence is essential for IoT forensics (Gómez et al., 2021). Extracting data involves working around the challenges of following a digital “footprint” through the various data collection and storage stages. This can be complex depending on the quality of the data.

IoT forensics experts have developed various automated methods to simplify the investigation process and make it more effective, resulting in clean, parsed, and structured data that can be used for investigative purposes.

1. Data Traces on Devices

This usually begins with uncovering information within the device itself, such as a smartphone. Unfortunately, many devices only store data for a short time. While most data leaves “traces” behind, these could be fragile and easily corrupted.

2. Data Traces in Networks

Networks used to transfer data may also maintain traces for a specific time. Again, these data traces are fragile and may disappear quickly. Moreover, different networks and processes will use varied encryption methods, creating additional hurdles.

3. Data Traces in the Cloud

Any data transferred from IoT devices that is then stored in or moved within the cloud will leave digital traces behind. Cloud service vendors and ethical hackers can often aid in cyber forensics by preserving and recovering such relics. Of course, they do so only when the recipient has the legal authority to make such a request.

Source: eccouncil.org