Keywords

1 Introduction

Digital technologies related crimes are pacing up. With the development of new technologies, criminals discover ways to use these techniques to commit offenses. The Internet is constantly transforming itself into certain unique kinds of software and hardware as a groundbreaking development, which means that no one can avoid it [1]. The kind of communication we are witnessing now is either human-device communication or human-human communication. However, the Internet of Things (IoT) has promise to deliver a fantastic future for the Internet as it provides Machine-Machine (M2M) communication [2]. Besides its tremendous benefits for the sector and the Internet of Things (IoT) community, it also presents its customers with countless difficulties. The expanding amount of IoT devices present possibilities and hazards from a forensic view in private settings such as smart homes. At the same moment, current digital forensic instruments and techniques do not support newer IoT devices. It makes it difficult for experts to extract data from them without the help of a forensic consultant with knowledge in this field. Furthermore, these traces may pose difficulties for forensic scientists to evaluate and may contain vulnerabilities that pose hazards to privacy. In this chapter, we examine digital forensics from the IoT perspective. IoT is the use of intelligently coupled devices with the help of an internet system, sensors, actuators in machines, and other physical objects. It makes the smart devices identifiable, intelligent, communicable, and information accessible. The IoT allows individuals and smart devices to be linked anytime, anywhere with anything by using any path or network, as shown in Fig. 1.

Fig. 1.
figure 1

Internet of things connected anytime anywhere with anchor device.

Full size image

IoT framework is a complex network of different systems where, traditionally, countless, sensors and gadgets are associated with one another through interchanges channel and data foundation. IoT has an Radio-frequency identification RFID sensor network concerning the conventional form of networks like wired networks, Wi-Fi networks, cable, and mobile networks. IoT framework offers some benefits included administrations through astute information preparing [3]. The measurable computerized examination has turned out to be more difficult because of the enormous increment in registering gadgets, giving new experiences and difficulties in processing advanced information. The expanding utilization of cloud benefits in everyday tasks by associations and the heightened development and use of savvy gadgets are indicating the new difficulties the advanced legal specialists [4]. The dynamic nature of IoT alternatives introduces the primary challenge in detecting an IoT crime. As discussed in previous studies that, virtualization sterilizes the resources. Therefore, traditional analysis of remaining artifacts could be inadequate for the investigators.

According to a report published by Tillman in 2013, we have more than 5 billion “things” connected to the network. This number is further expected to be increased by nearly 50 billion by 2020 [5]. Taking advantage of RFID and Wireless Sensor Network WSNs, physical objects such as computers, phones, smartphones, wearable technologies, home appliances, vehicles, medical devices, and industrial systems can be easily connected, tracked and managed by a single system [6].

Considering the high usage and complex functioning of the IoT devices, it creates numerous opportunities for cybercriminals, consequently causing a direct influence on consumers. For example, on October 21, 2016, a considerable cyberattack cracked out major websites across the Internet, which included Amazon, Twitter, Netflix, Etsy, Github, and Spotify [7]. Further to this, most IoT technologies are not manufactured with high-security parameters, and there are restricted regulations implemented on the consumer devices for the data collection; the main concern is the safety and security of the data [8]. Because of this scarcity, all security parameters cannot be amalgamated in IoT devices, as there is a requirement of considerable space and process to function for the same, which makes these devices easy prey for cybercriminals [9]. The perpetrators find an easy way to infect such devices so they can use them as tools to attack targeted individuals [10]. For instance, if any cloud computing technology is being used, the data is customarily written on a particular operating system. In such cases, pieces of evidence can be gathered in the form of short-term or temporary internet files, and be stored within the cybernetic atmosphere. This evidence usually lost as soon as the user exits the cloud [11].

Primarily, it is no more a difficult task to find potential evidence related to criminal activity through accessibility to network log, chatting details, emails, and other social networking inputs. Whether it is called IoT or WSN, there has been a lot of studies to secure these networks, starting from the mode level to the network level [12]. The security services provided in IoT include confidentiality, integrity, authentication, access control, anonymity, and availability. However, the major challenge is to accumulate and analyze bulk data correctly and to gather forensic evidence related to the crime, along with detecting the existence of IoT activity (Fig. 2).

Fig. 2.
figure 2

Accessed data log of a Bluetooth embedded door lock controlled through smart phone.

Full size image

Mainly the evidence sources in the case of IoT’s can be divided into three categories:

  1. a.

    Shreds of evidence retrieved from smart devices and sensors;

  2. b.

    Evidence gathered from software and hardware that provides communication between intelligent machines and the outside world (e.g., computers, mobile phones, and firewalls) included in established forensic networks;

  3. c.

    Evidence unruffled outside the network from the investigated hardware and software. This group includes social networks, cloud, mobile system providers and ISPs, virtual online identities, and the internet.

With the increasing prevalence of IoT devices in many real-life applications, there is a need for conducting digital/network forensics to be able to understand the reasons for challenges and various attacks. In this study, we examine different features of IoT forensics and the challenges faced by the investigators due to this advancement in technology and systematically put them for better understanding and future research.

In the Sect. 2 of this chapter, we will give detailed background information with discussion on IoT entities and WSNs as well as Forensics of IoT. In the Sect. 3, we will discuss various approaches to IoT Forensics. The Sect. 4 will give us insight into Digital Forensics followed by IoT vs. Digital Forensics in Sect. 5.

2 Background

2.1 IoT Entities and WSNs

IoT devices usually comprise of specific embedded software, communication network, computing, sensor, and security devices. IoT devices use specially equipped software as essential features, can provide exclusive services based on their designs and purposes. Another critical part is the robust communication networks through which the IoT can communicate anytime and anywhere in the world (Fig. 3). All the devices are then interconnected in the IoT network using computing technologies, such as Edge, Fog, and Roof computing. The interacting mechanisms, with the aid of specific embedded software, sensors, and system supporting components, realize the presence of any physical entity using particular software. These devices gather the information required for the interaction. The Internet performs the role of communication media of various distributed physical entities. Each physical object is provided with a unique identification number. The gathered information from physical devices with the unique identification number will be processed using storage servers on the web and they will be delivered at the desired place in the desired time using different applications [13]. IoT functional safety blocks secure the system by offering multiple features such as authentication, approval, integrity of messages, privacy, content integrity, and data security.

Fig. 3.
figure 3

Basic working structure of an IoT device

Full size image

The background and evolution of IoT lie in the encroachment of the technology on microsensor devices in the late 90 s. These devices include microprocessors, memory technology, and other micro sensing devices, which led to the development of tiny sensors. These small sensors are equipped with communication capabilities that make them intelligent sensing devices to gather, process, and transmit data [14]. The other sensor component that is of interest to forensics would be a communication module. The amount of cyber-offense cases related to IoT has been increasing ever since [15]. The incidents such as ransomware, fraud, malicious attacks, node tempering, phishing, SQL injections and many more have been detected either by depleting the IoT devices or misusing applications and devices to commit a crime [16]. Since these instruments are linked through the networks, it is quite difficult to use static digital forensic tools compared to other computer forensics methods [17]. In addition, due to the constraints of IoT systems and the varying characteristics of digital evidence, adequate handling is needed; therefore, the IoT forensics require real-time inquiry [18]. In the next section, we familiarize with the concepts of Forensics of IoT.

2.2 Forensics of IoT

Forensics of IoT’s is one of the main branches of digital forensics. Therefore, the investigation process must support the IoT infrastructure [19]. IoT has created a multitude of new problems for the field of digital forensics. In IoT-based instances, researchers need to cope with three distinct levels more often: forensic cloud, network, and device level [20]. During the forensic investigations using IoT, the identification of evidence, the collection of potential pieces of evidence, their organization, and their presentation deal with the IoT structures to solve a case of criminal activity. While there are no specified principles for IoT forensics, analysis will depend considerably on the smart device’s mechanical and physical nature, as identifying sources of proof is a significant task. Certain necessary steps usually taken by an investigator during IoT forensics have been shown in Fig. 4. Recently, Servida & Kasey., 2019. have highligten the importance of traces from IoT devices in a smartphone for forensic investigation [21].

Fig. 4.
figure 4

Various steps followed by the cyber investigator during forensic investigation

Full size image

Considering a forensic viewpoint, each IoT device will provide several crucial elements that might be useful during the investigation. Even though IoT has massive sources of evidence, it often poses some difficulties for forensic examiners, including information location and heterogeneity of IoT systems, such as operating system variations and communication protocols [22]. Currently, available researches mainly focus on IoT security and protection. However, few essential components, such as response to incidents and investigative processes, were not effectively covered by scientists. This section therefore focuses on this aspect.

Forensics of IoT is considered as a mixture of three digital parameters including the forensics at the device level, Forensics at the network level and the cloud forensic [19].

  • Device forensics: Most recent IoT gadgets are being produced and progressed to make our lives simpler. These gadgets are worked by various working frameworks and may interface with various system advancements at one time. From the forensic viewpoint, the modern heterogenous gadgets, working framework, and correspondence section may influence the forensic examination. Typically these devices employ processing units, memory, a communication module, and sensing modules, which could be smartphones, smart meters, cameras, wearable devices, drones, etc. The specialist needs to gather information from the restricted memory of the IoT gadgets. At the point when important details should be picked from the IoT gadgets, it comprises of the gadget crime scene investigation [23]. Although it creates a burden on the investigation in terms of long time and increased learning curve, evidence must be collected from these sensing devices. Thus there is a need of standardization at device level investigations for IoT/WSN environments [24].

  • Network forensics: IoT structures comprise of different types of various network systems, for example, Local Area Networks (LAN), Wide Area Networks (WAN), Body Area Network (BAN), Personal Area Network (PAN) and Home Area Networks (HAN). Huge confirmations can be gathered from these systems [23]. For each type there will be customized methods to conduct cyber forensics after an incident. Regardless of which form of network is used, most of the data in networks is volatile, which causes serious issues in forensic investigations. Most of the hardware used in networks record transmitted data itself or some information about the data in logs. These logs are indespensible to the forensic investigators as they may contain information which can eventually be used as evidence. Firewalls capture and record the information about network traffic and keep the logs of events and transmitted data which goes through them while preventing unauthorized access to the systems [24].

  • Cloud forensics: The cloud crime scene investigation is considered as one of the first capacities in the IoT criminology field. Information created from the IoT gadgets and utilizing IoT systems are put away in the cloud criminology. Cloud arrangements have numerous favorable circumstances, including availability, the substantial limit of capacity and on-request openness [24]. Data stored in the cloud raises severe issues in forensic investigations performed in IoT/WSN environment. Authors defines cloud forensics in three dimensions – legal dimension, organizational dimension, and technical dimension [25]. For similar reasons and to provide efficient service availability and reduce the cost of services, major service providers like Google, Amazon, and HP locate their data centers all around the world. Different countries and different states have different jurisdictions. A crime will be treated differently in different jurisdictions. Due to these issues, investigators may have to deal with multi-jurisdiction issues when data from IoT and WSNs are stored in the cloud [24].

3 Approaches in IoT Forensics

IoT legal sciences have been communicated as a real area of computerized criminological concern where the examination procedure must be under the IoT innovation and framework. This is essential for understanding the structure entirely and to explore the occurrence that is identified with IoT. The expedient advancement of this innovation, the IoT scientific must be prepared to confront the new difficulties, particularly in the worry of security and protection. The essential strides in legal examination incorporate the ID, legitimate gathering, conservation, intensive study and investigation of recuperated proves in advanced crime scene investigation. In any case, these procedures must serve for the Internet of Things and its conditions [26]. For example, some of the methods for data extraction are mentioned in Table 1.

Table 1. Data extraction methods [27].
Full size table

In context of IoT, mainly two approaches have been identified by the researchers [28]:

Pre-investigation Phase:

Preparing for the IoT forensic readiness during this phase is the foundation of the investigation. Pre-investigative preparedness is essential to ensure the acquisition and evaluation process. It includes the preparation of the plan of investigation strategy, procedures, standard tools, operational and infrastructural support for the investigation. In addition to this, the scoping is very much required. Scoping is a method to narrow down the possible evidence that helps the investigator to identify, appropriately collect and preserve the evidence accurately. The investigator must be aware of what to obtain, how to determine, and how to protect the evidence (Fig. 5)?

Fig. 5.
figure 5

IoT Forensic planning and overview for the investigators.

Full size image

Real-time Investigation:

The real-time investigation is a spontaneous, automatic and live investigation process on any IoT device. It facilitates the handling of various tools and also the way to deal with them within IoT limitations. The next step will focus on applying a detection mechanism that triggers the main forensic phase to look for any strange activities on the IoT devices. Once it is detected, the Real-Time systems will perform the pre-investigation process to identify, collect and preserve the evidence for further investigation process.

4 Digital Forensics

Digital forensics is described as the discipline of locating, extracting and analyzing information from various interpretation instruments as legal proof in law [29, 30]. In the years following the technological revolution that began around the 1960s, the number of crimes perpetrated using computers has grown significantly.

Digital forensics is utilized differently that mostly depends upon the case scenario, event, organizations, and type of the system used in the crime. However, the primary goal of a digital forensic investigation is to obtain forensically significant evidence that can be used further to determine the activity or mode of operation in the case under investigation [27]. The NSIT guide recommends four phases of the digital forensics approach, i.e. collection, examination, analysis, and reporting of the evidence [29]. In IoT/WSN context, the digital forensics approach with a different set of processes as explained in Table 2.

Table 2. Digital forensics IoT specific steps [27].
Full size table

The main objective of Digital forensics (DF) is usually to obtain as much as evidence from electronic devices or media with the use of various forensic techniques and tools that are admissible in the court of law. The very nature of digital evidence means it is sensitive and can be altered, damaged, or destroyed if it is handled or examined inappropriately. Indeed, examining a copy of the initial proof is best practice. Such initial proof should be acquired in a manner that protects and maintains the integrity of the proof [31]. There are number of methods use to collect the data and transfer to the forensic workstation. Commercially accessible software like EnCase and FTK (forensic toolkit from accessdata.com) along with other open source instruments are the most widely used techniques for information collection. DF operates on gathering two data types. The persistent data stored on a local hard drive and the data stored when the computer is switched off are preserved. When the computer or device is switched off, volatile data stored in memory will be lost. Volatile data resides in the system’s registries, cache, and RAM. Forensic investigation usually consists of three processes, i.e., using Live Acquisition Tools, Imaging Tools, and Analysis Tools. With the aid of EnCase, a live image of the data is created that can be used further for forensic investigations. EnCase usually supports all types of operating systems. The MD5 database is used to crack the encrypted files with a password.

5 IoT Vs. Digital Forensics

The Digital Forensics discipline deals with identifying, collecting, analyzing and presenting digital evidence from multiple types of digital/electronic storage media in an incident involving litigation/cybercrime or data security. Digital forensics utilizes the concept of electronic discovery of evidence which includes the processes of gathering the data from electronic documents and to prepare that data in an admissible form for the presentation in a court room in any given case [32]. Digital evidence is very delicate in forensic investigation. Numerous researches in the area of digital forensic investigation process have been made those usually focused on studying the different phases in an investigation. These phases include the pre-investigation phase, the investigation phase and the post-investigation phase [33]. Inappropriate preservation and examination of any evidence can alter or destroy it [34].

In IoT forensics, device interactions and users produce information of enormous forensic value in a smart environment. It is accomplished with the help of several sensors, objects, and intelligent nodes that are capable of communicating among each other with human intervention or in the absence of any human intervention [35]. Digital forensics are no longer restricted to storage systems such as USB drives, pcs, smartphones, etc. with IoT evolution. The data is often used for forensic reasons from instruments such as sensors, IT clouds, and the smartwatch. There are many differences and similarities between digital and IoT forensics from the characteristics of IoT and digital forensic processes. Concerning the evidence sources, digital evidence can be computers, mobile devices, hard drives, network, whereas, in IoT forensics, the evidence can be sensors on buildings or cars, home appliances, humans or animal implantations, or in other IoT incorporated devices. The evidence data can be in any possible format in IoT forensics; however, in digital forensics, these will be electronic documents or standard file formats. The differences between IoT forensics and Digital Forensics mainly lies in the steps involved in the investigation from identification until the presentation of data, as mentioned in Table 3.

Table 3. Different steps involved in the investigation process in digital and IoT forensics.
Full size table

6 Conclusion

Internet has showed its vital presence in human lives, from connections at a virtual level to the public associations. Researchers have used a AI techniques i.e. Knowledge based system for design of deep drawing dies for manufacturing of components for various industrial applications [36]. Firstly, the Internet of Things has added a new prospective into the world of internet by establishing communications between smart objects and the humans. This communication has created the vision of ‘‘anytime, anyway, anywhere, anything” interactions [37, 38]. There is no doubt that the IoT will provide a more physical world evidences than standard computer systems [39]. Consequently, the large amount of evidence generated by a huge quantity of IoT devices will cause scientists extra difficulties in gathering appropriate proof from individually distributed IoT infrastructures. Newer methods are needed to rationalize information and determine what can be inferred from big data sets, as well as methods to explore instances where there are alleged “aggregation offenses.” IoT Forensics has implemented the digital forensics techniques in the IoT infrastructure. In this artefact, we attempted to explain the entities, different approaches of IoT forensics and to identify the various challenges of reliable forensic sources in the IoT. Deciphering all the challenges of IoT forensics appropriately can help in the identification of many new insights in forensic investigations. Moreover, to acquire forensic information and then analyze the information quickly, a combination of network forensics instruments and computer forensics instruments is needed. Traditional forensic tools can be used to collect active information while maintaining the integrity of such information as well [40]. In the IoT evidence procurement phase, there are significant issues and challenges – the first phase of IoT forensics. Unless resolved in a timely way, these problems and difficulties can lead to incomplete or inaccurate forensic inquiry of IoT offenses, which can offer criminals a advantage as they can readily escape due to absence of evidence or false positive/negative evidence. We realized that digital forensic tools presently available can be used in the entire IoT process to some part and at certain phases, But a general and efficient IoT justice model or process is still needed to assist scientists overcome the challenges.