Integrated intelligent IOT forensic framework for data acquisition through open-source tools

The study presented in this paper presents the need of an integrated intelligent IoT (Internet of Things) forensic framework. As there is increasing penetration of IoT into everyday life of a common man through smart home, smart city, smart industries etc. Thus, continuous escalation of numbers of IoT devices is generating enormous amount of very sensitive and personal data in various formats. Data, being the most important repository for any business, makes such environment susceptible to more attacks than ever to drain, steal or modify sensitive data. Hence IoT systems become prone to more cyber-attacks than other digital resources spanning a large range of attack vectors. Three important artifacts generated in any IoT environment are: memory, storage, ports used for connectivity, which are used as primary resources of data for digital forensic analysis in this study. These components generate network logs, system logs, registry entries which can be used to find out malicious activities done on the device or through the device. Due to its diversity in terms of manufacturing of IoT devices and architecture of IoT systems, the forensic analysis of artifacts collected from various resources spread across all the layers of IoT ecosystem imposes lot of challenges before investigating team. One such challenge being the need of a unified platform for collection of all artifacts from diverse devices at one place. In this work a study of heterogeneous nature of data obtained from various devices w.r.t to ecosystem of a specific IoT device has been carried out, by analysing the types of data that may be generated by an IoT device and may be forensically useful. A conceptual framework has been proposed to carryout forensic data acquisition and analysis using a unified repository of data collected from an IoT Ecosystem.