Challenges in Digital Forensics for the Internet of Things

Unfortunately, while IoT devices have become increasingly complex, diverse, and sophisticated, the field of digital forensics as applied to IoT devices has yet to catch up in many aspects, and this poses many challenges for investigators and cybersecurity personnel. There is a general lack of forensic tools are compatible with IoT devices, especially newer ones, and there are even fewer that reliably work across a broad range of IoT devices, due in large part to the wide diversity of technologies utilized among the multitude of IoT devices [3,4]. IoT devices often utilize volatile memory, which can limit the timespan within which useful data can be extracted from the device itself [2,3,4]. IoT devices also often use cloud storage to hold their associated data in the long term, which introduces the potential for legal issues such as jurisdictional or regulatory barriers to accessing that data [4]. The volume of data that can be collected by a network of IoT devices or even a single IoT device could be very large, making it potentially difficult and time-consuming to find relevant evidence in that data [3,4]. While standards do exist for digital forensic investigations in general, more still need to be developed, established, and widely agreed upon to cover the increasing range and complexity of such investigations; this is especially the case with regards to IoT devices or the evidence derived from them over the course of an investigation, where they are currently lacking greatly [2,3,4]. Even more concerning, threat actors seeking to utilize IoT devices in their attacks have a slew of anti-forensic techniques and technologies at their disposal to throw off investigators, such as encryption, malware, file tampering, memory manipulation, etc. For example, attackers could potentially hide their data in the volatile memory of an IoT device, making it very difficult if not impossible for investigators to retrieve that data [2,4]. This is by no means an exhaustive list, but a small selection of example issues that digital forensic investigators and cybersecurity personnel will eventually have to address and overcome.