Forensic analysis of IoT ecosystem

Connected toys, home automation appliances and wearable devices are all part of the Internet of Things (IoT), They digitize our lives and generate massive data transfer. This phenomenon brings many opportunities for police investigations, with a rich source of evidence11In this paper, the term ‘evidence’ must be understood in legal and forensic sense., information that is often unexplored and not valued. The proliferation of connected devices has given rise to IoT Forensic. It deals with IoT-related cyber-crime. It includes both local and external investigations. It is therefore a much more complex, multidimensional, and multidisciplinary approach than traditional forensics. Data can be scattered throughout the infrastructure, depending on its management policy (synchronization and storage). They become meaningful when they are contextualized and cross-referenced. This article focus on the process of exploiting data from connected devices at a crime scene and on reconstructing the timeline of a criminal event. We use a scenario based on real facts to illustrate the process of IoT investigation. Based on discovered data and objects, we reconstruct the chronology of criminal events.