Designing a Forensic Investigation Framework for IoT Monitoring and Modelling

Abstract

Securing a wireless digital scene for IoT based digital investigations has been problematic. Amongst the most pressing issues is the increasingly challenging task of identifying IoT devices. Practical difficulties arise from the rapid introduction, growing variety and likeness to ordinary physical objects of IoT devices. The mostly indistinguishable digital evidence sources are often overlooked during the forensic process of identification. The alternative means of IoT device identification, including from the Device Fingerprinting and Indoor Localisation areas, are lacking for the need of investigators to be able to accomplish the task of identification. To assist the search operations, including for IoT devices, a suitable approach is to reconstruct wireless sensing deployments ahead of the identification task. This, however, will require investigators to harness the communications of IoT devices. This paper apprises the salient features and capabilities desirable for an effective IoT monitoring and modelling system. A model of the envisaged system is light-weight and suited for both forensic and law enforcement purposes. The underlying principles of the contemporary model are three discrete aspects of IoT device communications, namely, monitorability, traceability and discoverability.