Digital Investigation of IoT Devices in the Criminal Scene

François Bouchaud (1, 2) , Gilles Grimaud (3, 4, 5) , Thomas Vantroys (4, 3, 5) , Pierrick Buret (2)

1 IRCGN - Institut de Recherche Criminelle de la Gendarmerie Nationale (IRCGN)
2 PJGN - Pôle judiciaire de la gendarmerie nationale
3 CRIStAL - Centre de Recherche en Informatique, Signal et Automatique de Lille - UMR 9189
4 IRCICA - Institut de Recherche sur les Composants logiciels et matériels pour l'Information et la Communication Avancé - UAR 3380
5 2XS - Extra Small Extra Safe

The Internet of Things (IoT) is everywhere around us. Smart communicating objects are offering the digitalization of lives. They create new opportunities within criminal investigations. In recent years, the scientific community sought to develop a common digital framework and methodology adapted to IoT-based infrastructure. However, the difficulty in exploiting the IoT lies in the heterogeneous nature of the devices, the lack of standards and the complex architecture. Although digital forensics are considered and adopted in IoT investigations, this work only focuses on the collection. The identification phase is quite unexplored. It addresses the challenges of locating hidden devices and finding the best evidence to be collected. The matter of facts is the traditional method of digital forensics does not fully fit the IoT environment. Furthermore, the investigator can no longer consider a connected object as a single device, but as an interconnected whole one, anchored in a cross-disciplinary environment. This paper presents the methodology for identifying and classifying connected objects in search of the best evidence to be collected. It offers techniques for detecting and locating the appropriate equipment. Based on frequency mapping and interactions, it transfers the concept of "fingerprinting" into the field of crime scene. It focuses on the technical and data criteria to successfully select the relevant IoT devices. It gives a general classification as well as the limits of such an approach. It shows the collection of digital evidence by focusing on pertinent information from the Internet of Things.

Mots clés: Internet of Things; Digital Forensics Model; IoT Forensics; IoT Investigations; Evidence acquisition

Domaines: Systèmes embarqués

François Bouchaud, Gilles Grimaud, Thomas Vantroys, Pierrick Buret. Digital Investigation of IoT Devices in the Criminal Scene. Journal of Universal Computer Science, 2019, 25 (9), pp.1199-1218. ⟨hal-02432740⟩