IoT forensics
This section provides a more detailed treatment of IoT forensics, a crucial element of post-incident analysis activities. Forensics in the IoT poses a variety of unique challenges, but ubiquitous spread of IoT devices also introduces new forensics opportunities.
We will therefore discuss two facets of IoT forensics:
- Forensics of an IoT device that may been compromised (as part of an incident)
- Forensics in which the IoT devices are ancillary to the event, but useful in resolving questions surrounding it
Post-incident device forensics
As part of an investigation process, system-level investigation may lead you to one or more devices (for example, sensor, actuator, gateway, or other server), and therefore a thorough forensic examination of the compromised device is in order to try to determine the characteristics of the attacker.
You may find specific files loaded or modified by the attacker, or in some cases it may be possible to lift fingerprints from the device itself. Device analysis...
