Digital Forensics Reports: Analysis of IoT and Mobile Device Cases

This document comprises three distinct reports delving into the realm of digital forensics, specifically focusing on the challenges and advancements in investigating IoT and mobile devices. The first report examines the application of digital forensics in IoT and Wireless Sensor Networks (WSN), addressing the increasing security concerns and data processing complexities. It proposes a framework to reduce the data processing scope for forensic investigators by utilizing data selection algorithms. The second report introduces IoTDots, a digital forensic framework designed for IoT smart environments, emphasizing the limitations of current cloud-based architectures and advocating for an integrated approach to data recovery from core data sources. The final report concentrates on digital forensics in mobile devices, analyzing current and past trends, particularly in the context of Bring Your Own Device (BYOD) scenarios. It highlights the importance of mobile forensics (MF) and proposes a framework encompassing data acquisition, malware analysis, evidence reconstruction, and behavioral analysis to enhance investigation efficiency. All three reports underscore the need for improved security frameworks and automated data selection processes to streamline forensic investigations and ensure the admissibility of evidence in legal proceedings. Future work includes the automation of data selection and practical exploration of integrating proposed frameworks into smart environments.

1
[Title Here, up to 12 Words, on One to Two Lines]
[Author Name(s), First M. Last, Omit Titles and Degrees]
[Institutional Affiliation(s)]
Author Note
[Include any grant/funding information and a complete correspondence address.]

2
Digital Forensics in IoT
Introduction
IoT and WSN(Wireless Sensor Networks) have increased in their use cases from the traditional
military usage to more commercial uses. Some IoT devices have been adopted for monitoring of
the environment especially health, agriculture, and other applications. In a typical WSN sensor
are deployed act as gateways for application data processing capabilities. Much interest has been
drawn to the security issues within the IoT world since they have been reported misusing by
adversaries with little ability to have the offenders comprehended. The amount of data being
processed by the IoT devices is enormous thanks to the advancement in technology. This has
been a challenge for digital forensic experts who find it difficult to have the forensic
investigators uses the available tools to process data from IoT devices. This research paper
attempts to provide a framework that can be utilized to have the investigators reduce the amount
of data processing scope by narrowing down to the critical data segments.
background
The evolution of the IoT world is due to the increasing advancements in the microsensors used to
drive the IoT world. To be more specific, the advancement in micro memory, microprocessors,
and micro-sensing technology have made it possible to have numerous IoT devices. The IoT era
has changed the needs to have security improved on these devices. This lack of proper security

3
has led to several reported attacks on the IoT devices and ironically, the digital forensic experts
have been unable to recover the identity of the attackers in most of these instances. This has led
to the researcher coming up with a framework that can be used to aid the investigator's recovered
data from these IoT objects of cyber attacks. Despite numerous attempts, no particular study has
overcome the enormous need to process the data for digital forensic purposes.
This paper proposes a model that can be adapted to efficiently reduce the enormous data to be
processed by use of selective algorithms to have critical data to be analyzed by the investigators.
Methodology
The research paper followed the quantitative research design where the current algorithms were
analyzed in terms of performance and each model was quantitatively analyzed using statistical
methods to have a better understanding on how the investigators have trouble using some of this
tools (Birkel & Hartmann, 2019). This followed the design of the proposed model which undergo
several tests and each test was used as a benchmark against the performance of the current tool in
the given environment. The results were analyzed by the statistical methods and presented to
have a clear performance outlook of the proposed model. The result clearly shows the model
performance relatively efficient due to the use of data selection algorithm which reduces the
scope of data uses in the forensic investigation (Nieto, Rios, & Lopez, 2018)
Conclusion
In conclusion, it is seen that despite the increasing developments in the prior technology which
has led to the advent of IoT devices, the security frameworks behind this technology are still at
the infancy stage and this has led to several lawsuits involving security violations by this IoT
devices. Forensic experts have problems recovering data from these devices due to the enormous

4
data being processed by these sensors hence making it inefficient to reliable rely on the outcome
hence not easily admissible in lawsuits. The research has proposed a better model that can
leverage on the data selection algorithm which reduces the scope of data to be processed by the
forensic tools increasing efficiency exponentially
Future works
Future enhancement onto the work included the automation of the selection processed of the IoT
devices. This provides a more efficient approach to improving the working of the algorithm

5
[Title Here, up to 12 Words, on One to Two Lines]
[Author Name(s), First M. Last, Omit Titles and Degrees]
[Institutional Affiliation(s)]
Author Note
[Include any grant/funding information and a complete correspondence address.]

6
Digital Forensics in IoT
Introduction
IoT technology has quickly experienced advancement due to the continued networking of
Internet-enabled devices. The devices interact with each using microsensors on a daily basis,
creating the concept of smart environments. These environments have improved the quality of
life of the different individuals who handle these new data sets.
Despite these enormous advantages that come with the IoT devices, the solutions do does not
have solid means to enable forensic analysis. There is the limitation of resources needed and the
current cloud-based IoT architecture has made it very challenging to have data stored on these
IoT devices for purposes of forensic analysis.
This paper introduces IoTDots, which is a unique digital forensic framework design purposefully
for the IoT smart environments
background
The advent of micro memory, microprocessor, and microsensors saw the birth of IoT devices
which has revolutionized the smart office and smart homes environments. This is due to the
increasing interconnection of the devices which communicate with each other using

7
microsensors. The IoT devices being able to connect to the Internet, on daily basis processes a lot
of data due to their usage on providing physical environment data.
Security issues with regards to the IoT have been discussed on major conferences and discourses.
The security concerns have led to researches proposing frameworks that can be used to provide
digital forensic capabilities on the IoT devices. Despite the general success on this front, none
has been able to come up with an integrated approach to ensure all the data recovery components
of investigation is achieved. This has led to an incomplete forensic investigation by the experts.
This paper has proposed an integrated approach to introducing digital forensic capabilities into
the IoTs by targeting the core data sources of these devices. This datasets when recovered by the
framework, can be utilized in a digital forensic case.
Methodology
The research focused on providing a basic understanding of current system via the literature
review which has provided the background information needed to understand the theoretical
frameworks used in the digital forensics of smart environments which have been overpopulated
by IoT devices. The statistical analysis of the performance of the current methods analyzed and
its current state reported by the research. It shows clear weakness in the way digital forensics is
done. The current systems lack a build in IoT enabled forensic framework that can be sued by the
investigators to have admissible evidence into the court's system.
The proposed framework has provided data that when analyzed by the quantitative means shows
a rather more improve data extraction capabilities from the smart environments. This makes it
more robust model to be adapted to provide digital forensic capabilities for investigators on IoT

8
Conclusion
From the paper, it clear IoT devices that make up the smart environment and smart offices can be
to a great extent behave faced issues with the security challenges that have rocked the
environment. Digital forensics has been researched and their utilization into the smart offices
have been done. The current approaches have provided standalone solutions which have been
working in silos to provide the investigator with the information needed. The proposed solution
has encompassed this solution and given a more integrated approach to solving the given
frameworks. This will however still need more research done on it on making the whole process
more automated and proactive
Future Works
The future works includes more practical exploration of integrating the smart offices with the
proposed IoT framework which shall ensure the smart offices have capabilities to offer forensic
investigation capacities incase of security breaches.

9
[Title Here, up to 12 Words, on One to Two Lines]
[Author Name(s), First M. Last, Omit Titles and Degrees]
[Institutional Affiliation(s)]
Author Note
[Include any grant/funding information and a complete correspondence address.]

10
Digital Forensics in Mobile Devices
Introduction
The digital forensic discipline was created due to increased criminal activities involving
electronic devices. The discipline is mainly concerned with the collection of evidence,
investigation and the final presentation of the evidence which is admissible in courtrooms. A
subset, mobile forensic has been established to undertake a forensic investigation on mobile-
based devices. The mobile devices have varying constraints which make the investigators have a
compromise between processing powers and portability. The MF is developed under the premise
that mobile devices have massive information about individuals both personal and professional
life. This paper analyses the current and past trends in the MF with the aim of providing future
enhancements. The first section of the paper deals with basic background information on MF.
The second section is concerned with the methodology used in the research design t get and
analyze the data. finally, the conclusion parts give the summary of findings giving future
enhancement recommendations.
background
The mobile devices usage on the digital realm has surpassed that of desktop due to massive data
processing capabilities of the new smartphones and other mobile devices. The cloud environment

11
digital forensic and the mobile forensic has been a hot topic in the recent year as more research is
been conducted to unveil the underlying technologies behind the two technologies and how
forensics can be applied to the two (Sangho Park, Yanghoon Kim, Gwangmin Park, Onechul Na,
& Hangbae Chang, 2018). The researcher has come to terms that the two technologies can not be
used with the same approach when conducting a forensic investigation, giving birth to the new
MF field. The advent of BYOD has brought with advantages and disadvantages. The employee
own devices pose serious security risks and they can be used by rogue employees to steal critical
information assets of the company. The company lack control of these devices hence has a little
legal option. This is where the proposed MF technique will be used to investigate such
occurrences (Petraityte, Dehghantanha, & Epiphaniou, 2017)
Methodology
The research design followed the following methodology to have the MF framework in place.
The key steps include,
Acquisition of the file and checking data integrity
Identify any malicious actions through malware analysis
Reconstruction of evidence and presentation of the same
Parsing of evidence
Representation of knowledge
Automation of the classification and analysis of mobile user behavior

12
The above-mentioned framework shall provide the investigator with the advanced options when
it comes to MF as it encompasses all the key requirement an investigator must undertake to have
a solid digital forensic case admission in a court of law
Digital Forensics in Mobile Devices
Conclusion
The research paper looked into the mobile devices unique characteristics in the field of MF. The
research was particularly focused on the bring your own device technique used by companies to
cut cost and have users use their own device for computation. This approach is risky nonetheless
hence the paper has provided a binding approach that shall allow the investigators to have a
better approach to finding the missing pieces by following the proposed framework in the
methodology section. The automation of this system is a critical future enhancement to ensure
efficiency and effectiveness of the framework
Future Works
Theirs is still need to have more research on the current security threats when it comes to digital
forensics in the mobile realm. The more concern is with regard to the privacy issues which may
arise with the usage of the digital forensics in the mobile devices

13
[Title Here, up to 12 Words, on One to Two Lines]
[Author Name(s), First M. Last, Omit Titles and Degrees]
[Institutional Affiliation(s)]
Author Note
[Include any grant/funding information and a complete correspondence address.]

14
Digital Forensics in Mobile Devices
Introduction
This research paper provided a deep dive into the various mobile devices that many forensic
experts have issues gathering forensic data to from such mobo devices due to the lack of tools to
ensure the forensic data is effectively recovered. This paper focuses on the challenges faced by
experts as they use the available tools to gather the necessary information from this mobo
devices. The various challenges shall be critically analyzed and proposed solution given in the
research in the methodology section.
background
Numerous electronic devices are categorized into mobo devices. The mobile device includes
smartphones such as Apple iPhones, PDA and various smartphones that have flooded the market.
The laptops and tablets fall in this category of mobile devices as their use is not localized to a
given location. The storage of this mobo devices has been on the rise exponentially giving a key
target for criminals to use to steal company information. This has drawn the attention of forensic
experts. Currently, the mobo devices are used to store company data of personal and corporate
data making it extremely difficult for forensic experts to have better access to the personal phone
which may not be within the jurisdiction of the company. The current tools have been more

15
focused on cloud forensic and traditional forensic methods. The mobo devices area has been grey
but a recent study has shown a more inclination towards the same.
Methodology
The research used the use of open source tools available in the community. The UFED has been
specifically recommended for the standalone mobile forensic investigation since it supports most
of the available mobo devices such as the USB, Bluetooth, and other serial connections. The
research has gone further to recommend the use of Cellbrite for the forensic investigators since it
is ideal for data extraction from the mobo devices such as iPhones and other smartphones
making it have the best use cases. The research used the COTS tool for acquisition and analysis
of data tools for examining cellphone data using the GPS coordinates. This can be done using
data dumps of the deleted files hence it is key for the data recovery phase of the forensic
investigation. This tools were used by the research and exhibited the best performance as it is
was able to get the deleted files from the mobile devices. From the research, the various
methodology proposed worked swiftly to have better tools for forensic experts to use in doing
their investigations.
Conclusion
This research paper introduced the growing need of mobile device forensic tools due to the
overwhelming data storage and processing capabilities of the mobile devices making them both a
subject and object of forensic investigations. This prompted the researchers to proposes some
tools and frameworks that the forensic experts can use to ensure the data are safely recovered
during investigation and capability of using different phone models to conduct the investigation
using the same tool. The research concluded that despite the current open source tools being in

16
the market, further studies should be done to come up with more robust tools that can efficiently
handle the mobile forensics.
Future works
The future works includes More tools to be developed by Improving the open source tools. Chain
of Custody automation in Mobo devices shall increase the efficiency of the systems

17
[Title Here, up to 12 Words, on One to Two Lines]
[Author Name(s), First M. Last, Omit Titles and Degrees]
[Institutional Affiliation(s)]
Author Note
[Include any grant/funding information and a complete correspondence address.]

18
Digital Forensics in Networking
Introduction
IM and other network-based tools are on the rise in the recent past. This is due to the advent and
widespread usage of social media in recent years. This paper provides an advanced discussion on
the research done so far with regards to challenges the various digital forensics experts face in
using the data from these network-based services to recover evidence. The review of literature
shall provide basic background on the current theoretical and practical concepts developed to
find a better mechanism to provide digital forensic expertise in the network-based services such
as IM
background
Recent statistics were done on the steady growth of huge fraudulent activities on the www and
internet as a whole. These activities have affected the growth of network-based services such as
e-commerce as more users become less acceptable to the network-based services. Despite this
worrying trend, many researchers have proposed great solutions that can be used to solve this sad
state of affairs (Scanlon & Kechadi, 2014). Theoretical and practical frameworks have been
developed to measure trust levels in the world of not trusting. Furthermore, conceptual

19
frameworks have been proposed by some scholars to gauge the level of trust in risky internet-
based services in terms of increasing fraudulent activities.
The current digital forensic tools have beenfocused on a single protocol to provide means to
collect artifacts and objects for forensic investigation, none so far has proposed a multiple
protocol approach to the same. This paper has made efforts to have a framework that can use
multiple protocols to reconstruct conversation on the internet and network based services by
checking vital resources such as logs, RAM, and other file used by this network-based services
(Chu, Yang, Hsu, & Park, 2014)
Methodology
To achieve the objective, the paper established steps and scenario where the investigator would
use the multiple protocol approach to have the best desirable results. The steps include the
following scenario
The suspected object is in constant communication with the network-based applications
The four protocols used include AIM, Google Talk, Yahoo Messanger which have been
configured with different IM rules
The research then discovered different session and the conversations which have been performed
and the various correspondences made
All the discoveries of the com are normally stored in hard drives, RAM swaps.
The data got is analyzed, after extraction, decrypted and given deep analysis to
discovernormalized in the digital footprints of the communication.

20
Conclusion
In this paper, a framework which enables the digital forensic experts uses multiple protocol suits
to provide a digital forensic investigation have been proposed. The investigative framework has
the scope to identify, examine, and output critical information. The framework allows the
forensic expert to discover large data sets since it gets data from hard drive, RAM swaps which
have proven to be a critical source of information for digital forensic experts trying to get trust in
communication between network-based applications. The study suggests automation be
developed for large data set discoveries to make the framework effective and efficient
Future Works
The research optimized improvement on the automation of data extraction and the Inclusion of
multiple network protocols to be included in the future works

21
[Title Here, up to 12 Words, on One to Two Lines]
[Author Name(s), First M. Last, Omit Titles and Degrees]
[Institutional Affiliation(s)]
Author Note
[Include any grant/funding information and a complete correspondence address.]

22
Digital Forensics in Networking
Introduction
The advancements in technology have changed the workplace of the current existing companies
with the advent of the internet and cloud computing. Different smart working conditions have
been on the rise where employees can access the company’s data from outside the private
networks of the company. This has posed serious security risks due to potential leakages of
critical company's information assets. This sad start of affairs has led to the development of
digital forensic tools which are normally used to investigate when such risks have occurred.
These tools have been limited to the fact that they act when already the risks have occurred
hence cannot proactively investigate the digital forensics case before information assets have
been stolen. This research has proposed a design for a digital forensic model that can pre-
emptively address the security threats posed by the cloud computing environment brought to us
by networking and the Internet.
The first section provides background information about the current tools and dives deep into the
literature which has researched and proposed some of these tools which can be used for this
scenario. Their limitation is analyzed. The second sections provide the theoretical and conceptual
frameworks upon which the proposed tool shall work to provide the pre-emptive nature of
response for digital forensic experts. Finally, a recap of the research shall be provided in the
conclusion part together with future enhancements.

23
background
The cloud is a very interesting Internet-based computing architecture which uses technology to
process data using different computing devices via the Internet. The computing devices don’t
necessarily have to be the owners. The data is shared among different computing devices. The
access to the data is not bound to locations or the availability of networking resources such as
serves storage and or applications. The cloud is normally classified as private, community, public
and hybrid depending on the degree of control the user has on the data processing. The current
workspace which utilizes this computing architecture has shown distinctive changes with regards
to the existing work environments.
Security issues with regard to cloud computing have In the past brought some serious security
incidences. Companies providing cloud infrastructure and services in the past have made the
news through massive data leaks where a non-authorized party is able to gain access to user data
using zero-day attacks of the virtualization technology supporting the cloud computing model.
Digital readiness tools have since been a top priority for organization as it can be used in
lawsuits to bring criminals to justice. The current tools are reactive and only used to investigate a
given incident. This approach risks the artifact got to be damaged hence risk being non-

24
admissible in courts. It is therefore critical to have proactive digital forensic frameworks to
provide a better solution beforehand.
Methodology
The research followed the classical research design where the previous work was analyzed to
identify their strengths and weaknesses. This provided the prospects to have an understanding of
the current systems and applications on how they use the reactive frameworks to investigate
digital forensic cases. The proposed framework usage was analyzed with comparison to a
reactive framework, data analyzed and results discussed
Conclusion
From the paper, it is clear that the current mechanism to provide digital forensic reporting and
investigation has serious loopholes which could affect their data admissibility in lawsuits. This is
due to their reactive nature of reporting. This paper has proposed a more proactive approach
which actively scans the network and has digital information assets analyzed even if no real
threat has happened.
Future Works
The current work can be enhanced by the use of automated network scans to ensure the model is
more proactive to the changes in network topology and addition of new services. In addition, the
chain of custody inclusion is envisioned to be included in the future enhancements

25
References
Birkel, H. S., & Hartmann, E. (2019). Impact of IoT challenges and risks for SCM. Supply Chain
Management, 24(1), 39.
Chu, H.-C., Yang, S.-W., Hsu, C.-H., & Park, J. H. (2014). Digital evidence discovery of
networked multimedia smart devices based on social networking activities. Multimedia
Tools and Applications, (1), 219. https://doi.org/10.1007/s11042-012-1349-9
Nieto, A., Rios, R., & Lopez, J. (2018). IoT-Forensics Meets Privacy: Towards Cooperative
Digital Investigations. Sensors (14248220), 18(2), 492.
Petraityte, M., Dehghantanha, A., & Epiphaniou, G. (2017). Mobile Phone Forensics: An
Investigative Framework based on User Impulsivity and Secure Collaboration Errors.
Sangho Park, Yanghoon Kim, Gwangmin Park, Onechul Na, & Hangbae Chang. (2018).
Research on Digital Forensic Readiness Design in a Cloud Computing-Based Smart
Work Environment. Sustainability, (4), 1203. https://doi.org/10.3390/su10041203
Scanlon, M., & Kechadi, M.-T. (2014). Digital Evidence Bag Selection for P2P Network
Investigation.