Unified Methodology for Forensic Analysis of IoT Devices (UM-FAID)

The world is becoming increasingly dependent on Internet-connected devices. According to industry reports, there are an estimated 26.6 billion devices connected to the Internet with a predicted 51 billion devices by 2023. The range in devices along with the shift from traditional computers to embedded devices makes a digital forensic investigator\u27s job increasingly difficult. This study aims to create a unified methodology for forensic analysis of Internet of Things (IoT) devices. Specifically, it dives into the data extraction from IoT devices through hardware-based methods. To create this methodology a number of existing academic papers and case studies from the digital forensics, computer engineering, and reverse engineering subject areas were acquired to develop an all-encompassing methodology for hardware-based data extraction. To test the methodology, a number of IoT devices were acquired, populated with user-data, and extracted through the methods described in this study. The results of this study supports that an investigator following this methodology (UM-FAID) would be able to extract data directly from the hardware of a sweeping number of IoT devices without access to the linked smartphone or cloud login information. Artifacts from the analyzed data can include personally identifiable information (PII) and hidden data that is not displayed from the smartphone or cloud user interfaces. Consequently, developers should take into account the security of their user\u27s data on their IoT devices in addition to smartphone and cloud security