The smart speaker is becoming a common part of the modern household, which usually includes an AI-powered Intelligent Voice Assistant to communicate with its users. Amazon Echo Dot is a popular smart speaker that extends the above-stated functionality by acting as a communication hub for other Internet of Things (IoT) and mobile devices within its local network. The nature and volume of data that an Echo Dot handles make it a potential source of evidence, if one is seized for a digital forensics investigation. Researchers and practitioners have explored various techniques to extract data from these IoT devices. However, traditional methods make changes to the physical device and/or its data, which is undesirable from a digital forensics perspective. The current work focuses on developing a nondestructive methodology for extracting data from IoT devices, with Amazon Echo Dot version 2 as an example, which use embedded Multimedia Card (eMMC)/embedded Multichip Package (eMCP) chips as their primary storage. We identify all in-system programming (ISP) pins using the computed tomography (CT) Scan imagery of the main printed circuit board (PCB) of the device. We created a 3-D fixture that accommodates pogo pin connectors to create contact with the already identified ISP taps on the main PCB. The 3-D Test Probe Jig can extract data from an IoT device’s memory chip using an eMMC reader. The proposed nondestructive solution is reproducible, portable, and affordable.

It is challenging for digital forensic practitioners to maintain skillset currency, for example knowing where and how to extract digital artifacts relevant to investigations from newer, emerging devices (e.g., due to the increased variety of data storage schemas across manufacturers and constantly changing models). This paper presents a knowledge sharing platform, developed and validated using an Internet of Things dataset released in the DFRWS 2017-2018 forensic challenge. Specifically, we present an automated knowledge-sharing forensic platform that automatically suggests forensic artifact schemas, derived from case data, but does not include any sensitive data in the final (shared) schema. Such artifact schemas are then stored in a schema pool and the platform presents candidate schemas for use in new cases based on the data presented. In this way, investigators need not learn the forensic profile of a new device from scratch, nor do they have to manually anonymize and share forensic knowledge obtained during the course of an investigation.

Over 20 studies have been published in the past decade involving file and data type classification for digital forensics and information security applications. Methods using n-grams as inputs have proven the most successful across a wide variety of types; however, there are mixed results regarding the utility of unigrams and bigrams as inputs independently. In this study, we use support vector machines (SVMs) consisting of unigrams and bigrams, as well as complexity and other byte frequency-based measures, as inputs. Using concatenated unigrams and bigrams as input and a linear kernel SVM, we achieve significantly improved results over those previously reported (73.4% classification rate across 38 file and data types). We are the first to use concatenated n-grams as the sole input, and we show their superiority over inputs used previously. We also found that too many different types of features as inputs result in overfitting and poor generalization properties. We include several types seldom or not studied in the past (Microsoft Office 2010 files, file system data, base64, base85, URL encoding, flash video, M4A, MP4, WMV, and JSON records). The “winning” approach is instantiated in an open source software tool called Sceadan - Systematic Classification Engine for Advanced Data ANalysis.