Recovery of forensic artefacts from a smart home IoT ecosystem

This paper reports an investigation into a modern smart-environment ecosystem comprising of multiple Internet of Things devices: Amazon Echo, Nest Indoor Camera and Philips Hue smart-bulb. As of yet, there is still little to no documentation, nor established methodology for the examination, acquisition and documentation of evidentiary artefacts from a smart-environment. Much of the research still remains individual to each device and does not incorporate the “melting pot” reality of most smart-environments. The methodology outlined in this paper was artefact-centric, and was purposely designed to facilitate the creation, discovery and documentation of network-native, cloud-native and device-native artefacts. Whilst not all aspects of the investigation were successful, a strong groundwork of documentation of the artefacts present on each of the smart-devices examined has been compiled, so as to inform and lay the foundations for future studies on this area of research.