Best Practices for On-Scene Identification, Seizure, and Preservation of Internet of Things (IoT) Devices

When collecting any digital evidence it is best to first reference the SWGDE Best Practices for Digital Evidence Collection. In addition to those best practices, the following should be considered.

While documenting the scene, be sure to include the contents of a display or other device status indicators, prior to taking any further action. Special attention should be paid to the preservation process and its impact on collection, as well as the potential for additional evidence (e.g. latent prints, DNA, spatter evidence on the surface of devices, etc.).

While attempting to isolate the device, the collector also needs to be aware of trigger events. Trigger events may include (but are not limited to) manipulation of the device itself, motion/movement caused by collectors (which may be detected by connected sensors), manipulation of connected switches (e.g. light switch), verbalizing wake-words (saying you found an Alexa device, and “Alexa” is also the wake-word), making sounds above a detectable threshold, disconnecting the power and/or data connection, etc. This may cause an update/alteration of the data to be investigated, possibly alert the owner that a trigger event has occurred, and may cause the alteration and/or loss of volatile data of interest. Consideration should also be taken in preserving (sending in a preservation order) and capturing data that is possibly stored in the cloud, on mobile and other linked devices, and with other parties.

Although IoT devices may not currently store a significant amount of data on the device, they could provide information leading to data stored elsewhere, such as with a cloud service provider, personally owned computer, mobile device, or other IoT devices. Relevant data may be accessible from those devices. If additional devices are discovered, the same collection and acquisition procedures should be followed to secure/isolate the newly discovered devices.

Devices must be isolated from their network(s). One method of isolating a device from the network is to unplug the power to the device or remove the battery power. If the device cannot be powered off using these methods, use a Faraday bag/box or other network isolation method. If a battery is removed in order to isolate the device, do not place the battery in a Faraday enclosure with the IoT device as the shielded bag may actually create a connection and turn the Faraday enclosure into an antenna. In cases where IoT devices are hardwired into power supplies, and first responders lack either the knowledge or agency authority to remove the device, remove power at the circuit breaker (being mindful of other devices of evidentiary interest that may be on the same circuit). Where the power cannot be removed, and the devices cannot be directly isolated from the network, removing Internet connectivity can be achieved by disconnecting the network cable, wireless access point, switch, router or modem. This action should be weighed against the potential impact of removing network connectivity to any non-targeted devices. Be mindful of IoT devices that may be actively reporting their location (e.g. Air Tags) that may be beaconing.

Collection procedures are dependent on several device characteristics due to the disparate manner in which IoT devices receive power and communicate. The characteristics include the following items.

• Form Factor – The differences in the devices can range from the discreet to visually obvious. Devices may contain any number of items to include cameras, microphones, or other sensors that can be miniaturized and embedded in other objects. Radio frequency technology may be used in less than intuitive ways, such as for motion detection.
• Power – When collecting a device from a scene, to minimize changes one must remove power from the device. Devices may be wired for power, run on a battery, or perhaps may have both wired and battery power. Device configuration and hardware mounting, such as a Ring doorbell mounted to an exterior door frame, may make power assessment challenging and require pre-collection research.
• Artifact/Data Storage – IoT devices store artifacts across an array of locations. Probative data may exist locally or remotely to a sensor or device and have finite storage and persistence. One must be ready to collect a physical device and investigate a network storage location. That location could be in close proximity to the device, or within a vendor’s cloud storage.
• Connectivity – IoT devices use several communication protocols. In order to properly seize and preserve a device, one may need to assess if there is a presence of a hub, a router, or if the device connects directly to the internet. In instances wherein a hub or a router are used, those items should also be collected.
• Artifact/Data Spoliation – Specific Considerations/Cautions (Instances where probative data exists in volatile memory only or where data overwrites or appends in a finite storage setting)
• Specific Device Risk – Considerations or exposures to avoid (Instances where fragility, temperature, moisture, or other sensitivity risk to the device and data exist)
• Device Security – Considerations regarding security design (Technology designed to invoke security related to locally stored data, network or ad hoc connections, and data transmission)
• Identifiers – Taking pictures of the make/model/serial number and Media Access Control (MAC) address of the device may be useful documentation when attempting to match connections to other devices such as smartphones. Identifiers in an IoT Standard are typically divided into the following categories:
  • Object identifier
  • Communication identifier
  • Application identifier