How the Internet of Things has Changed Computer Forensics

More and more, Internet of Things (IoT) devices have been entering the market recently, with the most prominent product being Amazon's Echo and its smaller counterpart, the Echo Dot, along with Google Home.

What do these devices do?

The Echo and Echo Dot are pretty straight-forward. Users can play music, set an alarm and manage calendars. The user can also activate "skills," as extensions, in order to add more functions to the Alexa app.

In contrast to other IoT devices, the Amazon Echo does not save data on the device. Instead, it transfers all voice recordings to Amazon's data center.

Although the recorded data is not saved on the device itself, users are still concerned as to what rights to privacy they have. Trigger words are used to prompt the attention of the device. For the Echo, it is, "Alexa" and for Google Home, it is, "O.K. Google." Every word spoken after that trigger word is recorded and transferred to the provider's data center. The recorded data is then stored by Amazon or Google and it is somewhat of a mystery as to what happens to the data from there.

Computer Forensics: Can recorded data solve crimes?

In some cases, the data is used for much more serious situations than one might think. Earlier this year, data from an Echo device was used in a murder investigation. An individual was found dead after a house party in Bentonville, Arkansas, and criminal charges were brought against the owner of the home. Investigators demanded the Echo recordings, and data from the Echo inside the home was used as evidence in the case.

This case demonstrates the impact that IoT devices will have on computer forensic investigations. Investigators are now able to utilize data stored on devices, the cloud and external data centers. When data becomes available to computer forensics specialists, the work becomes the same as any other ordinary case. After forensic investigators create a 1:1 image of the original storage media – a hard disk drive, an SSD, a removable FLASH card, a data tape or any other storage media – they begin to analyze the data. When this assessment is completed, investigators use specialized software tools to search through the data, looking for evidence that can be used in a trial.

Can I stop sharing my data?

While this is a beneficial tool for some criminal investigations, users have the power to turn this feature off. If a user does not want their recordings to be stored, there is a way to delete them. Inside the Alexa app on your smartphone, there is a possibility to delete your voice requests one by one. If you do want to bulk delete, you can do that by signing into your Amazon Account and check out your devices under this link https://www.amazon.com/mn/dcw/myx.html?tag=w050b-20.

At KrolLDiscovery, computer forensics is in our DNA. Our analysts have years of experience investigating real cases and obtaining real results in both civil and criminal contexts, and our analysts are recognized experts in the field. If you have an IoT device, or any media type, that needs investigating, we are here to work with your team.