IoT forensics
Also known as: IoT-Forensik, OT forensics, device forensics
Trace recovery on connected devices without standardised operating systems, forensic interfaces or local storage – from the camera to the industrial controller.
IoT and Operational Technology (OT) devices produce evidence distributed across many systems and often across the manufacturer's cloud. Hardly any tool covers more than one device model, and there are no uniform procedures. The European Union Agency for Law Enforcement Cooperation (incl. EC3) (Europol) report names missing forensic interfaces, short retention at the provider and encrypted transport as the main problems. For operators of critical plant, passive network monitoring is therefore frequently the only reliable source of traces.