How the Internet of Things has Changed Computer Forensics

More and more Internet of Things (IoT) devices have been entering the market recently, with the most prominent product being Amazon´s Echo and its smaller counterpart, Echo Dot along with Google Home.

What do these devices do?

The Echo and Echo Dot are pretty straight-forward.  Users can play music, set an alarm and manage calendars.  The user can also activate “skills”, as extensions, in order to add more functions to the Alexa app.

In contrast to other IoT devices, the Amazon Echo does not save data on the device. Instead, it transfers all voice recordings to Amazon´s data center.

Although the recorded data is not saved on the device itself, users are still concerned as to what rights of privacy they have. Trigger words are used to prompt the attention of the device.  For the Echo, it is “Alexa” and for Google Home, it is “O.K. Google”.  Every word spoken after that trigger word is recorded and transferred to the provider´s data center. The recorded data is then stored by Amazon or Google and it is somewhat of a mystery as to what happens to the data from there.

Computer Forensics: Can recorded data solve crimes?

In some cases, the data is used for much more serious situations than one might think.  Earlier this year, data from the Echo was used in a murder investigation.  An individual was found dead after a house party in Bentonville, Arkansas.  The owner of the home is now on trial Investigators demanded the Echo recordings individual was later found dead after a night of drinking. Data from the Echo inside of the home is now being used as evidence in the case.

This case demonstrates the impact that IoT devices will have on computer forensic investigations. Investigators are now able to utilize data stored on devices, the cloud and external data centers.  When data becomes available to computer forensics specialists, the work becomes the same as any other ordinary case. After they create a 1:1 image of the original storage media – a hard disk drive, a SSD, a removable FLASH card, a data tape or any other storage media – they begin to analyze the data. After this assessment is completed, they use specialized software tools to search through the data, looking for incriminating evidence that can be used in a trial.

Can I stop sharing my data?

While this is a beneficial tool for some criminal investigations, users have a right to turn this feature off.  If a user does not want their recordings to be stored, there is a way to delete it. Inside the Alexa App on your smartphone, there is a possibility to delete your voice requests one by one. If you do want to bulk delete you can do that by signing into your Amazon Account and check out your devices under this link https://www.amazon.com/mn/dcw/myx.html?tag=w050b-20 .

In another blog article published last year, we explained with several cases how data recovery and computer forensics go hand-in-hand in order when analyzing data regarding a company crimes and the methods and possibilities modern computer forensic can offer. Find out more here.

Additionally, if you've recently experienced data loss on your laptop, check out Ontrack's expert laptop data recovery service.