An improved IoT forensic model to identify interconnectivity between things

The Internet of Things (IoT) is permeating our daily lives, blurring the boundaries between the cyber world and the physical world. With an increased number of identified sources, obtaining potential digital evidence has become a significant aspect of investigations and incident responses. However, multi-level interconnections are bringing new challenges to identifying connected things in IoT ecosystems. This study focuses on IoT services that can connect or be connected to various things to reveal their connected relationship by examining forensic artifacts under six interconnected scenarios. We found that not all services retain traces of interconnection. Based on our findings from scenario-based experiments and existing IoT forensic frameworks, we propose an improved IoT forensic model to identify interconnectivity between things. This framework suggests additional phases for identifying the interconnectivity of things. The proposed framework is designed to investigate IoT-related cases by identifying all the connected things, ensuring relevant data collection, narrowing down areas of investigation, and integrating the data. Our proposed model discovers pieces of connected things, which helps reveal the whole interconnected IoT ecosystems where users are involved in. This approach can also be applied for a thorough understanding of events relating to things and services around a suspect in cybercrime response.