IoT Forensics: Smart Home, Wearables, MQTT/CoAP and Firmware Analysis

Consumer, industrial, medical, automotive and other connected systems can combine sensors, actuators and services. Device operation can affect physical safety, so avoid generic isolation or power-cycle instructions for every category.

Identify hardware, firmware, network links, accounts, paired devices and stored/remote data paths. A local-only system, edge recorder and cloud-dependent product have different collection needs.

Inventory accessible storage, removable media, hubs, companion-app data, exports and account records. Neither a few seconds of local audio nor a complete vendor history is universal across smart speakers.

Cloud retention can depend on subscription, settings, deletion and service changes. A provider request cannot guarantee every clip, command or sensor sample. Preserve actual account and service settings.

Prioritise sources by the question and loss risk. Seize or interact only within appropriate authority and document why a source was collected, deferred or unavailable.

Surveillance-specific storage and clock handling are developed in DVR/NVR Forensics. Do not transfer one camera brand’s format to every device.

MQTT publishes application messages through a broker to topic subscriptions. Common TCP ports are 1883 and 8883 for TLS, but actual transport, port and configuration must be verified.

Authentication and authorisation can restrict clients and topics. Subscribing to # does not guarantee access to every broker message or complete history; system-topic rules, retained messages, sessions and permissions matter.

MQTT delivery quality-of-service describes protocol delivery behaviour, not the truth of a sensor reading or completion of a physical action. A retained message may be older state rather than a new event.

CoAP’s base specification uses UDP with request/response resources, commonly ports 5683 and 5684 with DTLS. RFC 8323 also defines TCP, TLS and WebSocket transport arrangements.

Observe and block-wise transfer extend relevant interactions. A protocol name or port alone does not establish plaintext, authentication failure, malware control or a fixed amplification ratio.

Preserve available captures, broker/service logs, device identifiers, payload schemas, access controls and clock context. Encrypted transport can conceal topics or content from passive capture. Publishing or subscribing during a test can alter live state and must be recorded.

Smart speakers can process and retain different information locally and remotely according to model and settings. Voice history can contain recognised text, audio, errors or no retained recording; a wake-word trigger is not automatically a command intentionally spoken by a named person.

Cameras may use local cards, NVRs, cloud storage or hybrids. Remote viewing is not proof of remote recording. Identify enabled channels, schedules and retained versions rather than apply a fixed subscription window.

Wearables can retain sensor samples, derived activity summaries and device/account associations. Paired phones and cloud exports may contain different time ranges or detail. Their presence should be checked independently.

Heart rate, steps, sleep and stress are measurements or model outputs with device-specific error. They do not independently establish death, exact movement, the wearer or an alibi’s truth.

Separate sample time, device processing time, phone synchronisation and cloud upload. Timezones, resets and delayed sync can cause apparent disagreement.

Correlate relevant sensor findings with independent evidence and disclose calibration, wear state and missing periods. Use sourced cases only for supported claims; a hypothetical example can teach the method without invented convictions.

Firmware analysis investigates code, configuration and storage formats; it is distinct from acquiring user event data. A vendor download can be a useful reference without matching the exact installed build or per-device state.

Acquisition can use supported exports, published firmware, authorised update collection, in-circuit interfaces or specialist component reading. Triggering an update changes evidence and may destroy relevant state; it is not a routine passive collection step.

UART settings, voltage levels and pinouts must be verified before connection. A serial output can be logs only, authenticated or disabled; do not assume it provides an unauthenticated root shell.

JTAG access depends on enabled debug features and supported operations. ISP and chip-off expose different storage paths with damage and encryption limits. A removed component is not inherently the highest-fidelity plaintext source.

Run binwalk or other format tools on isolated copies using the installed release’s supported options. Validate extracted structures and record offsets, warnings and transformations; entropy alone does not identify an AES key or encrypted region conclusively.

Disassembly requires the correct architecture, load context and relevant dependencies. Candidate strings, accounts and update endpoints are leads, not proof they were used.

Compare like representations: a signed update package, expanded filesystem and per-device flash dump can legitimately have different hashes. Differences can reflect version, calibration, configuration or corruption as well as compromise. Record the baseline and investigate specific changes.

Common concerns include default or shared credentials, unsafe interfaces, weak updates, inadequate isolation and missing monitoring. Their presence needs actual configuration and behaviour verified rather than inferred from a brand or country.

Mirai is a useful historical example of compromised connected-device infrastructure, but exact bot counts, traffic peaks and later variants should not be mixed into one unverified narrative. A 2016 label does not identify a current infection.

Update confidentiality and authenticity differ. An HTTP-delivered package can be cryptographically signed, while TLS delivery alone does not establish trusted firmware provenance. Validate signature and update checks separately.

An MQTT broker without client certificates may still authenticate using other mechanisms. Conversely, an open port does not prove anonymous access or permission to every topic.

Heterogeneous storage, clocks, limited interfaces and retention complicate collection. Reboot effects vary; do not assume most devices erase every cache or that no general digital-evidence principles apply.

NIST IR 8259A describes baseline IoT cybersecurity capabilities, including identification, configuration, protection, access, update and state awareness. These can guide readiness questions without certifying that a product implements them.

Where the vendor is unavailable, preserve device and companion sources, identify actual interfaces and consider a suitable reference unit. A clean-reference difference is an observation requiring interpretation, not a compromise verdict.

IoT records can expose household, health, location, voice and workplace information about multiple people. Collection, disclosure and evidentiary requirements vary by jurisdiction and data type.

Define the authority, relevant accounts/devices, categories and time range. A law-enforcement purpose is not a universal permission to collect every unrelated household record or bypass all privacy safeguards.

Provider preservation, account export and device seizure have different effects. Use the applicable process and retain its actual returned scope and limitations; geography alone does not decide the entire route.

Authentication and admissibility assessments need provenance, collection method, clock context, transformations and limitations. A certificate does not automatically validate the recorder clock, sensor interpretation or human identity.

For provider and cross-border boundaries, use Cloud Forensics. Keep named statutory analysis in the relevant legal-framework lesson.