Vol. 8, No.

1 | Jan – June 2025

IoT Forensics: Addressing Challenges and Establishing

a Framework for Exploring Digital Forensics
Shauban Ali Solangi1∗
1
Department of Information Technology, Faculty of Engineering & Technology (FET),
University of Sindh, Jamshoro, Pakistan. (76080).

Abstract:
IoT forensics is a form of digital forensics that focuses specifically on the investigation of
security incident detection and the accumulation and analysis of evidence to eliminate future
attacks upon IoT networks. It is differentiated from other kinds of digital forensics due to several
unique characteristics present in IoT equipment, such as low processing capacities and
connectivity features. The science is rapidly transforming, and reviewing the entire activity to
keep it abreast of new threats and best practices should be done very often. This paper reviews
the present state of IoT forensics and outlines the challenges investigators face. Also, a
framework is devised to mitigate these issues and help in a smooth process of data analysis. For
this, relevant reviews are analyzed to find key issues and significant obstacles in the field. Many
problems emerge in the collection and preparation of evidence, largely because of counter-
analysis techniques and challenges in data gathering from devices and the cloud. The analysis
also highlights procedural issues concerning preparedness, reporting, and ethical considerations.
We have identified the challenges of the existing research, which will help guide future studies
and, thus our contribution to the IoT forensics field.

Keywords: IoT, digital forensics, cloud forensic, proactive and reactive forensics, digital
evidence.
of IoT devices in our lives, including their
1. Introduction misuse in criminal activities [3]. IoT forensics
The Internet of Things, or more commonly involves the collection, analysis, and
referred to as IoT, is a group of devices preservation of digital evidence from these
equipped with electronics and software along devices for legal cases or incident
with sensors that can share data and investigations. Critical areas of focus in this
communicate with each other. It helps field are: Extracting evidence from IoT
automate processes and enables cooperation devices, Analyzing network communications,
among different industries, such as healthcare, Designing special tools and methodologies for
agriculture, transportation, and manufacturing the unique challenges posed by various IoT
[1], [2]. Nevertheless, several issues need to be devices, Enhancement of reliability of forensic
fixed, such as security problems, lack of evidence, and Setting standards for IoT
standard rules, and risks of hacking. These forensics practices [4].
problems need to be solved in order to fully Most application domains give a clear view
unleash the benefits of IoT and to protect of the IoT, including cloud computing,
privacy and data. There is also an increasing agriculture, smart homes, manufacturing,
demand for IoT forensics with the growing use supply chains, and smart cities, all connected
SJCMS | P-ISSN: 2520-0755| E-ISSN: 2522-3003 | Vol. 8 No. 1 Jan – Jun 2025
43
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
through the Internet. IoT technology has
enabled remarkable advancements, allowing
for the interconnection of uniquely identifiable
physical devices [5]. This includes sensors,
Radio Frequency Identification (RFID) tags,
and sensor networks that monitor greenhouse
systems. These sensor networks are the
backbone of managing agricultural processes
and water distribution in smart cities [6-9]. The
integration of IoT into life has brought many Fig 1: Worldwide IoT devices connections [13]
benefits through its applications, but this also IoT connectivity intertwines and integrates
generates a large amount of data on a daily nearly every system, device, standard, and
basis, thus creating new paradigms and protocol of ICT networks, presenting a high
security issues concerning evidence-based degree of heterogeneity, thereby increasing
information. Recent developments in challenges in the area of security and privacy.
Information and Communication Technology Hence, any loophole in security can be
(ICT) have sparked a dramatic increase in determined and exploited by attackers. An
connectivity and use of IoT devices. expert cyber-criminal can strategize an attack
According to IDC, connected IoT devices using public or open networks or private
would reach more than 41.6 billion by 2025," networks and sources, like smart homes,
and "IoT utilization worldwide was estimated smartphone, or smart cars. Therefore, all those
at USD 772.5 billion in 2018 with a growth of malicious actions related to data theft of
14.6% in IoT consumption during 2017." personal or organizational information can be
According to IDC and Gartner, the CAGR in seen as a huge threat to people and the business
IoT device consumption will jump to 1.1 integrity [11], [14].
trillion by the end of 2021, and over and above
everything, the interest in these devices is IoT forensics represents one of the most
going to spread out across a myriad of sectors, powerful tools in the spectrum of key
indicating tremendous opportunities for applications: criminal investigations, incident
growth till the year 2028 [10], [11]. response, and litigation. It is a beacon in the
criminal investigation approach: the extraction
As envisioned by Gartner, installation in of critical digital evidence from the IoT device
2019 was projected at 26.66 billion while in illuminates the possible route to justice. It
2020 was expected to rise at 30.73 billion with unravels, in the context of incident responses,
an exponential rate of 35.82 billion in 2021. the origin and scope of security breaches
Total IoT installed devices are predicted to involving connected devices, thus keeping
reach a considerable number close to 75.44 organizations in control [14]. The legal
billion with the curve demonstrated in Fig. 1 processes rely on the integrity of IoT forensics
[12], [13]. However, the large amount of data to gather and safeguard data that can stand
generated by IoT requires the need for IoT strong in court as evidence, preserving truth
forensics and investigations, along with and accountability. This multi-phased journey
privacy concerns about data usage. Security of IoT forensics consists of critical steps,
and privacy are undoubtedly paramount, starting with the careful seizure and protection
especially as IoT-driven productivity increases of IoT devices to uphold their integrity. It
across businesses, governments, and top progresses through both volatile and non-
management levels. Since IoT systems handle volatile extraction of data and then into
important and sensitive information, any profound analysis of communication on the
vulnerability could lead to significant risks and network and data, which delivers significant
cyber-crimes. and relevant information and connections. It
culminates with analytical results speaking to
the facts. Researchers, each with their own
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
44
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
courage in facing the multi-faceted challenges 2. Background
they come across with IoT, manage operating
A digital forensics framework, also known
systems, storage systems, data formats, and
as a digital forensic process model, is a series
bridge them up by creating solutions. It follows
of steps with the related inputs, outputs and
on to reliability and consistency in forensic
requirements with which assistance is given
evidence gathering and the establishment of
toward a successful forensics
strong standards for IoT forensics [15-17].
investigation[18], [19]. A digital forensics
Network communication analysis delves into
framework powers forensic investigators as
the intricacies of network traffic and
well as any other related personnel to carry
interaction records, which are used to
meaningful investigations and administer
determine the behavior of devices and their
justice by unearthing criminals and bringing
interconnections, thereby improving our
the perpetrators to task. This allows a
understanding of this dynamic realm.
structured framework for each investigative
IoT devices generate data with such phase, providing for timely actions that are
complexity and high volumes that digital relevant and effective for the case being
forensic investigations become much more investigated. Implementing these
complicated. Most information is stored in considerations will allow reconstructing the
IoT-based clouds, making data acquisition and time line of all events and pertinent data with
retrieval very difficult due to SLAs and data ease. The most critical stage in this regard is
volatility. Effective digital forensics, therefore, the careful maintenance of evidence chain of
require systematic research in IoT areas as the custody because it serves as the guarantee to
infrastructure is changing rapidly [17]. No win these battles and secure the truth triumph
matter whether it is virtualized or traditional in court.
computing, proper procedures must be
Different investigation models, tailored to
followed along with legal analysis of evidence.
specific phases and levels of detail, are
Some of the major challenges include a lack of
essential for effectively addressing various
forensic tools, heterogeneous data, ambiguous
types of investigations. In this regard, Kohn et
locations of data, and information volatility.
al. provides an integrated suitability
The collection of data from the distributed IoT
framework maps a set of requirements derived
network poses technical and legal obstacles
from an ongoing investigation to the most
due to limited storage and integrity issues
appropriate forensic procedure [20]. Finally,
among devices. Additionally, they need
the authors make use of a graph-based
reliable forensic tools and secure custody
approach, illustrating the interrelation between
chains. Identifying these primary research
well-known forensic frameworks: number of
design challenges is crucial for advancing
phases and their respective content. Notable
digital and IoT forensic investigations.
frameworks are the Analytical Crime Scene
This research article comprises five Procedure Model, abbreviated as ACSPM
sections. Section I provides a succinct [21], the Systematic Digital Forensic
introduction to the IoT and digital forensics Investigation Model, abbreviated as SRDFIM
and the nature of the research. A literature [22], and the Advanced Data Acquisition
review of existing research related to digital Model, abbreviated as ADAM [23]. In general,
forensics with suggested designs is provided in law enforcement agencies follow their variant
Section II. In Section III, an overview of some of the guidelines provided by the Association
of the digital IoT forensics is provided. In of Chief Police Officers, ACPO [24]. In
Section IV, key challenges within the existing addition, additional forensic guidelines and
forensic research design are provided with the models recommended by NIST and
identification of the research gap.The proposed INTERPOL can be found in [25-32].
framework for the digital forensics is discussed
Table 1 summarizes the most widely
in Section V. Finally, the conclusion and future
known digital forensic frameworks. In general,
directions are provided in Section VI.
the procedures listed in Table 1 share a
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
45
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
common hierarchical structure [33], [34] that Whereas for forensic guidelines and
can be grouped into the steps described in frameworks, in parallel, standards are
Table 1. Notice how some of the models detail extremely important to obtain conformance in
finer granularity for a subset of the steps where addition to inter-compliance geographical and
the context of the investigation requires it-for jurisdiction borders. There already are many
example, particular appliances and constraints numbers of standards plus established
on seizure or acquisition. In the case of chain practices with organizations worldwide being
of custody and trail of events preservation, a applied using appropriate methods. On how to
forensically sound procedure must ensure practically go about such a forensic treatment
features like integrity traceability, on a certain investigation, such details vary due
authentication, verifiability and security [35], to the particular device. As shown in Table 12,
[36]. the phases of electronic evidence analysis are
typically categorized as stated. However, the
Several authors also identified some exact phases' name may be different because
problems in digital investigation processes different forensic models may be used
during earlier times, that is [37-45] mainly
according to each organization's needs.
related to the preservation of chain of custody,
the growth of the data to be processed, and The huge amount of information exchange
privacy and ethical issues when collecting such demands much more attention related to cyber-
data. Furthermore, our research methodology security. The IoT forensic and digital forensic
discovered a number of literature reviews investigation has a lot of research suggestions
which addressed the challenges and limitations in different application domains by numerous
of forensic frameworks. For example, in [44], research scholars throughout the world, still
the authors used a graph analysis methodology require an effective framework for
for leveraging a summary of digital forensic consideration concerning the digital forensics.
frameworks and tools along with their
interrelationships. Moreover, they presented 3. Digital Forensics Challenges
some challenges and limitations of privacy-
preserving digital investigation models and There are certain factors which
proposed some measures to palliate them. In significantly affect the IoT forensics process.
[45] the authors present a chronological review First, the explosion of big data which have
of the most well-known forensic frameworks created large data, and lack of real-time log
and their characteristics. The work in [46] analysis. Second, the varied and numerous
assesses the current frameworks among devices, most of them having heterogeneous
European law enforcement agencies, functionalities, and resources limitations.
identifies, and defines elements of robustness Third, the complexity comes in both forms
and resilience in the context of sustainable namely a huge number of devices or data, and
digital investigation capacity so that heterogeneous operating systems as shown in
organisations can adapt and overcome Fig. 2. Fourth, the data diffusion from multiple
deviations and novel trends. In [43], the platforms and systems such as data-ware
authors identified the need to define specific houses, databases etc. Fifth, different vendors
models according to the forensic context, such and different standards are adopted and applied
as in the case of Mobile Forensics [43]. In by proprietary hardware and software
addition, the authors provided a specific companies. Sixth, the legal process of the data
forensic framework to enhance the Mobile collection and usage from the indigenous and
Forensics investigation. Additional reviews of or cross-borders perspectives. Seventh, the
the most widely applied forensic frameworks varied data formats and storage of capacity of
and their characteristics are available in [47], the data in either phone memory or at the data
[48]. Table 14 summarizes the key identified centers impose challenges in the digital
challenges of each literature review in forensic forensic processes.
frameworks.

Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
46
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
Apart from this, the IoT enables various nature IoT, in turn, is complex to ensure those
devices to connect over networks, creating are authenticable to users always. Users can
significant security problems. Public networks create trust by using dependable services and
must be constantly monitored to protect users' key sharing for the transmission of data. Key
IoT systems from cyber attacks. Weakness in management and encryption facilitate trust in
security provides a chance for attackers to the incoming and outgoing information.
harm the user and invade his privacy. These
cyber attackers can use DoS, sniffing, data 4. Investigations related to Digital
modification, malware attacks, MiTM attacks,
and Trojan horses among others. Many Forensics and existing frameworks
organizations have reported significant
damage and losses due to these types of
In Digital Forensics (DF), the investigation
attacks. Smart tablets, smartphones, and
process for the information related to security
personal computers will need secure and
can be revealed through how, when, where,
reliable settings with strong encryption
and what incident has taken the place. In other
protocols. IoT security challenges include
words,. Digital Forensic is the process of
privacy and authentication, device variety, and
identification, collection, examination, and
policy issues. The current security protocols
analysis of digital evidence found in the digital
still require more research. As the exchange
devices under criminal investigation. The
between devices needs to be confidential. The
collected evidence present in the court of law
requirement increases if devices monitor data
for legal proceedings. Therefore, emerging IoT
without human oversight. But preserving
devices proliferation made it a bit difficult for
confidentiality requires protection against any
examiners to carry out satisfying results. Most
unauthorized changes in the data—as
of the organization, on the other hand, are
confidentiality demands integrity in addition.
reluctant to ponder about cyber-security issues.
Even though cyber-security demands focused
consideration.
However, the traditional method for the
digital evidence investigation is not applicable
to the IoT forensic due to the huge amounts of
IoT data, Integration of IoT and the Cloud,
legal, and technical issues.. The traditional
method for the investigation can be both the
evidence collection from the primary sources
namely PCs (Personal Computers), main
servers, laptops, mobile phones, and gateways,
or IoT devices such as home appliances,
medical devices, sensors, and many other
smart IoT devices. Consequently, the digital
forensics and related investigation is still
Fig. 2: Digital Forensics Security Stages [source: impromptu and requires a comprehensive
the Internet]
framework for the investigators in a volatile
Privacy in IoT-based systems demands digital forensic environment.
excellent security. Consideration from
In the investigation process of DF, the
viewpoints of user's and data point of view -
technical areas are supposed to require deep
privacy is absolutely necessary. While IoT
and comprehensive research. Also, the
devices observe the environment with their
ownership and jurisdictional issues are the
sensors collect the data sensed, process that
same from the legal perspective. Because
data and submit it to end users for an analysis.
forensics tools are incapable to delve into the
So, users do rely on them. However because of
investigation process due to different IoT
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
47
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
devices and their proprietary designs and process of the data, whereas the data storage is
ambiguous data storage places and network likely to be replicated [37-40].
approaches [35]. On the other hand, some
traditional approaches in the DF are relatively 2. Understanding:
involved to carry out the desired results based At this level, the help of tools and
on the standardization processes. Traditional technology is needed for the support of
processes mainly focus upon the information evidence, and authorization is required for
sources namely, Random Access Memory monitoring and accessing the overall system. It
(RAM), HDDs (Hard Drives), logs, histories, resolves the complex tasks in CC platforms
and any connected storage source. through the recovery of deleted data from
Interestingly, the traditional method of Backups, Repositories, Snapshots, Mobiles as
investigation comprises a range of malicious shown in Fig 3. Examining the partial
network activity detection. In this detection evidence is a real risk because partial or
method, the data traffic passing through the incomplete evidence may be inadmissible in
network is closely analyzed and stored. When court [41-43].
it comes to mobile cellphone crimes, the DF
investigation method leverage significant 3. Reporting:
challenges for the preservation of the evidence Reporting comprises the approaches
and the encryption techniques for a volatile to formulate a dynamic technological question
environment. The data collection and analysis that strongly supports the evidence and reflects
from both the legal perspective and technical the potential impact on witnesses. It requires
perspective is with all supporting facts the reconstruction of the crime scene as shown
presented before the court for further actions. in Fig 3. It needs state-of-the-art digital
Therefore, the legal and technical issues with forensic related valid tools and process and
data representation for necessary proceedings guidelines, and evidence. Due to the
in the courts require the traditional and state of complexity of the IoT environment sometimes
the art digital forensics investigation expertise it is difficult to make understanding the jury
to disclose the real facts about the crime [36]. about the crime scene as depicted in Fig 3.
In the last one and a half decades,
various research contributions have suggested
different solutions and frameworks in the
fields of DF. The suggested research studies
not only contributed to the information and
communication technologies but also in
improved frameworks and models.
A digital forensics framework consists of
the stages of digital forensics that are given
below:
1. Identification:
In this stage, incident location and
unknown crime location are focused.
Assurance of service manageability, service Fig 3: Main challenges of the digital forensics.
availability, and flexibility is affected by CSPs.
SLA guidelines mostly focused upon security 4. Close
needs than forensic needs as illustrated in Fig It ensures the digital and physical
3. SLA specifications and log framework on properties of the returning of the evidence. So,
both physical machines and data centers are this stage advocated the return of evidence and
permissible for the creation, storage, and secure the deletion of the data. Legal training

Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
48
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
and legal advice are required as shown in Fig Numerous digital forensics research has
4. been proposed with different methods for
investigations that rely purely on the types of
5. Examination cases and investigation areas. For two decades
The examination comprises insightful and the research has been carried out by suggesting
valid systemic research for the evidence. frameworks or designs for compromising
Creates challenges in the timelining of events results. Therefore, the categories are divided
and logs help an investigator to connect the into seven stages. Each stage is further
dots as illustrated in Fig 4. categorized into a specific sub-stage or as a
cloud forensic design challenge. In Table 1,
6. Collection digital forensics design comparisons for a
At this level of digital forensics, the crime specific category are given. So, many research
scene evidence collection with all supporting scholars proposed the research designs by their
data to the suspected crime scene is collected specific contribution identification of SLA
or recorded. Sometimes, a snapshot of virtual design, log frameworks, decentralized data,
machine or forensic image is a process of and CSP based dependency [42], [46-59], [67].
making a clone of a virtual image including the Various research designs have been suggested
running system’s memory. It adds to the for each digital forensics area in the stage of
complexity of forensics data collection and understanding the cyber-crime namely
easy to seize the hardware as shown in Fig 3. recovery of the deleted data from cellphones,
laptops, and others [47] [51-54], [56-64].
7. Preservation: Partial returning of the partial evidence and
Preservation is based on the data information related to the cyber-crime [42],
volatility, data integrity, data isolation, and [47-50], [52], [66]. Cryptographic data
valid state of the data whether it is in the form recovery in mobile devices namely computers,
of digital evidence or physical evidence. So, laptops, and cellphones in suggested by [27]
state-of-the-art forensic techniques and cloud [53] [59], [44], [63] as shown in Table 1. Some
provider’s expertise use their crucial research scholars specifically focused upon the
environment. Therefore, having persistent reporting, close or returning of the evidence,
storage and keeping the storage synchronized examination and collection the crime- scene
is suggested by researchers to counter the data related information and collection all main
volatility issues as shown in Fig 3. supporting points which strengthen the
evidence are suggested in [41-52], [56-74] that
After following all these stages and advocated about the crime-related data
completing the requirements the data is further gathering and maintaining information. To
analyzed for presentation. The data validate the evidence, it is essential to maintain
presentation incorporates all necessary steps to and lining the data with the evidence digital
identify, validate, and support all legal and signatures. Storage data recovery, and fully or
technical aspects which strongly support the partially deleted data recovery and its
suspected crime. The suspected crime scene verification regarding the multi-tenancy and
reconstruction, no doubt, requires potential resource sharing also demands a significant
expertise. This relates to the physical and consideration as shown in Table 1. In the data
digital evidence that supports and validates the and evidence preservation stage, various
case. Due to the prevalence of DF as a complex challenges of the design have been cited with
infrastructure, forensics investigators confront the corresponding solution in [26] [42] [47]
new challenges that require comprehensive [48] [52] [53] [50] [43] [59] [46] [56], is the
and potential knowledge. Thus, the forensics data integrity and chain of custody. In data
investigator must be equipped with state-of- integrity and privacy, and SLAs are those
the-art knowledge and possess the expertise to issues, having almost the same number of
tackle the challenges. solutions with all the others added up as shown
in Table 1.
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
49
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
TABLE I: Overview of digital forensics stages mentioned stages and sub-categories possess a
and corresponding challenges quite enriched future for future research as
represented in Table 1.
Forensics
Stages framework References
challenges
5. PROPOSED FRAMEWORK FOR
THE DIGITAL FORENSICS
Not accessible
[30-67]
Identification

location-wise or
Unknown In this section, the proposed digital
Decentralized [43] [42] [46-48] forensics framework includes phase-wise flow
Data [50-69] for an effective process as shown Fig. 4.
[41] [47] [51] [52] Particularly, this framework covers all
CSP based
[53] [54] [55] [56]
Dependency
[57] [58]
essential areas from preparation of the
[47] [52] [51] [41] investigative to the finalization of the evidence
Recovery of collection. But, the devised phases help to
Understanding

[27] [53] [62] [63]

deleted data
[64] [56] maintain a coherent and abstract enhancing
Partial evidence [50] [47] [50] [66] efficient and appropriate investigation.
Furthermore, the data source verification and
[27] [53] [59] [44] the interactive sessions with the digital
Cryptography
[63] forensics administrations or digital forensics
Jurisdiction [41-67] expert from the preparation phase to the
establishment of evidence. Therefore, there are
Reporting

Crime scene
[42-54] four phases for this framework, and each phase
reconstruction
[41] [27] [38] [47] is formalized encompassing important steps.
Complexity of
cloud
[48] [59] [53] [63] Phase 1 deals with the preliminary preparation
[70] of the process for the evidence gathering by
Return of going through the planning for process by
Close

[42-44] [68], [69],

Evidence and
[70] getting official order for the investigation,
Secure Deletion verification of the data source whether it is
Lack of Log
[59], [61], [71-74]
primary data or secondary data, and finally, to
Examination

Framework have clear awareness regarding legal or

[27] [53] [59] [47] organizational ethical issues as shown in Fig.
Encrypted data
[48]
4.
lining [48] [51] [39]
After completion of the Phase 1, the Phase
[26] [28] [48] [51- 2 is started where a strong focus is paid on the
Inaccessibility
53] both aspects of the forensics process namely
Collection

Deleted data [27], [49-57] reactive forensics and proactive forensics as

shown in Fig. 4. The reactive forensics is
Multi-tenancy
and resource
[26] [42] [32] [48- applied when there is the perception of having
68] detected digital crime, in favor of legal
sharing
[26] [42] [47] [48] prosecution. This type of forensic reaction is
Preservation

Data integrity manifested in five steps, which integrate a

[51-70]
Chain of [41] [42] [47] [52] [51] conditional iteration facility for further
custody [61-69] possible forensic examination, which are given
Data volatility [46] [48] [52-66] below:
I. Identification: During this stage, the
Several solutions to the design challenges investigator identifies the available evidence
and access issues are based on previous and determines if it is an internal network or
experience and old-fashioned designs. All the cloud-based. In addition, the investigator
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
50
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
identifies the tools and techniques needed for evidence in already established crimes. In
subsequent processes. addition, to enhance digital forensics and the
pursuit of prosecution through the legal
II. Acquisition: Acquisition refers to the channel. Also, this process is the systematic
process of acquiring digital forensic evidence gathering and preservation of physical
by imaging. This process ensures the usability evidence that is not limited to DNA and
and admissibility of the evidence in a court of fingerprints etc. These encompass three
law while preserving the integrity of the primary processes namely securing the scene,
original materials. preservation of the physical environment, and
III. Preservation: The first responder detection of the incident or the crime.
performs preservation, where he or she is In the Phase 3, the presentation of the
supposed to isolate and secure the original process is initiated, but this is done having the
evidence in a manner that prevents documentation and cooperation and
contamination. coordination with the digital forensic expert.
IV. Examination: This is the core Because, the presentation marks the
process where facts are discovered through a completion of whole process, delivering the
systematic approach using forensic tools and ultimate results, facts, and findings culled from
techniques. the digital forensics processes. The facts and
information shared by the investigator
V. Analysis: In this last stage, the results determine whether the case of crime is being
of the examination are carefully analyzed, made in both the legal trial and the decision-
evaluated, categorized, and concluded. This is making of the organization. There are four
important for preparing and presenting the essential steps for this process which are as
digital forensics report successfully. follows:
I. Report: It provides an in-depth
description of the forensics case that outlines
the starting point, readiness for examination,
and the background of the examiner.
II. Reconstruction: the reconstruction
means an in-depth analysis and review of the
findings of the DF examination. It is a crucial
step that determines how certain results were
obtained; it serves different purposes in
investigations.
III. Distribution: It share the valuable
lessons learned from the completed digital
forensics process with concerned investigators
so that they are empowered to conduct future
investigations of a similar kind with greater
efficacy.
IV. Return of Evidence: The last task
Fig 4: Proposed digital forensics framework undertaken by the investigator is the
having four phases. systematic return of evidence to its rightful
On the other hand, proactive forensics owner so that integrity and transparency are
deals with the instant action taken in maintained in the investigative process.
safeguarding the evidence in a real Once a forensic case has been initiated,
investigation focused on the detection of then from the state of preparation to the
incidents or crimes. It also deals with securing presentation stage, it becomes highly
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
51
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
important. This precious record forms the proposed framework, it becomes essential to
cornerstone upon which the forensic report manage each stage of a forensic case with
will be written that will empower the care, from preparation through to
organizations and courts in deciding the presentation. Thorough documentation is
correct path towards justice. Moreover, all fundamental, as it serves as the foundation for
documentation is preserved by the digital the resultant forensic report, thereby
forensics administration or database. It equipping organizations and judicial
becomes a beacon in future investigations. authorities to make informed decisions
regarding justice. Moreover, all
6. Conclusion documentation is preserved by digital
Digital forensics presents complexities forensics administration or database systems,
due to the heterogeneous nature of the IoT ensuring availability for future investigations.
devices while also offering significant
AUTHOR CONTRIBUTION
advantages. It provides crucial security
measures to users against malicious activities Shauban Ali Solangi: Concept, idea, writing,
and criminal acts. Conducting digital forensics editing, review.
in an IoT environment demands a more
DATA AVAILABILTY STATEMENT
thorough and insightful investigation
compared to traditional digital forensic The data will be made available upon
methodologies. The IoT encompasses a reasonable request.
diverse array of technologies and devices,
including sensors, cloud computing, and radio
CONFLICT OF INTEREST
frequency identification (RFID) systems,
which collectively produce substantial No potential conflict of interest is reported for
volumes of data and create unique security this research.
challenges. Yet, technical as well as
nontechnical challenges arise from the nature
FUNDING
of IoT devices that hinder digital forensic in
the IoT domain. This study focuses on No funding is acquired.
identifying some of the salient challenges
faced in the effective conduct of IoT forensics. ACKNOWLEDGMENT
Moreover, the research identifies important We would like to thank the University of
domains for digital forensic inquisition that Sindh, Jamshoro.
can help in further improvements and inform
the development process. This study conducts
a comprehensive review of the current state of REFERENCES
IoT forensics, outlining the challenges
investigators routinely face. Furthermore, a [1] L. Da Xu, W. He, and S. Li, “Internet of
Things in Industries: A Survey,” IEEE Trans.
framework is developed to address these Ind. Informatics, vol. 10, no. 4, pp. 2233–
challenges and enhance the efficiency of data 2243, Nov. 2014.
analysis processes. Analyzing relevant [2] M. M. Aslam, K. Kalinaki, A. Tufail, A. G. H.
literature reveals significant issues related to Naim, M. Z. Khan, and S. Ali, “Social
the collection and preparation of evidence, Engineering Attacks in Industrial Internet of
Things and Smart Industry,” in Emerging
largely due to counter-analysis techniques and Threats and Countermeasures in
difficulties in data acquisition from devices Cybersecurity, Wiley, 2025, pp. 389–412.
and cloud services. The analysis also 2025.
emphasizes procedural matters concerning [3] A. Dehghantanha, “Internet of Things
investigator preparedness, reporting, and Security and Forensics: Challenges and
ethical considerations. By utilizing the
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
52
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
Opportunities,” Future Generation Computer [14] Panchiwala, Shivani, and Manan Shah. "A
Systems, vol. 78, no. 2, pp. 544-546.2018 Comprehensive Study on Critical Security
[4] H. M. Zangana and M. Omar, “Introduction to Issues and Challenges of the IoT World."
Digital Forensics and Artificial Intelligence,” Journal of Data, Information and Management
2025, pp. 1–30. doi: 10.4018/979-8-3373- (2020): 1-22.
0857-9.ch001. [15] M. Frustaci, P. Pace, G. Aloi, and G. Fortino,
[5] K. Khoumbati, S. A. Solangi, Z. Bhatti and D. “Evaluating Critical Security Issues of the IoT
N. Hakro, "Optimal Route Planning by World: Present and Future Challenges,” IEEE
Genetic Algorithm for Wireless Sensor Internet Things J., vol. 5, no. 4, pp. 2483–
Networks," 2020 International Conference on 2495, Aug. 2018.
Information Science and Communication [16] M. Stoyanova, Y. Nikoloudakis, S.
Technology (ICISCT), KARACHI, Pakistan, Panagiotakis, E. Pallis, and E. K. Markakis,
2020, pp. 1-4, doi: “A Survey on the Internet of Things (IoT)
10.1109/ICISCT49550.2020.9079944. Forensics: Challenges, Approaches, and Open
[6] S. A. Solangi, D. N. Hakro, I. A. Lashari, K.- Issues,” IEEE Commun. Surv. Tutorials, vol.
R. Khoumbati, Z. A. and Bhutto, and M. 22, no. 2, pp. 1191–1221, 2020.
Hameed, “Genetic Algorithm Applications in [17] K. Kaushik, M. Ouaissa, and A. Chaudhary,
Wireless Sensor Networks ( WSN ): A Advanced Techniques and Applications of
Review,” Int. J. Manag. Sci. Bus. Res., vol. 1, Cybersecurity and Forensics. Boca Raton:
no. 4, pp. 152–166, 2017. Chapman and Hall/CRC, 2024. doi:
[7] S. A. Solangi, K. Khoumbati, and D. N. 10.1201/9781003386926.
Hakro, “Multi-Hop Optimization in Wireless [18] M. Köhn, M. S. Olivier, and J. H. Eloff,
Sensor Networks using Genetic Algorithm,” ‘‘Framework for a digital forensic
Univ. Sindh J. Inf. Commun. Technol., vol. 3, investigation,’’ in Proc. ISSA, 2006, pp. 1–7.
no. 4, pp. 193–197, 2019. [19] W. Halboob and R. Mahmod, ‘‘State of the art
[8] S. A. Solangi, “Energy Efficient Strategy for in trusted computing forensics,’’ in Future
Wireless Sensor Networks lifetime endurance Information Technology, Application, and
using Genetic Algorithm,” Sukkur IBA J. Service. Dordrecht, The Netherlands:
Emerg. Technol., vol. 7, no. 1, pp. 48–55, Jul. Springer, 2012, pp. 249–258.
2024, doi: 10.30537/sjet.v7i1.1430. [20] M. D. Kohn, M. M. Eloff, and J. H. P. Eloff,
[9] N. Nathiya, C. Rajan, and K. Geetha, “A ‘‘Integrated digital forensic process model,’’
hybrid optimization and machine learning Comput. Secur., vol. 38, pp. 103–115, Oct.
based energy-efficient clustering algorithm 2013.
with self-diagnosis data fault detection and [21] H. I. Bulbul, H. G. Yavuzcan, and M. Ozel,
prediction for WSN-IoT application,” Peer-to- ‘‘Digital forensics: An analytical crime scene
Peer Netw. Appl., vol. 18, no. 2, p. 13, Apr. procedure model (ACSPM),’’ Forensic Sci.
2025. Int., vol. 233, nos. 1–3, pp. 244–256, Dec.
[10] V. Hassija, V. Chamola, V. Saxena, D. Jain, P. 2013.
Goyal and B.Sikdar, “A Survey on IoT [22] A. Agarwal, M. Gupta, S. Gupta, and S. C.
Security: Application Areas, Security Threats, Gupta, ‘‘Systematic digital forensic
and Solution Architectures”, 2019, in IEEE investigation model,’’ Int. J. Comput. Sci.
Access, vol. 7, pp. 82721-82743. Secur., vol. 5, no. 1, pp. 118–131, 2011.
[11] M. Bolatbek, G. Baispay, S. Mussiraliyeva, [23] R. Adams, V. Hobbs, and G. Mann, ‘‘The
and A. Usmanova, “A framework for advanced data acquisition model (Adam): A
detection and mitigation of cyber criminal process model for digital forensic practice,’’ J.
activities using university networks in Digit. Forensics, Secur. Law, vol. 8, no. 4, pp.
Kazakhstan,” Radioelectron. Comput. Syst., 25–48, 2013.
vol. 2024, no. 2, pp. 186–202, Apr. 2024.
[24] J. Williams, ‘‘ACPO good practice guide for
[12] R. Qamar and B. A. Zardari, “Introduction to digital evidence,’’ Metrop. Police Service,
the Internet of Behavior (IoB),” 2025, pp. 1– Assoc. Chief Police Officers, GB, Tech. Rep.,
20. doi: 10.4018/979-8-3693-7545-7.ch001. 2012.
[13] Global scale of installed IoT devices, [25] K. Kent, S. Chevalier, T. Grance, and H.
Available online: Dang, ‘‘SP 800-86. guide to integrating
https://www.informationmatters.net/internet- forensic techniques into incident response,’’
of-things-statistics/. Nat. Inst. Standards Technol., Gaithersburg,
https://www.statista.com/outlook/tmo/interne MD, USA, Tech. Rep., 2006.
t-of-things/worldwide, (accessed on 27-1-
2025) [26] W. G. Kruse II and J. G. Heiser, Computer
Forensics: Incident Response Essentials.
London, U.K.: Pearson, 2001.
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
53
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
[27] M. Reith, C. Carr, and G. Gunsch, ‘‘An Digit. Forensic Eng. (SADFE), Nov. 2005, pp.
examination of digital forensic models,’’ Int. 155–161.
J. Digit. Evidence, vol. 1, no. 3, pp. 1–12, [42] Z. Li, Q. A. Chen, R. Yang, Y. Chen, and W.
2002. Ruan, ‘‘Threat detection and investigation
[28] B. Carrier and E. H. Spafford, ‘‘Getting with system-level provenance graphs: A
physical with the investigative process,’’ Int. survey,’’ Comput. Secur., vol. 106, Jul. 2021,
J. Digit. Evidence, 2003. Art. no. 102282.
[29] V. Baryamureeba and F. Tushabe, ‘‘The [43] A. Al-Dhaqm, S. A. Razak, R. A. Ikuesan, V.
enhanced digital investigation process R. Kebande, and K. Siddique, ‘‘A review of
model,’’ Digit. Invest., 2004. mobile forensic investigation process
[30] S. O. CiardhuÆin, ‘‘An extended model of models,’’ IEEE Access, vol. 8, pp. 173359–
cybercrime investigations,’’ International 173375, 2020.
Journal of Digital Evidence, vol. 3, no. 1, pp. [44] M. Abulaish and N. A. H. Haldar, ‘‘Advances
1–22, 2004. in digital forensics frameworks and tools: A
[31] I. O, D. Chris, and D. David, ‘‘A new comparative insight and ranking,’’ Int. J.
approach of digital forensic model for digital Digit. Crime Forensics, vol. 10, no. 2, pp. 95–
forensic investigation,’’ Int. J. Adv. Comput. 119, 2018.
Sci. Appl., vol. 2, no. 12, pp. 175–178, 2011. [45] R. Agarwal and S. Kothari, ‘‘Review of digital
[32] S. Alharbi, J. Weber-Jahnke and I. Traori, forensic investigation frameworks,’’ in
“The Proactive and Reactive Digital Forensics Information Science and Applications
Investigation Process: A Systematic Literature (Lecture Notes in Electrical Engineering), vol.
Revoew,” Int. J. Security and Its Applications, 339. Berlin, Germany: Springer-Verlag, 2015,
vol. 5, no. 4, pp. 59-72, Oct 2011. pp. 561–571.
[33] Y. Yusoff, R. Ismail, and Z. Hassan, [46] P. Amann and J. I. James, ‘‘Designing
‘‘Common phases of computer forensics robustness and resilience in digital
investigation models,’’ Int. J. Comput. Sci. investigation laboratories,’’ Digit. Invest., vol.
Inf. Technol., vol. 3, no. 3, pp. 17–31, 2011. 12, pp. S111–S120, Mar. 2015.
[34] K. Kyei, P. Zavarsky, D. Lindskog, and R. [47] R. Montasari, ‘‘An ad hoc detailed review of
Ruhl, ‘‘A review and comparative study of digital forensic investigation process
digital forensic investigation models,’’ in models,’’ Int. J. Electron. Secur. Digit.
Digital Forensics and Cyber Crime, M. Rogers Forensics, vol. 8, no. 3, pp. 205–223, 2016.
and K. C. Seigfried-Spellar, Eds. Berlin, [48] R. Sabillon, J. Serra-Ruiz, V. Cavaller, and J.
Germany: Springer, 2013, pp. 314–327. J. Cano, ‘‘Digital forensic analysis of
[35] S. Bonomi, M. Casini, and C. Ciccotelli, ‘‘B- cybercrimes: Best practices and
CoC: A blockchain-based chain of custody for methodologies,’’ Int. J. Inf. Secur. Privacy,
evidences management in digital forensics,’’ vol. 11, no. 2, pp. 25–37, 2017.
2018, arXiv:1807.10359. [49] D. Desai, “Beyond location: Data Security in
[36] Z. Tian, M. Li, M. Qiu, Y. Sun, and S. Su, the 21st Century,” Commun. ACM, vol. 56,
‘‘Block-DEF: A secure digital evidence no. 1, p. 34, Jan. 2013.
framework using blockchain,’’ Inf. Sci., vol. [50] M. Irfan, H. Abbas, Y. Sun, A. Sajid, and M.
491, pp. 151–165, Jul. 2019. Pasha, “A framework for cloud forensics
[37] R. S. Greenfield et al., Cyber Forensics: A evidence collection and analysis using
Field Manual for Collecting, Examining, and security information and event management,”
Preserving Evidence of Computer Crimes. in Security and Communication Networks,
Boca Raton, FL, USA: CRC Press, 2002. John Wiley and Sons Inc., Nov. 2016, pp.
3790–3807. doi: 10.1002/sec.1538.
[38] D. Reilly, C. Wren, and T. Berry, ‘‘Cloud
computing: Forensic challenges for law [51] V. S. Harichandran, F. Breitinger, I. Baggili,
enforcement,’’ in Proc. Int. Conf. Internet and A. Marrington, “A cyber forensics needs
Technol. Secured Trans., Nov. 2010, pp. 1–7. analysis survey: Revisiting the domain’s
needs a decade later,” Comput. Secur., vol. 57,
[39] S. L. Garfinkel, ‘‘Digital forensics research: pp. 1–13, Mar. 2016, doi:
The next 10 years,’’ Digital Investigation, vol. 10.1016/j.cose.2015.10.007.
7, pp. S64–S73, Aug. 2010.
[52] A. Alenezi, R. K. Hussein, R. J. Walters and
[40] A. Guarino, ‘‘Digital forensics as a big data G. B. Wills, “A Framework for Cloud
challenge,’’ in ISSE Securing Electronic Forensic Readiness in Organizations,”
Business Processes. Wiesbaden, Germany: presented at the 2017 5th IEEE Int. Conf.
Springer, 2013, pp. 197–203. Mobile Cloud Computing, Services and
[41] G. Mohay, ‘‘Technical challenges and Engineering, San Francisco, CA, USA, Apr.
directions for digital forensics,’’ in Proc. 1st 6-8, 2017.
Int. Workshop Systematic Approaches to
Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
54
 Solangi, S. A., IoT Forensics: Addressing Challenges and Establishing a Framework for Exploring Digital Forensics
(pp. 43-55)
[53] M. B. Mukashe, J. L. Sedgwick and D. W. [62] S. Friedl and G. Pernul, “IoT Forensics
Hagy, “Electronic Crime Scene Investigation: Readiness - influencing factors,” Forensic Sci.
A Guide for First Responders,” NIJ., Int. Digit. Investig., vol. 49, p. 301768, Jun.
Washington, USA, Rep. NCJ 219941, 2001. 2024, doi: 10.1016/j.fsidi.2024.301768.
[54] G. S. Chhabra, P. Singh, “Distributed Network [63] V. Schmitt and E. Butterfield, “Digital
Forensics Framework: A Systemetic Review,” forensics in healthcare: An analysis of data
Int. J. Computer Application, vol. 119, no. 19, associated with a CPAP machine,” Forensic
pp. 31-35, Jun. 2015. Sci. Int. Digit. Investig., vol. 48, p. 301661,
[55] B. Singh and C. Kaunert, “Intelligent Machine Mar. 2024, doi: 10.1016/j.fsidi.2023.301661.
Learning Solutions for Cybersecurity,” 2024, [64] S. Brotsis et al., “Blockchain meets Internet of
pp. 359–386. 2024. doi: 10.4018/979-8-3693- Things (IoT) forensics: A unified framework
5380-6.ch014. for IoT ecosystems,” Internet of Things, vol.
[56] M. Ng, J. James, and R. Bull, “‘What you say 24, p. 100968, Dec. 2023, doi:
in the lab, stays in the lab’: A reflexive 10.1016/j.iot.2023.100968.
thematic analysis of current challenges and [65] S. Ruiz-Villafranca, J. M. C. Gómez, and J.
future directions of digital forensic Roldán-Gómez, “A forensic tool for the
investigations in the UK,” Forensic Sci. Int. identification, acquisition and analysis of
Digit. Investig., vol. 51, p. 301839, Dec. 2024, sources of evidence in IoT investigations,”
doi: 10.1016/j.fsidi.2024.301839. Internet of Things, vol. 27, p. 101308, Oct.
[57] J.-P. A. Yaacoub, H. N. Noura, O. Salman, 2024, doi: 10.1016/j.iot.2024.101308.
and A. Chehab, “Advanced digital forensics [66] V. R. Kebande, P. P. Mudau, R. A. Ikuesan,
and anti-digital forensics for IoT systems: H. S. Venter, and K.-K. R. Choo, “Holistic
Techniques, limitations and digital forensic readiness framework for IoT-
recommendations,” Internet of Things, vol. enabled organizations,” Forensic Sci. Int.
19, p. 100544, Aug. 2022, doi: Reports, vol. 2, p. 100117, Dec. 2020, doi:
10.1016/j.iot.2022.100544. 10.1016/j.fsir.2020.100117.
[58] T. Göbel, F. Breitinger, and H. Baier, [67] S. Rudrakar and P. Rughani, “IoT based
“Optimising data set creation in the Agriculture (Ag-IoT): A detailed study on
cybersecurity landscape with a special focus Architecture, Security and Forensics,” Inf.
on digital forensics: Principles, Process. Agric., vol. 11, no. 4, pp. 524–541,
characteristics, and use cases,” Forensic Sci. Dec. 2024, doi: 10.1016/j.inpa.2023.09.002.
Int. Digit. Investig., vol. 52, p. 301882, Mar. [68] D. Dunsin, M. C. Ghanem, K. Ouazzane, and
2025, doi: 10.1016/j.fsidi.2025.301882. V. Vassilev, “A comprehensive analysis of the
[59] A. Wickramasekara, F. Breitinger, and M. role of artificial intelligence and machine
Scanlon, “Exploring the potential of large learning in modern digital forensics and
language models for improving digital incident response,” Forensic Sci. Int. Digit.
forensic investigation efficiency,” Forensic Investig., vol. 48, p. 301675, Mar. 2024, doi:
Sci. Int. Digit. Investig., vol. 52, p. 301859, 10.1016/j.fsidi.2023.301675.
Mar. 2025, doi: 10.1016/j.fsidi.2024.301859. [69] S. Khanji, O. Alfandi, L. Ahmad, L. Kakkengal, and
[60] C. Hargreaves, F. Breitinger, L. Dowthwaite, M. Al-kfairy, “A systematic analysis on the
H. Webb, and M. Scanlon, “DFPulse: The readiness of Blockchain integration in IoT
2024 digital forensic practitioner survey,” forensics,” Forensic Sci. Int. Digit. Investig., vol.
Forensic Sci. Int. Digit. Investig., vol. 51, p. 42–43, p. 301472, Oct. 2022, doi:
301844, Dec. 2024, doi: 10.1016/j.fsidi.2022.301472.
10.1016/j.fsidi.2024.301844. [70] A. R. Javed, Z. Jalil, W. Zehra, T. R. Gadekallu, D.
[61] P. Binnar, S. Bhirud, and F. Kazi, “Security Y. Suh, and M. J. Piran, “A comprehensive survey
analysis of cyber physical system using digital on digital video forensics: Taxonomy, challenges,
forensic incident response,” Cyber Secur. and future directions,” Eng. Appl. Artif. Intell., vol.
Appl., vol. 2, p. 100034, 2024, doi: 106, p. 104456, Nov. 2021, doi:
10.1016/j.csa.2023.100034. 10.1016/j.engappai.2021.104456.

Sukkur IBA Journal of Computing and Mathematical Science - SJCMS | Vol. 8 No. 1 Jan – Jun 2025
55