Evidence Gathering in IoT Criminal Investigation

The Internet of Things (IoT) is a new paradigm. It enables communication between physical “things” through a common and distributed architecture. It is based on objects deeply rooted in the intimate lives of users. The devices are constantly scanning and interacting with this physical world. They bear witness to past events and are therefore a rich source of information for criminal investigations. The collection of evidence from the connected infrastructure is a decisive phase of the success of the police investigation. It is about removing objects from their initial environment and placing them in a controlled and secured area. This action allows the evidence to be preserved for later examination. It is crucial, but nevertheless difficult. It can alter or destroy valuable data during manipulation. Moreover, the difficulty lies in the heterogeneous nature of the devices and their strong dependence on the environment. This paper focuses on the collection of IoT devices at the local level, linked to an investigative strategy. It presents several tools and methods to retrieve the objects and proposes to evaluate its relevance in a use case.