Reference no: EM132293985

Assignment

The aim of this assignment is to focus on the implementation of Digital Forensics to the Internet of Things (IoT). This assignment consists of a theoretical component, which requires the application of reasoning to provide a solution to real-world problems, as well as a practical component.

The IoT is starting to form a great part in modern society, as IoT devices are starting to be used in more environments, fulfilling various tasks and requirements. IoT devices are devices that give physical entities, virtual entities by connecting the physical entities to the internet and various digital systems.

IoT devices can be seen as small computing devices, with rather specific uses. IoT devices are therefore usually resource constrained, which means the IoT devices do not have high performance hardware compared to normal computers.

IoT devices can however pose a threat to digital systems, as they can be vulnerable to cyber-attacks. This assignment will focus on the digital forensic aspects of IoT devices and how IoT devices change the Digital Forensic environment.

Your assignment is to conduct research on an incident where an IoT device(s) has/have been compromised in a cyber-attack, as well as the practical application of Digital Forensics with regards to IoT devices.

You will be required to find open-source tools that can be used in digital forensic investigations for this purpose. You will, however, be required to use various tools by making use of a Google Sheet document by "claiming" various tools that have been identified. This will ensure that not all the students make use of the same tools.

This will work on a first-come-first-served basis. For example, if you "claim" to use "Tool A", then we will cap the maximum number of students to, for example, 5 students. That means, if the maximum number of students for "Tool A" has been reached, you should claim another one, e.g. "Tool B". The "claim" procedure will be given later. Failing to use unique tools will cost you marks, i.e. is the maximum number of students for "Tool A" has been reached, yet you continue to use "Tool A", you will lose significant marks.Various theoretical tasks of the assignment:

1. Identify an incident where an IoT device(s) has/have been compromised in a cyber-attack. Provide details about the incident as to how the device(s) has/have been compromised and how it impacted the environment/systems that it formed a part of. Provide details as to how

it affected the availability and/or integrity and/or the confidentiality of the system it formed a part of.

2. Make use of a model framework for conducting digital forensic investigations and apply the framework to the identified scenario. For each of the steps in the identified framework, specify how you would conduct a forensic investigation on the IoT device(s) that formed part of the incident identified in question 1. Remember to reference the framework you identified.

3. Identify 2 possible solutions that could have prevented the cyber-attack in question 1. Discuss how these solutions could have prevented the cyber-attack. Hint: pay special attention to solutions that can be applied to IoT devices.

4. Identify 3 possible sources of evidence that can be gathered before an incident occurs, which can assist forensic investigators in their investigations in IoT-related cyber-attacks. The sources of evidence should thus be gathered before a possible incident occurs, which will speed up the forensic investigation, should an incident take place. Motivate your chosen sources of forensic evidence.

Practical tasks of the assignment:

5. Find an open source digital forensic investigation tool that can gather one of the identified sources of evidence that you mentioned in question 4 of the theoretical part of the assignment. Provide an overview of the tool that you identified and how the tool enables forensic investigators to use the evidence gathered using the tool. Note that the tool doesn't have to be specific to IoT devices as some sources of evidence can be universal. In other words, it can be applicable to various storage mediums and system information on various types of devices.

Please send an email to the provided email address to indicate which tool you would like to use for this question. Students will be limited to only 5 students for a specific tool, so choose quickly before your desired tool are no longer available. Failure in adhering to the limitation of only 5 students per tool will result in a penalty of 3 marks.

6. Illustrate the working of the open-source tool by showing how the tool can be useful in forensic investigations. The purpose of this question is to determine whether or not the tool is effective in providing forensic investigators with trustworthy evidence. Explain your steps and provide screenshots of how the tool gathers evidence. You will aslo be required to demonstrate the at a certain time after the project hand-in deadline.

Second theoretical part

Massive data centres such as Google, Microsoft and Firefox use tools to conduct live forensic analysis of their server farms. These tools are usually custom developed, due to the sheer size of these data centres. IoT devices are being utilised in modern society in enormous numbers. The problem with IoT devices is that there are limited to no tools that can be used specifically for IoT devices.

7. Find 1 open-source tool used in massive data centres for live forensic investigations. Provide an overview of what the tool does and how it works.

Please send an email to the provided email address to indicate which tool you would like to use for this question. Students will be limited to only 15 students for a specific tool, so

choose quickly before your desired tool are no longer available.

8. Would this tool be adaptable to work on IoT devices? Motivate your answer. If you are of the opinion that the tool can be used for IoT devices, list the reasons why this is the case. If you are of the opinion that the tool cannot be used on IoT devices, state the reasons why this is the case.

Second theoretical part
This part of the assignment requires the practical implementation of a tool, developed by yourself, to conduct forensic investigations of IoT devices. The tool must be used to preserve digital evidence from some IoT device.

An example of such a tool is a tool that can compare two images of a system. The tool will then be able to analyse the two versions of the file system and identify the files that changed between the two versions of the file system. The tool must conduct the comparison in a forensically-sound manner.