A self-contained emulator for the forensic examination of IoE scenarios

Abstract

With the number of cyber incidents on the Internet of Everything (IoE) increasing every year, so does the amount of forensic investigations that are carried out in this environment. As the research community is avidly working on the development of solutions that can assist in the examination process, it is crucial to, firstly, have access to a resource that can facilitate the process of learning the characteristics of these investigations, and, secondly, to have a testbed that allows evaluating the effectiveness and feasibility of new solutions. Likewise, from an educational standpoint, having access to assets that allow interacting with these devices in a simple and efficient way can lead to learners getting a better understanding of the forensic characteristics and requirements of this environment. In view of this, a self-contained emulator for the forensic examination of these scenarios is presented in this article that mirrors their static and dynamic by emulating both the firmware of the devices that comprise them and the multiple network protocols used in them. Additionally, the emulator offers the capability to deploy digital twins within IoE scenarios, enhancing its utility for cybersecurity forensic investigations and training sets. To demonstrate its feasibility and convenience, two case studies are presented that emulate different IoE forensic contexts, showing that the proposal is capable of emulating their static and dynamic behaviour, and that it can be used to perform different forensic tasks.