Internet of Things Forensics

Forensically sound collection, analysis, and incident response for data from IoT devices, from wearables and home automation to connected vehicles, with chain of custody preserved for use in litigation.

Submit a case All Digital Forensics

Internet of Things Forensics capabilities

IoT Data Collection and Preservation
We collect and preserve data from IoT devices, including wearables, home automation devices, and connected cars, following a strict, forensically sound process. Each engagement begins with a customized collection plan that protects data integrity, preserves chain of custody, and ensures admissibility in court.
IoT Data Analysis and Review
Our experts analyze and review data drawn from a wide range of IoT devices using advanced analytics tools to search and filter large volumes of data. We surface relevant evidence and present it clearly and concisely while maintaining its integrity and admissibility.
IoT Incident Response
We deliver rapid, effective response to security incidents involving IoT devices, identifying and isolating affected devices while minimizing disruption to business operations. We also work to identify the underlying vulnerability and provide recommendations to help prevent future incidents.
Technology and Innovation
We invest continuously in proprietary technology and workflows that allow us to process and review large volumes of IoT data efficiently and cost-effectively.
Customized, Court-Ready Solutions
Every matter is unique. We tailor each engagement to the client's goals, devices, and budget, prioritizing the integrity and admissibility of data throughout the entire process and providing clear, concise reporting at every stage.

Internet of Things Forensics — matters we are engaged for

A connected device is the only witness
Access control systems, vehicle telematics, building sensors and wearables record presence and timing that no human recalls precisely. Whether that record is usable turns on how it is captured, because most of these devices were never designed to be examined.
Firmware and cloud hold different halves of the story
The device retains recent state; the vendor's cloud retains history. Neither alone answers the question, and the two are frequently inconsistent in ways that themselves need explaining.
A device must be examined without altering it
Many IoT devices have no read-only mode and begin overwriting on power-up. Deciding acquisition order before touching anything is the difference between evidence and a plausible reconstruction.
Vendor cooperation is required and slow
Much of the useful record sits with the manufacturer under retention policies measured in weeks. Identifying what to request, and from whom, early enough for it to still exist is the practical constraint.

Internet of Things Forensics — frequently asked questions

What types of IoT devices can you work with?

We collect, preserve, and analyze data from a wide range of connected devices, including wearables, home automation devices, and connected cars, using specialized tools and techniques suited to each device type.

How do you keep IoT evidence admissible in court?

We follow a strict, forensically sound process designed to maintain data integrity and chain of custody from collection through analysis and reporting, so that the resulting evidence is admissible in court.

Can you respond to a security incident involving IoT devices?

Yes. Our IoT Incident Response service provides rapid identification and isolation of affected devices while minimizing impact on business operations, and we identify the underlying vulnerability and recommend measures to prevent future incidents.

How does an IoT forensics engagement begin?

Each engagement starts with a thorough understanding of the client's needs, including the type of data involved, the devices in question, and the associated risks. From there we develop a customized plan for collection, analysis, or incident response tailored to the matter.

More Digital Forensics questions answered →

Digital Forensics experts who testify to this work

Full expert panel →

J-Michael Roberts
Senior Director
Digital Forensics · Incident Response · Malware Reverse Engineering
Daniel B. Garrie
Founder
Digital Forensics · Expert Witness Testimony · Incident Response
Roland Cloutier
Expert Consultant
Incident Response · Expert Witness Testimony