The Truth Shall Set Thee Free: Enabling Practical Forensic Capabilities in Smart Environments

scale, the analysis performed on data collected from multiple devices may reveal substantially more forensic details about the activities occurring in the smart environment at any time.In fact, in some countries, insurance companies have started giving incentives to customers if they install measures like smart lighting, smart energy management systems, smart fire, or water monitoring devices [8].Nonetheless, current smart home/office platforms do not provide any means for forensic analysis.Indeed, the limitation of available computing resources in the majority of the smart devices [9]-[14] and the distinctive cloud-based architecture of most smart home/office platforms [15] make it very challenging to store data inside these devices [16]-[19], rendering traditional forensic analysis unsuitable for the smart environment.Additionally, the most popular platforms (e.g., Samsung SmartThings, Apple HomeKit) do not provide any mechanisms to access and indefinitely store smart data in the cloud [20].Prior research works have proposed logging techniques to collect data from smart apps and devices [21], [22] to implement, for instance, IoT data provenance analysis [23].However, these works either (1) do not specifically focus on utilizing the data collected from the smart environment to implement forensic solutions; (2) assume trusted devices which may be unrealistic nowadays [24]; or (3) do not directly consider forensically-relevant activities and behaviors in their threat models.In addition, traditional forensic solutions targeting smart systems only focus on specific data formats (e.g., video streaming extracted from a smart camera) to perform their analysis [25], which are not always available in every forensic evaluation.To overcome these limitations, we introduce VERITAS 1 , a novel and practical forensic analysis framework that uses data collected from the smart environment to support traditional forensic investigations.With VERITAS, we aim to fill the gap between current digital forensics and the unique data-rich characteristics of modern smart environments, providing a forensic solution that considers data from every device and app used in the smart environment for a more comprehensive analysis.VERITAS has two main components: the VERITAS Collector (VC) and the VERITAS Analyzer (VA).The VC automatically analyzes and modifies smart 1 In Roman mythology, VERITAS is the goddess of truth.Abstract-In smart environments such as smart homes and offices, the interaction between devices, users, and apps generate abundant data.Such data contain valuable forensic information about events and activities occurring in the smart environment.Nonetheless, current smart platforms do not provide any digital forensic capability to identify, trace, store, and analyze the data produced in these environments.To fill this gap, in this paper, we introduce VERITAS, a novel and practical digital forensic capability for the smart environment.VERITAS has two main components: Collector and Analyzer.The Collector implements mechanisms to automatically collect forensically-relevant data from the smart environment.Then, in the event of a forensic investigation, the Analyzer uses a First Order Markov Chain model to extract valuable and usable forensic information from the collected data.VERITAS then uses the forensic information to infer activities and behaviors from users, devices, and apps that violate the security policies defined for the environment.We implemented and tested VERITAS in a realistic smart office environment with 22 smart devices and sensors that generated 84209 forensically-valuable incidents.The evaluation shows that VERITAS achieves over 95% of accuracy in inferring different anomalous activities and forensic behaviors within the smart environment.Finally, VERITAS is extremely lightweight, yielding no overhead on the devices and minimal overhead in the backend resources (i.e., the cloud servers).