# Smart Digital Forensic Readiness Model for Shadow IoT Devices
## 3 Conceptual Model for Digital Forensic Readiness in Shadow IoT Devices
### Stage A: Device Connection  
The SIoTDFR model involves the connection of known (legitimate) or shadow (illegitimate) IoT devices to the enterprise network. In this Bring Your Own Device (BYOD) dispensation, organizations have indirectly opened up their network to both legitimate and shadow IoT devices. Hence, the first stage of the SIoTDFR manages the connection of both shadow and legitimate IoT devices to an enterprise network. Examples of such IoT devices are fitness trackers, smart watches, biosensors and smart thermometers. The flow diagram of the SIoTDFR model device connection stage is depicted in Figure 2.  
It is crucial that organizations put in place security measures for their network to ensure that the activities on the network are properly monitored and to enforce compliance with organizational policy. At step 1 of this stage, the researchers assume that each organization puts in place a proprietary network activity monitoring system as a security measure. Step 2 implies that the proprietary network is also able to detect devices as they connect. At step 3, any attempt of an IoT device--be it shadow or known--to join an enterprise network is inspected to confirm the status of the connection as either successful or otherwise. Steps 1-3 serve as the input to this stage. After step 3, it becomes possible to determine the devices that are connected to an enterprise network. Step 4 represents the gathering of potential digital evidence (PDE) artefacts. Three (3) PDE artefacts are gathered at this stage, which are timestamp of device, connected device name, device type.  
Figure 1: High-Level Overview of SIoTDFR.  
The PDE gathered is passed to stages D, E and F of the SIoTDFR model, as the respective input and output of these stages are indicated by steps 12-14. For the sake of clarity, these stages (D-F) are already discussed at this point.  
Stage D is the digital evidence-gathering stage and it is represented as step 12 in all the flow diagrams shown in this article. Stage D serves as the collector of the PDE for the SIoTDFR model. It involves the logging of potential evidence while ensuring there has occurred no alteration of the digital evidence. The input to stage D is therefore the PDE discovered at each stage of the SIoTDFR model. The process involved here includes the logging of the PDE as strings of characters, while the output involves passing the strings to stage E.  
Stage E is the digital evidence preservation step, presented as step 13 in all the flow diagrams in this article. In order to secure the integrity of the logged PDE collected in stage D, hashing is introduced to the logged PDE at stage E. As mentioned above, the input of stage E involves accepting the strings from stage D and transforming them into hashed values. The hashed values are then passed to stage F as the output of stage E.  
Stage F, the last stage of the SIoTDFR model, enforces the secured storage of the PDE gathered during the previous stages of the model. Stage F is therefore named digital evidence secure storage, and it is the 14 th step in the entire SIoTDFR model process. The hashed values from stage E are the input into this stage, and the process involves a two-factor authentication of the database as well as enforcing access control to the database. The next section explains the concept of identification of connected devices and how they are sorted into either known or shadow device categories.