# Smart Digital Forensic Readiness Model for Shadow IoT Devices
## 1 Introduction  
Internet of Things (IoT) has introduced a vast number of smart 'things' or 'devices' that support various applications, services and platforms. IoT offers a wide range of opportunities to various business sectors and these have a huge impact on society and modern-day interactions. IoT furthermore aims to introduce intelligent collaborations and communications among devices, systems and humans through the use of the internet, different protocols and technologies [1]. For instance, many countries are now seamlessly adopting and integrating IoT solutions into their existing critical health infrastructures for the monitoring, tracking, detection and prevention of the COVID-19 disease [2]. Physically connected thermometers, body temperature sensors, smart wearables, smart clothing and IoT buttons are some of the IoT devices that help provide patients with significant care so they can recover more quickly. Despite having brought ease and convenience by its sensitivity to human needs and digitalization, the high rate of IoT acceptance into the various domains of wellbeing and life has resulted in a huge platform for attacks, threats and security concerns [1, 3]. New concerns about the field of forensics have also emerged with the proliferation of IoT and its activities [4, 5]. Furthermore, IoT devices such as IP cameras, thermostats, fitness trackers, and wearables can become so-called'shadow' IoT devices if they use their data link communication privileges to connect to any network, without the prior knowledge of the network administrator. Hence, shadow IoT devices are IoT devices that have the ability to join, interact, perform some activities as well as leave the network without being noticed by the network administrator. Such devices may or may not introduce vulnerabilities or loopholes in anetwork. When they do this, attackers or adversaries could exploit them to carry out their criminal activities. According to [6], the varying activities of IoT devices may provide potential evidence for a forensic investigation, although, more often than not, their activities are short-lived and disappear soon after gaining access to the network. These short-lived activities can introduce security breaches, privacy issues as well as crimes that are difficult to trace in forensic investigations, since it is difficult to gather evidence from a shadow IoT device if it is no longer connected to the network. Therefore, the incorporation of digital forensic readiness in such networks is inevitable for the monitoring of shadow IoT devices and their activities. Conventional digital forensic readiness approaches are not suitable for IoT devices as they are light-weight and resource-constrained. Digital forensic processes are suitable for conventional devices such as computers, servers and smartphones, but IoT forensics needs to counter a far more extensive attack surface compared to conventional digital forensics [7]. For example, numerous shadow IoT devices interact with public interfaces, which makes them highly susceptible to malicious infestation and can become a security trap to enterprise networks. Shadow IoT devices generate vast amounts of digital data and records that become untraceable once they disconnect from the enterprise network. Such digital data and records might be important digital evidence when an unwanted incident occurs, but when the shadow IoT devices are not connected anymore, there is no way to acquire the necessary digital evidence. The preservation of such digital evidence is vital for a digital forensic investigation. The contributions of the paper are as follows. This work addresses the challenge of shadow IoT device inclusion in a network by identifying and monitoring shadow IoT device traffic, features and behaviour. It further presents a digital forensic readiness model applicable to organizations with shadow IoT devices. Potential sources of digital evidence that are applicable to IoT networks are also identified in this study.