# Research on Digital Forensics Analyzing Heterogeneous Internet of Things Incident Investigations
## 6 Discussion  
This section provides a detailed analysis of the results and insights obtained from our experimental setup, focusing on data acquisition from the SmartThings and Aqara platforms, as well as from the NAS and IP camera devices. Our experiments with the SmartThings and Aqara platforms demonstrated that effective data collection is feasible through OSINT and applications, regardless of the device's operational state. For active devices, network-based data acquisition methods proved efficient. However, in inactive states, we shifted to hardware-based approaches. This two-pronged strategy allowed for versatile and adaptable data collection. Data gathered from NAS devices in active states included network configurations, service status, and process-related information. Conversely, when these devices were inactive, we could obtain file system data, details on malicious files, and log data. A significant challenge was hardware disassembly, especially as UART and JTAG connections required soldering for access, as they were part of the printed circuit board. Regarding IP camera devices, active data acquisition provided access to network details, account information, and service configurations. Remote services like SSH could be utilized for additional data collection. Disassembling the hardware, we achieved system access via UART ports, although limited to a restricted shell rather than a full root shell. Despite this limitation, it allowed us to gather crucial network and system information. Additionally, memory dumping was feasible using a small outline integrated circuit test clip on the accessible 8-pin flash memory. We encountered several challenges in our research:  
Disparities in API requirements across different platforms necessitated varied methodologies and scopes for data acquisition. Relying on APIs for OSINT often required specific account information and did not encompass all cloud-stored data, leading to gaps in comprehensive data collection. Accessing hardware debugging ports was complicated due to security measures implemented by manufacturers, posing a challenge in physically examining the devices. The encryption of network packet data, particularly the use of TLS encryption by many smart-home devices, made intercepting data transmissions difficult. Theoretical methods like TLS downgrade attacks were conceivable, but their practical application was limited due to the need to modify smart-hub root certificates, hindering effective packet decryption. In response to these challenges, we explored alternative methods, such as using encrypted network packet headers to identify device manufacturers or types. Although this did not grant direct access to communication content, it provided valuable insights into the types of operational devices. In the field of OSINT investigations, retrieving personal data from cloud-based platforms is a key focus area, presenting a significant challenge due to limited access. This highlights a major constraint in cloud-based digital forensics. Investigations involvingapplication data are also hampered by a reliance on mobile devices, potentially leading to gaps or inaccuracies in the gathered information. Network data acquisition, primarily focused on intercepted data, faces hurdles due to widespread encryption, complicating the analysis of communication content. In terms of hardware investigations, both chip-off analysis and debugging port analysis have their inherent limitations: chip-off analysis risks irreversible device damage and accessing debugging ports is typically successful only with less secure devices [34]. These challenges emphasize the need for developing diverse and adaptable forensic methodologies within IoT environments, considering the varying security measures and data accessibility issues across different devices and platforms. These findings underscore the complex nature of digital forensics in smart-home environments. The variety of devices and platforms calls for a dynamic and adaptive approach to data acquisition.