# Smart Digital Forensic Readiness Model for Shadow IoT Devices
## 2 Background
### IoT Digital Forensic Challenges  
IoT forensics is that aspect of digital forensics that is aimed at identifying and extracting legally acceptable and forensically sound digital information from the IoT ecosystem. Unlike the digital forensic field where computers, servers and gateways (among others) act as digital evidence sources, sources of digital evidence in IoT forensics involve things such as fitness trackers, medical implants, smartwatches and infant monitoring systems [8]. The seamless ubiquity of IoT devices and the disparate technologies within the IoT ecosystem have made digital investigation and forensic readiness processes complex and difficult for the digital forensic community to conduct.  
The IoT ecosystem has grown exponentially and there are high expectations of sporadic explosions. For instance, according to CISCO predictions [9], 500 billion IoT devices will be networked and connected to the internet by the year 2030. By 2026, the IoT market cap is expected to extend to 771 billion USD. This explosion in the use of IoT devices has opened up a new area of concern for the forensic community. Since IoT devices engage with the public, the IoT ecosystem has been brought into the limelight of security and privacy risks at a different level. Additionally, any network joined by these devices is subject to their vulnerabilities [8]. IoT technologies and devices have furthermore tainted the cyber-physical space with virtual crimes that may become threats to human life. For example, a group of researchers were able to access a livestockman video from inside the house of an owner of a smart vacuum cleaner by using the login portal and so managed to hijack the vacuum cleaner [10]. Smart locks can be configured to either lock or open when a particular condition is satisfied. If such a device is hijacked by a criminal, it can become life-threatening by turning digital risks into cyber-physical threats.  
Furthermore, reference [4] suggest that the limited computational resources and memory capability of IoT devices constitute a major limitation and can cause untraceable security concerns to the community. The lifespan of data generated and stored on IoT devices is short-lived and the data that is supposed to serve as digital evidence ends up being deleted or written over easily--thus introducing a security challenge to the forensic evidence gathering community.  
According to [4], the amplifying rate at which IoT devices are manufactured and released into society introduces a high level of complexity into forensic investigations as there is so much variation in the functionality and operating systems used by the different IoT devices. The forensic tools in existence at the moment struggle to adapt to the varying characteristics presented by the IoT ecosystem. Another vital point significant to IoT forensics mentioned by [11] is the resilience of IoT devices to physical attacks, theft and natural disaster due to their miniaturized nature. These makes it easy for evidence to be carted away, deleted or erased without trace. The issue posed by these IoT devices would be minimal or controllable if they are known by the network administrator of the enterprise network. Shadow IoT device is liable to introduce greater vulnerabilities, threats and criminal acts to the enterprise network.  
The aforementioned challenges need the intervention of the forensic community in terms of digital forensic measures as well as proactive measures in case of any criminal activity.