# Non-Volatile Memory Forensic Analysis in Windows 10 IoT Core
## 1 Introduction  
Among the different definitions of the term things, one of them describes it as \"an object not specifically named or designated\". Even though it might not seem that this non-specific concept can be applied in a scientific context, it turns out that it is completely accurate when used to describe the new paradigm existing in computer science. The internet of things (IoT) offers such a wide range of options and features that it is not possible to narrow it down. IoT devices can be present anywhere, and we are using them without even noticing. Everyday technology users will find themselves using drones, smart TVs, smart speakers or simply sensors in their home to measure temperature. Nevertheless, the context in which IoT devices are present is not only limited to the smart home environment, as other fields such as eHealth or smart industries have their origin in the application of the IoT in certain scenarios. According to a Gartner estimation [1], in 2018 there were more than 11 billion IoT devices installed, and an increase of almost twice this value is predicted for 2020, with 20.4 billion. Regarding the context in which they are used, the consumer segment is the one where more IoT units are installed, accounting for 63% of them. The coexistence of this huge number of devices translates into an advantage for consumers, offering a wide variety of options to choose from, and numerous contexts in which they can use IoT devices, but this is a big inconvenience for developers. The heterogeneity of the platform hinders the establishment of a common ground to be shared by all the systems. This is not the only negative aspect of the IoT, as a greater concern involves cybersecurity. The security measures implemented on the devices, especially during the IoT's conception, turned out to be a huge underestimation of the requirements that these devices and the information that they handle demand. The prioritization of usability, added to the failure at that time to appreciate that something as simple as a smart bulb could compromise the security of an entire network, resulted in a false sense of security. Nowadays, companies and developers have acknowledged this issue, takingsteps to improve the protection of the devices and their information, although there is still a very long way to go. It must be remembered that the data that this environment is handling is very sensitive, especially in contexts such as eHealth or smart homes. In addition, IoT devices are also present in critical environments, carrying out very delicate tasks, so the impact that an incident might have in these scenarios could be catastrophic. Furthermore, this is a concern that is currently having negative consequences, so time is working against us. The need to implement proper security on these devices is imperative. This situation has created a perfect environment for cybercriminals, as they can obtain high rewards with very little effort. This is evidenced by recent studies in which malware samples explicitly designed for the IoT are analyzed. In the year 2018, more than 120 thousand malware samples were detected, which was an increment of almost four times compared with 2017 [2], with distributed denial of service (DDoS) attacks, cryptocurrency mining and data theft being the most common types. Most worrisome is the infection vector used by them; the Mirai botnet family took control of the system through a dictionary attack on the devices that still had the default credentials [3]. It might seem an obvious attack that would have had no impact on a system, but it was just the opposite. The first version affected more than 600 thousand IoT units, and, with its different variations, went on to infect millions, proving the weakness of the security measures of the devices. Such was the success of this malware that in 2018, two years after the first version was detected, 20.9% of the samples of IoT malware belonged to the Mirai family, and new versions still appear every day.