# Non-Volatile Memory Forensic Analysis in Windows 10 IoT Core
## 1 Introduction
### Problem Discussed and Research Motivation  
The weakness of the security measures of IoT devices and systems, combined with the appearance of IoT malware samples, has translated into an increase in the number of cyberincidents. In order to respond to these incidents, and to determine what has happened in them, researchers are developing forensic techniques, adapting them to the characteristics of the environment in which the incidents take place. Given the novelty of the IoT, the current state of the art has not been adjusted to it yet. As a consequence, the only option for investigators is to follow conventional approaches and try to modify them in order to be able to carry out the examinations. This produces inefficient forensic investigations, and, what is most concerning, can even lead to the inadmissibility of evidence if it is not handled appropriately. In order to comprehend how distinct the characteristics of the IoT environment are compared with those of conventional forensics, the most relevant ones are listed and described below. In addition, we also explain how each one of them affects the investigation process, and why it complicates the development of techniques or the use of conventional ones. These characteristics are the following:  
Purpose. The main characteristic, although it may seem obvious, is the functionality for which IoT has been conceived, which is what shapes the creation of devices and systems. They have not been designed to improve the performance of previous devices, but to provide new contexts with technology or ones that did not have any. Therefore, some of the IoT systems have scarcely any similarities with conventional ones, so, in certain cases, they cannot be used as a reference. Connectivity. It is quite common to find IoT networks in which multiple devices are present. In fact, most of the topologies are based on the interaction between the units present in it. As a consequence, a cyberincident will likely affect more than a single device and, if it is not the case, the data that has been exchanged in the network will be a valuable source of information. This increases the range of forensic investigations, as more devices have to be studied, and changes the perspective from which it has to be addressed, as now that perspective becomes a collective one. Computational capacity. One of the main characteristics of the context is the reduction in computational capacities in exchange for mobility. Consequently, the storage of the devices has been reduced significantly compared with that of conventional ones, meaning that fewer sources of evidence are available for investigators. It also affects the lifetime of the data, which is now shorter. In addition, the lack of computational power complicates the possibility of carrying out a live analysis, since it takes more time to execute tasks. Therefore, understanding how a device or system works is more crucial than ever, so that no evidence is left out. Location. IoT devices have been designed to be installed in confined places or even be embedded into objects. This, added to the fact that two devices in the same network can be in very distant locations, which means that the investigator may not always have physical access to them. As a consequence, the acquisition, and analysis phases must be adapted in order to provide techniques to follow a live approach, which is not very common in conventional forensics. Heterogeneity. There are a great number of devices that coexist in the IoT, and they are used for very diverse purposes. E-health, smart cities or smart industry are three examples of different contexts in which IoT devices are present, and each one of them has its own characteristics and requirements. In fact, there are systems that have been designed to be only used in a specific scenario. Consequently, it is quite difficult for the forensic community to develop solutions, such as tools or methodologies, that can satisfy the requirements of all of them by following a general approach.