# Forensic Analysis on Internet of Things (IoT) Device Using Machine-to-Machine (M2M) Framework
## 2 Literature Survey
[38] proposed an application-specific forensic investigative model which combines the process of forensics as evidence collection, examination analysis, and application-specific reporting. This study highlighted the importance of this model in the traditional forensic model as well. The proposed model consists of three independent components as application-specific forensic, digital forensic, and forensic process. Information fetched from application-specific and digital forensic goes to the forensic process, which provides final evidence of the cyberattack. This study provides a holistic overview of the development of the proposed model, guidelines, and tools which will be helpful in forensic investigation to deal with evidence in different IoT systems. [PERSON] et al. [39] proposed a forensic investigation model for IoT devices. The advancements in technology have provided many open-source tools for investigating digital forensics in IoT networks. In this research, the most cost-effective tools for gathering and examining evidence from IoT devices have been proposed. IoT forensic investigation framework is also proposed which consisted of three layers, the IoT Application Layer which is responsible for monitoring communication between servers and application at cloud level, the Network Layer which is responsible for communication of all layers, and the IoT Device Layer which is responsible for the generating data which are stored at the same level or pushed on cloud servers. Overall, open-source tools along with the proposed framework are highly recommended for any forensic investigation of IoT networks because in any IoT network, multi-vendor tools make investigation complex. [PERSON] et al. [40] proposed a a conceptual architecture for smart digital forensic readiness (SloTDFR). SloTDFR consists of six steps which include IoT device identification, IoT device monitoring, and capturing and conserving digital potential evidence for forensic readiness for shadow IoT device enterprises. It allows IoT-based environments to better prepare for security threats and criminal behavior. The SloTDFR model is strong enough to catch even the smallest PDE, making criminal conduct easier to track in the case of an occurrence. [PERSON] et al. [41] presented a forensic model to detect and identify the flooding attack on IoT devices. The proposed forensic model has many stages. These stages are linked and play their roles equally in the investigation of the incident. Network forensics lies between cloud forensics and device-level forensics. In this paper, the classification of IoT prominent attacks is also described. The Arduino and Bluetooth scheme is used as the IoT device. After configuration, an IP packet is delivered on target, and the port is attacked. To detect the attack, a log file located in Bluetooth Arduino Uno is analyzed using the Wireshark tool. It resulted that the overload issue was because of three IP addresses which committed illegal actions. [PERSON] et al. [42] proposed a generic framework for identification of IoT devices using DNA. DNA of IoT devices is generated from the buyer information and device identification number. With DNA of each IoT device, the fingerprint of attacks of these IoT devices can easily be traced. They implemented this proposed DNA approach on the Hybrid Forensic IoT Server, where every IoT device is registered and existing forensic investigation can easily apply. [PERSON] et al. [43] performed classification of different attacks on IoT devices using machine learning algorithms and then performed forensics using Cowrie Honeypot. The authors have employed J48 decision tree, Naive Bayes, random forest, and Support Vector Machines (SVM) for attack classification and concluded that SVM best classifies these attacks with an accuracy of 97.39%. They analyzed commands and found that malicious commands are homogeneous and follow a pattern, and it identifies how an attacker performs malicious activity. [PERSON] et al.