# Non-Volatile Memory Forensic Analysis in Windows 10 IoT Core
## 4 Analysis Method
### Methodology
#### 4.2.1 Pre-Process  
As no warrants or approvals are required to start the investigation, this phase consists of the design of the scenario in order to study the system and the tool preparation. Scenario Creation. In order to be able to determine what information stored in the non-volatile memory is useful, it is necessary to acquire enough data to accurately capture the state of the operating system. To achieve this, three different scenarios that represent significant states of the operating system are analyzed. These scenarios, which help to understand the behavior of the system and the information that it handles, are the following:  
* OS installation. This scenario allows us to study the system in its conception before any usage data is injected into it. The aim of this analysis is to comprehend how the data is distributed in the storage and to have a first contact with the operating system when it has not generated very much information. In addition, we examine what resources are used to configure the operating system in order to prepare for use. To create this scenario, after the microSD card has been sanitized, the \"Windows 10 IoT Core Dashboard\" program is launched, and the operating systemis flashed into the storage. Once the installation process has finished, the microSD card is acquired and analyzed. * First boot. In this case, we are trying to understand what information the operating system contains once it has been configured and is ready for the user to work with. Therefore, the system is studied when it is booted for the first time. All the terms are accepted, and the privacy settings are left at their default values. When the boot process has finished and the main screen is shown, the device is shut down and the non-volatile memory is acquired and analyzed. * Normal usage. Lastly, the goal is to study the data generated by the operating system when the user has interacted with it. To achieve this, all the features of the system are explored: apps are installed and deployed, the settings are changed to fit the user preferences, a wired network and a wireless one are set up, connections with the IoT device are established using the Windows IoT Core Dashboard, services such as SSH and the web server are used, and the Arduino Board is paired via Bluetooth. After that, the storage is acquired and analyzed. Consequently, three different analyses and acquisitions are performed during the experiment. The same procedure is followed in each one of them but, in some way, they can be seen as separate forensic examinations. Once all the scenarios have been independently analyzed, the results are put together and evaluated from a general perspective in the evaluation phase. The graphical representation of the methodology followed, combined with the scenarios studied, is shown in Figure 2.  
Forensic Tools Used. Since at the time of this proposal there are not many forensic tools specifically designed for the IoT, general ones have been used to acquire and analyze the data stored in the non-volatile memory. Specifically, the selection of the tools was made on the basis of the knowledge that they are useful in retrieving evidence from multiple operating systems and, in particular, from the Windows 10 desktop version, on which the system that is being analyzed is based. The selected tools, which were all installed on the forensic computer, are the following:  
* FTK imager: used for the acquisition of the non-volatile memory and for analysis purposes, since it has browsing and mounting capabilities [36]. * Autopsy: allows the investigator to browse through the storage, apply filters and recover deleted files [37]. * QPhotorec: data carving tool to recover the deleted files from a filesystem [38]. * Registry explorer: analysis tool that enables the browsing of the Windows registry [39]. Figure 2: Methodology followed to perform the forensic analysis. * RegRipper: extract and interprets the data stored in the Windows registry hives [40].