Foundation of IoT forensics
Mohamed Abouhawwash · 2026
The extremely fast development of the Internet of Things (IoT) has caused a highly sophisticated situation in cybersecurity and new challenges to digital forensics. IoT forensics is a field of digital forensics focusing on the identification, collection, and analysis of electronic evidence on IoT devices in order to investigate security incidents. When contrasted with usual computer forensic investigations, the wide range of devices, high rates of data generation, and not-normalized designs in IoT forensic investigations complicate the analysis of cases. On top of these challenges, in addition to data being volatile in the IoT scenario, information transmission through encryption has enhanced such an aspect in forensics work. Several ways to address these challenges have emerged. Some investigative models for the investigation of IoT crimes are Digital Forensic Investigation Framework (DFIF) and IoTDOTS. These models are constrained by the characteristics of IoT devices, such as low connectivity and processing capabilities. New models, such as those based on blockchain, offer strong security in the guise of evidence persistence and integrity. Other ideas that have appeared in recent times are Forensics-as-a-Service (FaaS) and proactive Forensics Readiness, potential paradigms to make the forensic process automated and assist in IoT investigations. These kinds of developments have occurred, however, and there is still much to bridge the gap. Evidence acquisition, particularly from cloud services and decentralized systems, is still problematic, as is the potential for user-privacy problems. The addition of privacy-preserving techniques, like the PRoFIT (Privacy-Preserving Forensics in IoT) approach, is demonstrated to mitigate these problems and provide forensic integrity. IoT forensics is a relatively new and developing science, and there needs to be a common agreed manner of investigation. Important directions for future work involve the creation of adaptive forensic instruments, dealing with legal and ethical concerns in cross-border investigations, and enhancing the integrity of evidence gathered from IoT devices. This review presents the state of IoT forensics to define technological and procedural issues and challenge future innovation to match the rapidly evolving world of IoT.