Nondestructive Data Acquisition Methodology for IoT Devices: A Case Study on Amazon Echo Dot Version 2

Abstract

The smart speaker is becoming a common part of the modern household, which usually includes an AI-powered Intelligent Voice Assistant to communicate with its users. Amazon Echo Dot is a popular smart speaker that extends the above-stated functionality by acting as a communication hub for other Internet of Things (IoT) and mobile devices within its local network. The nature and volume of data that an Echo Dot handles make it a potential source of evidence, if one is seized for a digital forensics investigation. Researchers and practitioners have explored various techniques to extract data from these IoT devices. However, traditional methods make changes to the physical device and/or its data, which is undesirable from a digital forensics perspective. The current work focuses on developing a nondestructive methodology for extracting data from IoT devices, with Amazon Echo Dot version 2 as an example, which use embedded Multimedia Card (eMMC)/embedded Multichip Package (eMCP) chips as their primary storage. We identify all in-system programming (ISP) pins using the computed tomography (CT) Scan imagery of the main printed circuit board (PCB) of the device. We created a 3-D fixture that accommodates pogo pin connectors to create contact with the already identified ISP taps on the main PCB. The 3-D Test Probe Jig can extract data from an IoT device’s memory chip using an eMMC reader. The proposed nondestructive solution is reproducible, portable, and affordable.