Retrieving Forensically Sound Evidence From the ESP Series of IoT Devices

Abstract

The ESP series of electronics chips and boards are one of the most popular IoT devices and are dominant in the low-end IoT market. Unlike traditional electronic devices, in order to maintain the compact size, ESP devices are not equipped with a hard disk drive. Instead, their microcontrollers are tightly coupled with flash storage chips, which are the high-value targets from a digital forensics (DFs) perspective. To retrieve forensically intact evidences from these devices’ flash storage chips, investigators must be very careful in extracting data, in case the microcontrollers are activated unintentionally, which may allow the microcontroller to write something to the flash storage chips—the result will be unacceptable at court because the data integrity is concerned. This article is trying to solve this challenge, especially for tiny devices, by providing a standard process, utilizing 3D-printed enclosures, spring pins, and cold soldering techniques. The proposals here for the ESP series of IoT devices can be further explored in other IoT devices in the field of DFs.