This is an unedited manuscript accepted for publication and provided as an Article in Press for early access at the author’s request. The article will undergo copyediting, typesetting, and galley proof review before final publication. Please be aware that errors may be identified during production that could affect the content. All legal disclaimers of the journal apply.
Abdul Raqib Rahimi,
Mohammad Salem Hamedi,
- Lecturer, Department of Information Technology, Program of MIT, Jahan University, Kabul, Afghanistan
- Lecturer, Department of Information Technology, Program of MIT, Jahan University, Kabul, Afghanistan
Abstract
Smart home Internet of Things (IoT) devices distribute digital traces across device memory, home routers, companion applications, and vendor cloud services. This distribution complicates evidence preservation in Afghanistan, where many laboratories operate with limited budgets, unstable electricity, intermittent connectivity, and restricted access to commercial forensic tools. In this paper, a practical and repeatable evaluation design of five typical smart-home device categories-an IP camera, smart plug, smart bulb, door sensor with hub, and smart speaker is offered. The suggested process adheres to the principles of collection, examination, analysis, and reporting based on the NIST and the existing IoT seizure protocols, provided by the Scientific Working Group on Digital Evidence. Each machine is exposed to 10 scripted events three times. Targeted local device storage, network traffic and router logs, an Android companion app, and granted cloud exports are used to gain evidence. The effectiveness is measured by the artifact recovery rate, cross-source corroboration, acquisition time, repeatability and integrity checks with the help of the SHA-256 hashes. A pilot dataset represents the analyte: the combined multi-source approach retrieves 95.3 percent scripted events, while devices only retrieve 38.7 percent, network sources retrieve 73.3 percent, and mobile applications retrieve 86.7 percent, and cloud records retrieve 92.0 percent. Based on the design, low-cost, multi-source acquisition is more reliable than device-only examination and is still an option in Afghanistan with university or public-sector laboratories. At the end of the paper, there will be minimum cost workflow and reporting requirements to a defensible local practice.
Keywords: Internet of Things; digital forensics; smart home; Afghanistan; artifact recovery; network forensics; evidence preservation
[This article belongs to Journal of Microcontroller Engineering and Applications ]
References
[1] Scientific Working Group on Digital Evidence. Best practices for Internet of Things seizure and analysis (SWGDE 23-F-003-1.0, Version 1.0). 2024. https://www.swgde.org/documents/published-complete-listing/23- f-003-best-practices-for-internet-of-things-seizure-and-analysis/
[2] International Telecommunication Union. Afghanistan digital development dashboard [Data set]. 2026. Retrieved August 31, 2026, from https://datahub.itu.int/data/?e=AFG Page 10
[3] Conti M, Dehghantanha A, Franke K, Watson S. Internet of Things security and forensics: Challenges and opportunities. Future Generation Computer Systems. 2018;78:544-546. https://doi.org/10.1016/j.future.2017.07.060
[4] Yaqoob I, Hashem IAT, Ahmed A, Kazmi SMA, Hong CS. Internet of things forensics: Recent advances, taxonomy, requirements, and open challenges. Future Generation Computer Systems. 2019;92:265-275. https://doi.org/10.1016/j.future.2018.09.058
[5] Stoyanova M, Nikoloudakis Y, Panagiotakis S, Pallis E, Markakis EK. A survey on the Internet of Things (IoT) forensics: Challenges, approaches, and open issues. IEEE Communications Surveys & Tutorials. 2020;22(2):1191-1221. https://doi.org/10.1109/COMST.2019.2962586
[6] Servida F, Casey E. IoT forensic challenges and opportunities for digital traces. Digital Investigation. 2019;28:S22-S29. https://doi.org/10.1016/j.diin.2019.01.012
[7] Kim S, Park M, Lee S, Kim J. Smart home forensics-data analysis of IoT devices. Electronics. 2020;9(8):1215. https://doi.org/10.3390/electronics9081215
[8] Li S, Choo K-KR, Sun Q, Buchanan WJ, Cao J. IoT forensics: Amazon Echo as a use case. IEEE Internet of Things Journal. 2019;6(4):6487-6497. https://doi.org/10.1109/JIOT.2019.2906946
[9] Zawoad S, Hasan R. FAIoT: Towards building a forensics aware eco system for the Internet of Things. In: 2015 IEEE International Conference on Services Computing. IEEE; 2015. p. 279-284. https://doi.org/10.1109/SCC.2015.46
[10] Kent K, Chevalier S, Grance T, Dang H. Guide to integrating forensic techniques into incident response (NIST SP 800-86). National Institute of Standards and Technology; 2006. https://doi.org/10.6028/NIST.SP.800-86
Journal of Microcontroller Engineering and Applications
| Volume | 13 | |
| Issue | 03 | |
| Received | 12/10/2026 | |
| Accepted | 04/11/2026 | |
| Published | 04/11/2026 | |
| Publication Time | 23 Days |