An Investigation of Existing Digital Forensic Models for Internet of Things (IoT) Environments

Abstract

Abstract The rapid proliferation of Internet of Things (IoT) devices in smart homes has created new challenges for digital forensic investigations. Traditional forensic models, designed for personal computers and mobile devices, are inadequate for heterogeneous IoT ecosystems characterized by distributed architectures, proprietary protocols, and volatile data. This paper investigates existing digital forensic models for IoT devices, focusing on their applicability to smart home environments. A systematic review of frameworks such as Oriwoh’s 1‑2‑3 Zone model, Perumal’s Top‑Down approach, Zawoad and Hasan’s Forensic‑Aware IoT, and Kebande and Ray’s DFIF‑IoT, Zia et al.’s application-specific model, Goudbeek et al.’s smart home framework, Sathwara et al.’s three-step model, Al-Sadi et al.’s open-source geared approach, and Babun et al.’s IoTDots reveals that most remain conceptual, lack real‑world validation, and struggle with scalability, interoperability, and evidentiary admissibility. Comparative analysis highlights deficiencies in event reconstruction, chain of custody, and automated correlation. The study identifies research gaps and proposes opportunities for integrating AI, blockchain, and standardized protocols to strengthen IoT forensic investigations. Findings contribute to the foundation for event reconstruction in smart home forensic models.