<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-iot-device-forensics
description: >-
  IoT device forensic acquisition and analysis covering firmware extraction,
  UART/JTAG debug interface access, flash memory dumping, network traffic
  capture, MQTT/CoAP protocol analysis, and embedded filesystem recovery
  for smart home devices, industrial sensors, and connected appliances.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - iot-forensics
  - firmware-extraction
  - uart
  - jtag
  - spi-flash
  - mqtt
  - coap
  - embedded-systems
  - flash-dump
  - network-capture
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1200", "T1542.001", "T1005"]
  nist-csf: ["RS.AN-1", "RS.AN-3"]
  frameworks: ["NIST SP 800-183", "OWASP IoT Top 10", "NIST IR 8259"]
---

# Performing IoT Device Forensics

## Overview

IoT device forensics requires hardware-level access techniques combined
with firmware analysis and network traffic inspection. Devices often lack
standard forensic interfaces, requiring UART console access, SPI/JTAG
flash dumping, and protocol-specific traffic analysis (MQTT, CoAP, Zigbee).

## Prerequisites

| Requirement | Details |
|---|---|
| Hardware | USB-UART adapter (FTDI/CP2102), logic analyzer, SPI flasher (CH341A) |
| `binwalk`, `firmware-mod-kit`, `jefferson` (JFFS2), `sasquatch` (SquashFS) | Required |
| `minicom`/`screen` for UART console, `openocd` for JTAG | Required |
| `tcpdump`, `Wireshark`, `mosquitto-clients` for MQTT | Required |
| Multimeter for identifying debug pins | Required |

## Workflow

### Step 1: Hardware Reconnaissance

```bash
# Identify UART pins with multimeter
# GND = 0V, VCC = 3.3V/5V, TX = fluctuating voltage, RX = stable high

# Connect UART adapter and find baud rate
# Common rates: 9600, 19200, 38400, 57600, 115200
screen /dev/ttyUSB0 115200

# Automated baud rate detection
python3 -c "
import serial
for baud in [9600, 19200, 38400, 57600, 115200, 230400, 460800, 921600]:
    try:
        s = serial.Serial('/dev/ttyUSB0', baud, timeout=2)
        data = s.read(100)
        if data and any(32 <= b < 127 for b in data):
            print(f'Readable output at {baud} baud')
            print(data.decode('utf-8', errors='replace')[:200])
        s.close()
    except Exception as e:
        print(f'{baud}: {e}')
"
```

### Step 2: Firmware Extraction

```bash
# Dump SPI flash using CH341A programmer
flashrom -p ch341a_spi -r firmware_dump.bin

# Alternative: dump via JTAG/OpenOCD
openocd -f interface/ftdi/ft2232.cfg -f target/stm32f1x.cfg \
  -c "init; flash read_image firmware.bin 0x08000000 0x100000; shutdown"

# Dump via UART bootloader (device-specific)
# Example: ESP32
esptool.py --port /dev/ttyUSB0 read_flash 0 0x400000 firmware_dump.bin

# Hash the dump
sha256sum firmware_dump.bin > firmware_hash.txt
```

### Step 3: Firmware Analysis with Binwalk

```bash
# Scan firmware for embedded filesystems and signatures
binwalk firmware_dump.bin

# Extract all identified components
binwalk -e firmware_dump.bin

# Recursive extraction
binwalk -eM firmware_dump.bin

# Entropy analysis (detect encrypted/compressed regions)
binwalk -E firmware_dump.bin

# Extract specific filesystem types
# SquashFS
unsquashfs -d ./squashfs_root/ extracted_squashfs.bin

# JFFS2
jefferson -d ./jffs2_root/ extracted_jffs2.bin

# Search extracted filesystem for credentials
grep -rn "password\|passwd\|secret\|key\|token" ./squashfs_root/etc/
find ./squashfs_root/ -name "*.conf" -o -name "*.cfg" | \
  xargs grep -l "password"
```

### Step 4: Network Traffic Analysis

```bash
# Capture IoT device traffic (mirror port or ARP spoofing)
tcpdump -i eth0 host 192.168.1.100 -w iot_capture.pcap

# Filter MQTT traffic (port 1883/8883)
tcpdump -i eth0 port 1883 -w mqtt_capture.pcap
tshark -r mqtt_capture.pcap -Y mqtt -T fields \
  -e mqtt.topic -e mqtt.msg

# Subscribe to MQTT topics (monitor device communications)
mosquitto_sub -h broker.local -t '#' -v > mqtt_messages.log

# CoAP traffic analysis
tshark -r iot_capture.pcap -Y coap -T fields \
  -e coap.code -e coap.opt.uri_path

# DNS queries from IoT device
tshark -r iot_capture.pcap -Y dns -T fields \
  -e dns.qry.name | sort -u > dns_queries.txt
```

### Step 5: Filesystem and Log Recovery

```bash
# Mount extracted filesystem
sudo mount -o ro,loop extracted_fs.img /mnt/iot_evidence/

# Common IoT evidence locations
cat /mnt/iot_evidence/var/log/messages
cat /mnt/iot_evidence/etc/shadow          # User credentials
cat /mnt/iot_evidence/etc/config.json     # Device configuration
ls /mnt/iot_evidence/tmp/                 # Temporary files
find /mnt/iot_evidence/ -name "*.db" -o -name "*.sqlite" | \
  xargs -I{} sqlite3 {} ".tables"
```

## Detection

```yaml
title: Iot Device Forensics Detection
id: f6a196ad-744d-4ab9-9e5c-189f664189da
status: experimental
description: Detects suspicious activity related to performing iot device forensics techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*iot*"
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.t1542.001
  - attack.t1005
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Iot Device Forensics Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1200, T1542.001, T1005 |

## Verification

- [ ] Device photographed and hardware interfaces documented
- [ ] UART/JTAG access established and console output captured
- [ ] Firmware dumped and hash verified
- [ ] Filesystem extracted and searched for credentials/configs
- [ ] Network traffic captured and protocols identified
- [ ] MQTT/CoAP messages analyzed for data exposure
- [ ] Evidence chain of custody maintained

## References

- [NIST SP 800-183 — IoT Cybersecurity](https://csrc.nist.gov/pubs/sp/800/183/final)
- [Binwalk — Firmware Analysis](https://github.com/ReFirmLabs/binwalk)
- [flashrom — Flash Programmer](https://www.flashrom.org/)
- [OpenOCD — On-Chip Debugger](https://openocd.org/)
- [OWASP IoT Top 10](https://owasp.org/www-project-internet-of-things-top-10/)
