Forensic Science · Topic 9 of 9
IoT, OT and Multimedia Forensics
Learn IoT architecture, security problems, the OWASP IoT Top 10, IoT and OT threats and attack surfaces, and the multimedia basics used in forensics.
- 5 min
- IoT evidence is on the device, the app, the gateway, the cloud and the network.
- Weak passwords head the OWASP IoT list.
- OT puts safety and availability first, so avoid disturbing running processes.
What it is
The Internet of Things (IoT) is the network of everyday devices with sensors, software and network connections, such as cameras, thermostats, wearables and smart speakers. Operational technology (OT) is hardware and software that monitors or controls physical processes, such as factory lines, power plants and water systems.
Both hold useful evidence but are hard to examine, because they use unusual hardware, small storage and many protocols. Multimedia files (images, audio and video) are common evidence in their own right.
How it works
IoT architecture
IoT systems are commonly described in layers:
| Layer | What it does |
|---|---|
| Device (perception) | Sensors and actuators that collect data or act |
| Network (connectivity) | Wi-Fi, Bluetooth, Zigbee, cellular and other links, often through a gateway |
| Processing (cloud or edge) | Stores and analyzes the data |
| Application | Mobile apps and dashboards the user sees |
Evidence can sit on the device (flash memory and firmware), the companion phone app, the gateway, the cloud account and the network traffic between them.
IoT security problems
- Weak or default passwords.
- Devices that are never updated, or have no update method.
- Limited processing power, so little room for security software.
- Unencrypted communications.
- Poor physical protection.
- Huge numbers of devices that are hard to inventory.
- Vendors that stop supporting a product.
OWASP Top 10 IoT vulnerabilities
The OWASP Internet of Things Top 10 (2018) lists:
- Weak, guessable or hardcoded passwords.
- Insecure network services.
- Insecure ecosystem interfaces.
- Lack of secure update mechanism.
- Use of insecure or outdated components.
- Insufficient privacy protection.
- Insecure data transfer and storage.
- Lack of device management.
- Insecure default settings.
- Lack of physical hardening.
IoT threats and attack surface areas
An attack surface is every place an attacker can try to get in.
| Area | Example weakness |
|---|---|
| Device hardware | Exposed debug ports, removable storage |
| Firmware | Hardcoded credentials, unsigned updates |
| Network services | Open ports, unencrypted protocols |
| Web and mobile interfaces | Weak login, injection flaws |
| Cloud and APIs | Poor authentication on back end services |
| Radio links | Weak pairing or encryption |
Typical threats are botnets (such as the Mirai botnet that used default passwords to recruit devices for denial of service), data theft, eavesdropping, and use of a device as an entry point to the internal network.
Understanding OT and its security problems
OT includes industrial control systems (ICS), SCADA (supervisory control and data acquisition), distributed control systems, programmable logic controllers (PLC), remote terminal units and human machine interfaces (HMI). In the Purdue model, these sit at the lower levels, below the business network.
Security problems:
- Availability and safety come first, so patching and rebooting are hard to schedule.
- Old systems and protocols without authentication, such as Modbus and DNP3.
- Joining of OT to the corporate network and the internet (IT and OT convergence).
- Long equipment life and few security tools.
- Remote vendor access.
OT threats
| Threat | Example |
|---|---|
| Malware targeting control systems | Stuxnet damaged industrial centrifuges |
| Ransomware | Stops production or operations |
| Unauthorized command or change | Altering set points or logic on a PLC |
| Denial of service | Loss of view or control |
| Insider and supply chain | Maintenance laptops, vendor tools |
| Attacks on safety systems | Triton targeted safety instrumented systems |
For forensics in OT, the rule is to avoid disturbing running processes. Evidence comes from historian data, engineering workstation files, PLC project files, network captures on mirror ports, and event logs.
Understanding multimedia basics
Multimedia evidence includes images, audio and video.
| Item | Forensic relevance |
|---|---|
| Image formats (JPEG, PNG, GIF, BMP) | Different compression and metadata; JPEG is lossy |
| Metadata (EXIF) | Camera model, date and time, sometimes GPS location |
| Audio and video | Held in container formats with codecs; contain time and device metadata |
| Compression | Lossy compression discards data, lossless keeps all of it |
| Editing and tampering | Found by inconsistencies in metadata, compression artifacts and lighting |
| Hidden content | Steganography can hide data inside media |
A file header signature identifies the true type even if the extension is changed. JPEG files begin with the bytes FF D8 FF.
A worked example
A smart doorbell recorded a break in. The investigator works on a copy of the video from the cloud account, hashes it, reads the metadata for time and device, checks the doorbell's account log for access and compares the video time with the network log for the house.
How the exam asks about this
- "Which OWASP IoT risk is caused by default credentials?" → Weak, guessable or hardcoded passwords.
- "Which OT component directly controls machinery?" → A programmable logic controller.
- "Which metadata in a photo can reveal where it was taken?" → EXIF GPS data.
What to remember for the exam
- IoT evidence is on the device, the app, the gateway, the cloud and the network.
- Weak passwords head the OWASP IoT list.
- OT puts safety and availability first, so avoid disturbing running processes.
- SCADA, PLC, RTU and HMI are the main OT components.
- EXIF metadata and file signatures help verify multimedia evidence.
Never power cycle or probe live OT equipment for evidence without the operator's agreement. A change can cause physical harm.
Common mistakes
Treating IoT like a PC. Evidence often sits in the cloud account and app, not only the device.
Rebooting OT systems to collect data. It can stop a physical process, so use passive collection.
Trusting the file extension. The header signature shows the real file type.
Check yourself
What is the top item in the OWASP IoT Top 10?
Weak, guessable or hardcoded passwords.
What does a PLC do?
It is a controller that runs logic to operate industrial equipment.
Which bytes begin a JPEG file?
FF D8 FF.
Topic 9 of 9 in Forensic Science
Test yourself on Forensic Science
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.