Bluetooth, IoT, OT and Multimedia Forensics, and Acquisition Basics

What it is

Evidence now also comes from short range radio links, smart devices, industrial equipment and image, audio and video files. Each needs care because the device may be small, unusual or safety critical.

This page also starts the data acquisition methodology, a seven step plan used for every acquisition. Here you learn the first two steps: pick the method and pick the tool.

How it works

Bluetooth forensics

Bluetooth links nearby devices. Classic Bluetooth and Bluetooth Low Energy (BLE) both identify a device by its hardware address (BD_ADDR).

Evidence sources:

• paired and remembered devices on the phone or computer; on Windows, paired device records are kept in the registry under HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices
• device names, addresses and last connection times
• file transfer records and logs
• nearby device scans captured with Bluetooth sniffing equipment

Attacks you should recognize: bluejacking (sending unsolicited messages), bluesnarfing (stealing data without permission) and bluebugging (taking control of a device). Forensic goals are to show a pairing existed, when, and with which device.

IoT forensics

Internet of Things devices include cameras, speakers, wearables, thermostats and sensors. They have little storage, proprietary formats and often store data in the cloud.

Methods include reading memory through debug ports such as UART or JTAG, extracting firmware, and requesting data from the vendor with legal process. Many devices lose data when powered off, so decide early whether to keep power on. Note the limits, because tool support is thin and results need extra validation.

OT forensics

Operational technology (OT) controls physical processes: industrial control systems, SCADA, PLCs and sensors. Its first priority is safety and availability, not data collection.

• Coordinate with plant operators before touching anything.
• Avoid active scanning or probing of live controllers, which can disrupt a process.
• Use passive sources: network captures from a mirror port, historian databases, engineering workstation logs, and PLC project and change logs.
• Common protocols such as Modbus and DNP3 often have no authentication, so command traffic must be correlated with operator actions.
• Work on copies, and use the maintenance window where possible.

Multimedia forensics

Multimedia forensics examines images, audio and video to answer two questions: what do they show, and are they authentic.

Metadata can be removed or altered, so it supports but does not prove authenticity. Always work on a copy and keep the original file hashed.

Data acquisition methodology

Acquisition makes a forensic copy of evidence without altering it. The methodology has seven steps:

1. Determine the best acquisition method.
2. Select the acquisition tool.
3. Acquire volatile data.
4. Enable write protection on the evidence media.
5. Acquire nonvolatile data.
6. Plan for contingency.
7. Validate the acquisition.

Determine the best acquisition method

Choose based on the size of the source, time available, the legal scope, whether the system can be taken offline, and how important deleted data is. A bit stream copy captures deleted files and slack space that a logical copy cannot.

Select the acquisition tool

Pick a tool that fits the media and has been validated. Consider: support for the file system and encryption, ability to write forensic image formats (raw, E01), built in hashing and logging, speed, and whether it works through a write blocker. Examples: FTK Imager, dd and dc3dd, Guymager, EnCase and Magnet acquisition tools. Tools in this category must not write to the source.

A worked example

A plant engineer reports odd valve commands. The investigator does not scan the PLC. Instead, a passive capture from the mirror port and the historian logs are copied, hashed and compared with the operator log.

Meanwhile, a smart camera in the plant is imaged through its debug port after approval.

How the exam asks about this

• "Which Bluetooth attack steals data from a device?" → Bluesnarfing.
• "What is the priority in OT forensics?" → Safety and availability of the process.
• "Which acquisition captures deleted files and slack space?" → A bit stream copy.