Analyzing Edge IoT Digital Forensics Tools: Cyber Attacks Reconstruction and Anti-Forensics Enhancements

Digital forensics is a rapidly growing sub-domain of forensic science, primarily due to technological advancements and their integration into everyday life. In this paper, our study delves deep into the potential of digital forensics tools, particularly emphasizing their capability to reconstruct the timelines of cyber attacks on edge Internet of Things (IoT) systems. Our research compares ten distinct and widely used digital forensics tools to discern the most detailed, efficient, and user-friendly instrument for IoT attack reconstruction. Our analysis over fourteen different cyber attacks found that Splunk Enterprise is the most optimal static PCAP and CSV file analysis solution, while Microsoft Azure stands out for live analysis in the context of attack reconstruction. Furthermore, we outline potential enhancements for these tools with consideration to the evolving dynamics of anti-forensics.