Embedded Device Forensics with a Case Study of Raspberry Pi

The ever-evolving digital forensics is now coping up with latest trends in cyber-attacks. Among them Embedded Device forensics is a trending topic and that needs more research and development. Today, with the prevalence of miniaturized computers, the possibility of launching a cyber-attack using a physically hidden device on a premises is a facile task. Embedded device forensics involves identification, data extraction and analysis from miniaturised computers involved in a cyber-crime. This paper includes the research conducted on such a cyber-crime using the most convenient and widely used microcomputer, Raspberry Pi(RPi). In this research, RPi device is used to create a MITM attack and methods for extracting and analysing the suspect device storage media is well explained. Initially the files with evidential artifacts are explained and later the techniques and tools for extracting and analysing these files are explained in detail. The paper also explains the scope of Live Forensics and password recovery in embedded devices. This paper provides an insight for investigators and crime analysts who come across with a case where micro computers are involved as suspect device.