A forensically-sound methodology for advanced data acquisition from embedded devices at-scene

This paper presents a methodology for advanced extraction of data from embedded devices such as Internet routers. The use of different access techniques are considered, in order to gain access to device memory, and an investigative methodology is proposed. Lessons learnt from “hardware hacking” are considered and presented. Preparatory steps are discussed to maximise efficiency and likelihood of success for data acquisition. At scene actions and practice are discussed. The results show that, under the right circumstances, a full ‘filesystem’ and a full 'physical' acquisition of the device’s internal flash memory can be achieved. That this data can be decoded and extracted into a format which may subsequently be examined in industry-standard digital forensic tools is also presented and explored.