Forensic analysis for AI speaker with display Echo Show 2nd generation as a case study

Min A. Youn, Yirang Lim, Kangyoun Seo, Hyunji Chung, Sangjin Lee

Research output: Contribution to journalArticlepeer-review

10 Citations (Scopus)


As the Internet of Things (IoT) era arrives, many Internet-connected devices are being released, and their use is increasing. One of these, the AI speaker, is designed to augment user convenience by using voice recognition. The best-known products are the Amazon Echo family, including Echo and Echo Dot and more recently, Echo Show with display. An AI speaker with display provides diverse functions such as surfing the Internet, taking pictures, making voice or video calls, and controlling smart home devices. To do this, Alexa cloud servers store a variety of configuration values and historical logs, and users can manage their own cloud-native data through interfaces (e.g., Web sites or mobile apps). For this reason, AI speakers with smart display are similar to PCs or smartphones, which can be very profitable from a digital forensic perspective. This paper focuses on detailed research on the second generation of Echo Show. The first step was to collect forensic artifacts stored inside the product by teardown, identifying eMMC flash memory chips and performing chip-off on Echo Show. Alexa app-related artifacts used on smartphones and how to automatically acquire data from the Alexa cloud were also investigated. From three sources including Echo Show, a companion client (smartphone), and the Alexa cloud, it was possible to acquire user credentials, traces of photos, records of watching videos, log files, and Internet histories with timestamp. The second step was to identify the possibility of inferring new information by correlating artifacts collected from different sources. Integrative analysis enables investigators to track suspect activity across digital devices. Third, this paper introduces an updated version of Cloud-based IoT Forensic Toolkit (CIFT) to support digital investigation of Echo Show. Based on the technical findings, this study proposes a digital forensic framework for a smart speaker with a display that can play an important role as a digital witness at a crime scene. Until now, there has been no multilevel approach to acquisition and analysis of Echo Show data in the field of digital forensics. Therefore, this study makes a contribution to the digital forensic community.

Original languageEnglish
Article number301130
JournalForensic Science International: Digital Investigation
Publication statusPublished - 2021 Oct

Bibliographical note

Funding Information:
This work was supported by Institute of Information & Communications Technology Planning & Evaluation(IITP) grant funded by the Korea government (MSIT) (No. 2018-0-01000 , Development of Digital Forensic Integration Platform).

Publisher Copyright:
© 2021 The Authors


  • Amazon echo show forensics
  • Chip-off
  • Client-centric artifact
  • Cloud-native artifact
  • Digital forensic framework
  • Digital forensics
  • Integrated analysis
  • IoT forensics

ASJC Scopus subject areas

  • Computer Science Applications
  • Information Systems
  • Pathology and Forensic Medicine
  • Law
  • Medical Laboratory Technology


Dive into the research topics of 'Forensic analysis for AI speaker with display Echo Show 2nd generation as a case study'. Together they form a unique fingerprint.

Cite this