Forensic analysis for AI speaker with display Echo Show 2^nd generation as a case study

As the Internet of Things (IoT) era arrives, many Internet-connected devices are being released, and their use is increasing. One of these, the AI speaker, is designed to augment user convenience by using voice recognition. The best-known products are the Amazon Echo family, including Echo and Echo Dot and more recently, Echo Show with display. An AI speaker with display provides diverse functions such as surfing the Internet, taking pictures, making voice or video calls, and controlling smart home devices. To do this, Alexa cloud servers store a variety of configuration values and historical logs, and users can manage their own cloud-native data through interfaces (e.g., Web sites or mobile apps). For this reason, AI speakers with smart display are similar to PCs or smartphones, which can be very profitable from a digital forensic perspective. This paper focuses on detailed research on the second generation of Echo Show. The first step was to collect forensic artifacts stored inside the product by teardown, identifying eMMC flash memory chips and performing chip-off on Echo Show. Alexa app-related artifacts used on smartphones and how to automatically acquire data from the Alexa cloud were also investigated. From three sources including Echo Show, a companion client (smartphone), and the Alexa cloud, it was possible to acquire user credentials, traces of photos, records of watching videos, log files, and Internet histories with timestamp. The second step was to identify the possibility of inferring new information by correlating artifacts collected from different sources. Integrative analysis enables investigators to track suspect activity across digital devices. Third, this paper introduces an updated version of Cloud-based IoT Forensic Toolkit (CIFT) to support digital investigation of Echo Show. Based on the technical findings, this study proposes a digital forensic framework for a smart speaker with a display that can play an important role as a digital witness at a crime scene. Until now, there has been no multilevel approach to acquisition and analysis of Echo Show data in the field of digital forensics. Therefore, this study makes a contribution to the digital forensic community.