Electromagnetic (EM) side-channel radiation from Internet of Things (IoT) devices are shown to be effective at acquiring forensic insights during digital investigations. These EM radiation patterns can be analysed with the help of machine learning algorithms to detect internal behaviours of IoT devices, which can be relevant to an investigation. However, the real-world application of EM side-channel analysis for digital forensic purposes is obstructed by the lack of suitable tools and the technical expertise among law-enforcement communities. Although certain frameworks, such as EMvidence, exist to cater this requirement, the sheer diversity of the IoT ecosystem makes it difficult to support a sufficiently large collection of devices that are commonly encountered in forensic investigations. The work presented in this paper makes multiple contributions towards addressing this problem. Initially, a detailed discussion on the challenges of applying EM side-channel analysis in practical digital forensic purposes is provided, where the practical difficulties are illustrated. Then, it was shown that the existing EM side-channel analysis frameworks, such as EMvidence, can be used to overcome the diversity of IoT devices in forensics by equipping them with extensible plug-ins targeting the internal system-on-chips (SoC) of each device type. These plug-ins are expected to incorporate trained machine learning models, which are capable of recognising patterns of specific IoT device SoCs. However, the development of such plug-ins requires sufficiently diverse EM datasets from IoT devices. Facilitating this requirement, this work presents a comprehensive EM side-channel dataset representing a diverse collection of popular IoT devices and smartphones. The presented dataset is used to demonstrate the potential usage of machine learning models to recognise device behaviour.

The increasing use of smartphones has increased their presence in legal and corporate investigations. Unlike desktop and laptop computers, forensic analysis of smartphones is a challenging task due to their limited interfaces to retrieve information of forensic value. Electromagnetic side-channel analysis (EM-SCA) has been recently proposed as an alternative window to acquire forensic insights from computers, in particularly from Internet of Things devices. Along this line, this work experimentally evaluates the potential of extracting information of forensic value from smartphones through their EM radiation. Initially, a group of smartphones representing a diverse set of system-on-chip (SoC) processors were used to acquire EM radiation traces. Later, deep learning models were trained to detect various internal software behaviours running on the SoCs. The results of this work indicates that a wide variety of insights can be extracted from smartphones through EM side-channel, increasing the potential opportunities for digital forensic investigators.

Industrial control systems (ICS) often contain sensitive information related to the corresponding equipment being controlled and their configurations. Protecting such information is important to both the manufacturers and users of such ICSs. This work demonstrates an attack vector on industrial control systems where information can be exfiltrated through a electromagnetic (EM) radiation covert channel from the wired Ethernet connections commonly used by these devices. The attack leverages compromised firmware for the controller—capable of encoding sensitive/critical information into the wired network as packet transmission patterns. The EM radiation from the wired network’s communication is captured without direct physical interaction using a portable software-defined radio, and subsequently demodulated on the attacker’s computer. This covert channel facilitates the exfiltration of data from a distance of up to two metres with a data rate of 10 bps without any significant data loss. The nature of this covert channel demonstrates that having strong firewalls and network security.

The advancement of cryptographic systems presents both opportunities and challenges in the realm of digital forensics. In an era where the security of digital information is crucial, the ability to non-invasively detect and analyze cryptographic configurations has become significant. As cryptographic algorithms become more robust with longer key lengths, they provide higher levels of security. However, non-invasive side channels, specifically through electromagnetic (EM) emanations, can expose confidential cryptographic details, thus presenting a novel solution to the pressing forensic challenge. This research delves into the capabilities of EM side-channel analysis (EM-SCA), specifically focusing on detecting both cryptographic key lengths and the algorithms employed utilizing a machine-learning-based approach, which can be instrumental for digital forensic experts during their investigations. Through meticulous data processing and analysis, the Support Vector Machine (SVM) model, among others, demonstrated a notable accuracy of 94.55% in distinguishing between AES and ECC cryptographic operations. This capability significantly enhances digital forensic methodologies, offering a novel avenue for noninvasively uncovering encrypted data’s cryptographic settings. By identifying key lengths and algorithms without invasive procedures, this research contributes substantially to the advancement of forensic investigations in encrypted environments.

Internet of Things (IoT) refers to the network of interconnected physical devices, vehicles, home appliances, and other items embedded with sensors, software, and connectivity, enabling them to collect and exchange data. IoT forensics aim to investigate cybercrimes, security breaches, and other malicious activities that may have taken place on these connected devices. In particular, Electromagnetic Side-Channel Analysis (EM-SCA) has become an essential tool for IoT forensics due to its ability to reveal confidential information about the internal functions of IoT devices without interfering with these devices or wiretapping their networks. However, the accuracy and reliability of EM-SCA results can be limited by device variability, environmental factors, and data collection and processing methods. In fact, very few studies have explored potential solutions to address the significant impact of these limitations on the accuracy of EM-SCA approaches applied to crossed IoT devices. Therefore, this paper examines the impact of device variability on the accuracy and reliability of machine learning (ML)-based approaches for EM-SCA. We first present the background, basic concepts and techniques used to evaluate the limitations of current EM-SCA approaches and datasets. Our study then addresses one important limitation, which is caused by the multi-core architecture of the processors (aka. System-On-Chip). We present an approach to collect the EM-SCA datasets and demonstrate the feasibility of using transfer learning to obtain more meaningful and reliable results from EM-SCA in IoT forensics of crossed-IoT devices. Moreover, this study contributes a new dataset for using deep learning (DL) models in analyzing Electromagnetic Side-Channel data with regard to the cross-device portability matter.