{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T03:51:04Z","timestamp":1760241064576,"version":"build-2065373602"},"reference-count":54,"publisher":"MDPI AG","issue":"12","license":[{"start":{"date-parts":[[2019,11,22]],"date-time":"2019-11-22T00:00:00Z","timestamp":1574380800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>The increase in the number of cybersecurity incidents in which internet of things (IoT) devices are involved has called for an improvement in the field of computer forensics, which needs to provide techniques in order to perform complete and efficient investigations in this new environment. With the aim of doing so, new devices and systems are being studied in order to offer guidelines for investigators on how to examine them. This papers follows this approach and presents a forensic analysis of the non-volatile memory of Windows 10 IoT Core. It details how the investigation should be performed and highlights the relevant information that can be extracted from storage. In addition, a tool for the automation of the retrieval of the pieces of evidence detected is provided.<\/jats:p>","DOI":"10.3390\/e21121141","type":"journal-article","created":{"date-parts":[[2019,11,22]],"date-time":"2019-11-22T09:02:52Z","timestamp":1574413372000},"page":"1141","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Non-Volatile Memory Forensic Analysis in Windows 10 IoT Core"],"prefix":"10.3390","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6117-482X","authenticated-orcid":false,"given":"Juan Manuel","family":"Castelo G\u00f3mez","sequence":"first","affiliation":[{"name":"Albacete Research Institute of Informatics, 02071 Albacete, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jos\u00e9","family":"Rold\u00e1n G\u00f3mez","sequence":"additional","affiliation":[{"name":"Albacete Research Institute of Informatics, 02071 Albacete, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Javier","family":"Carrillo Mond\u00e9jar","sequence":"additional","affiliation":[{"name":"Albacete Research Institute of Informatics, 02071 Albacete, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5119-2418","authenticated-orcid":false,"given":"Jos\u00e9 Luis","family":"Mart\u00ednez Mart\u00ednez","sequence":"additional","affiliation":[{"name":"Albacete Research Institute of Informatics, 02071 Albacete, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2019,11,22]]},"reference":[{"key":"ref_1","unstructured":"Gartner Inc. (2019, July 18). Gartner Says 8.4 Billion Connected \u201cThings\u201d Will Be in Use in 2017, Up 31 Percent from 2016. Available online: https:\/\/www.gartner.com\/en\/newsroom\/press-releases\/2017-02-07-gartner-says-8-billion-connected-things-will-be-in-use-in-2017-up-31-percent-from-2016."},{"key":"ref_2","unstructured":"Kuzin, M., Shmelev, Y., and Kuskov, V. (2019, July 18). New Trends in the World of IoT Threats-Securelist. Available online: https:\/\/securelist.com\/new-trends-in-the-world-of-iot-threats\/87991\/."},{"key":"ref_3","unstructured":"Makrushin, D. (2019, July 19). Is Mirai Really as Black as It\u2019s Being Painted?\u2014Securelist. Available online: https:\/\/securelist.com\/is-mirai-really-as-black-as-its-being-painted\/76954\/."},{"key":"ref_4","unstructured":"Cimpanu, C. (2019, July 19). New Silex Malware is Bricking IoT Devices, Has Scary Plans-ZDNet. Available online: https:\/\/www.zdnet.com\/google-amp\/article\/new-silex-malware-is-bricking-iot-devices-has-scary-plans\/."},{"key":"ref_5","unstructured":"Hall, C. (2019, September 23). Survey Shows Linux the Top OS for Internet of Things Devices. Available online: https:\/\/www.itprotoday.com\/iot\/survey-shows-linux-top-operating-system-internet-things-devices."},{"key":"ref_6","unstructured":"Windows Dev Center (2019, July 15). Overview of Windows 10 IoT Core-Windows IoT- Microsoft Docs. Available online: https:\/\/docs.microsoft.com\/es-es\/windows\/iot-core\/windows-iot-core."},{"key":"ref_7","unstructured":"Windows Dev Center (2019, July 15). Enabling Secure Boot, BitLocker, and Device Guard on Windows 10 IoT Core-Windows IoT-Microsoft Docs. Available online: https:\/\/docs.microsoft.com\/es-es\/windows\/iot-core\/secure-your-device\/securebootandbitlocker."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Zhao, K., and Ge, L. (2013, January 14\u201315). A Survey on the Internet of Things Security. Proceedings of the Ninth International Conference on Computational Intelligence and Security, Leshan, China.","DOI":"10.1109\/CIS.2013.145"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Riahi, A., Challal, Y., Natalizio, E., Chtourou, Z., and Bouabdallah, A. (2013, January 20\u201323). A Systemic Approach for IoT Security. Proceedings of the IEEE International Conference on Distributed Computing in Sensor Systems, Cambridge, MA, USA.","DOI":"10.1109\/DCOSS.2013.78"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Cho, M.C.Y., Wang, C., Hsu, C., Chen, C., and Shieh, S. (2014, January 17\u201319). IoT Security: Ongoing Challenges and Research Opportunities. Proceedings of the IEEE 7th International Conference on Service-Oriented Computing and Applications, Matsue, Japan.","DOI":"10.1109\/SOCA.2014.58"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Xu, T., Wendt, J.B., and Potkonjak, M. (2014, January 2\u20136). Security of IoT systems: Design challenges and opportunities. Proceedings of the IEEE\/ACM International Conference on Computer-Aided Design (ICCAD), San Jose, CA, USA.","DOI":"10.1109\/ICCAD.2014.7001385"},{"key":"ref_12","first-page":"1","article-title":"A Critical Analysis on the Security Concerns of Internet of Things (IoT)","volume":"111","author":"Waseem","year":"2015","journal-title":"Int. J. Comput. Appl."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Mahmoud, R., Yousuf, T., Aloul, F., and Zualkernan, I. (2015, January 14\u201316). Internet of things (IoT) security: Current status, challenges and prospective measures. Proceedings of the 10th International Conference for Internet Technology and Secured Transactions (ICITST), London, UK.","DOI":"10.1109\/ICITST.2015.7412116"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Ukil, A., Sen, J., and Koilakonda, S. (2011, January 4\u20135). Embedded Security for Internet of Things. Proceedings of the 2nd National Conference on Emerging Trends and Applications in Computer Science, Shillong, India.","DOI":"10.1109\/NCETACS.2011.5751382"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Chze, P.L.R., and Leong, K.S. (2014, January 6\u20138). A secure multi-hop routing for IoT communication. Proceedings of the 2014 IEEE World Forum on Internet of Things (WF-IoT), Seoul, Korea.","DOI":"10.1109\/WF-IoT.2014.6803204"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Miettinen, M., Marchal, S., Hafeez, I., Asokan, N., Sadeghi, A., and Tarkoma, S. (2017, January 5\u20138). IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT. Proceedings of the IEEE 37th International Conference on Distributed Computing Systems (ICDCS), Atlanta, GA, USA.","DOI":"10.1109\/ICDCS.2017.283"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Wurm, J., Hoang, K., Arias, O., Sadeghi, A., and Jin, Y. (2016, January 25\u201328). Security analysis on consumer and industrial IoT devices. Proceedings of the 21st Asia and South Pacific Design Automation Conference (ASP-DAC), Macau, China.","DOI":"10.1109\/ASPDAC.2016.7428064"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Han, J., Jeon, Y., and Kim, J. (2015, January 28\u201330). Security considerations for secure and trustworthy smart home system in the IoT environment. Proceedings of the 2015 International Conference on Information and Communication Technology Convergence (ICTC), Jeju, Korea.","DOI":"10.1109\/ICTC.2015.7354752"},{"key":"ref_19","unstructured":"Lillis, D., Becker, B., O\u2019Sullivan, T., and Scanlon, M. (2016). Current Challenges and Future Research Areas for Digital Forensic Investigation. arXiv."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Oriwoh, E., Jazani, D., Epiphaniou, G., and Sant, P. (2013, January 20\u201323). Internet of Things Forensics: Challenges and Approaches. Proceedings of the 9th IEEE International Conference on Collaborative Computing: Networking, Applications and Worksharing, Austin, TX, USA.","DOI":"10.4108\/icst.collaboratecom.2013.254159"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"MacDermott, A., Baker, T., and Shi, Q. (2018, January 26\u201328). Iot Forensics: Challenges for the Ioa Era. Proceedings of the 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS), Paris, France.","DOI":"10.1109\/NTMS.2018.8328748"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"265","DOI":"10.1016\/j.future.2018.09.058","article-title":"Internet of things forensics: Recent advances, taxonomy, requirements, and open challenges","volume":"92","author":"Yaqoob","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Oriwoh, E., and Sant, P. (2013, January 18\u201321). The Forensics Edge Management System: A Concept and Design. Proceedings of the IEEE 10th International Conference on Ubiquitous Intelligence and Computing and 2013 IEEE 10th International Conference on Autonomic and Trusted Computing, Vietri sul Mere, Italy.","DOI":"10.1109\/UIC-ATC.2013.71"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"S54","DOI":"10.1016\/j.diin.2014.03.007","article-title":"Digital Forensics as a Service: A game changer","volume":"11","year":"2014","journal-title":"Digit. Investig."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Perumal, S., Norwawi, N.M., and Raman, V. (2015, January 7\u20139). Internet of Things(IoT) digital forensic investigation model: Top-down forensic approach methodology. Proceedings of the Fifth International Conference on Digital Information Processing and Communications (ICDIPC), Sierre, Switzerland.","DOI":"10.1109\/ICDIPC.2015.7323000"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Bouchaud, F., Grimaud, G., and Vantroys, T. (2018, January 27\u201330). IoT Forensic: Identification and Classification of Evidence in Criminal Investigations. Proceedings of the 13th International Conference on Availability, Reliability and Security, Hamburg, Germany.","DOI":"10.1145\/3230833.3233257"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Al Sharif, S., Al Ali, M., Al Reqabi, N., Iqbal, F., Baker, T., and Marrington, A. (2016, January 21\u201323). Magec: An Image Searching Tool for Detecting Forged Images in Forensic Investigation. Proceedings of the 8th IFIP International Conference on New Technologies, Mobility and Security (NTMS), Larnaca, Cyprus.","DOI":"10.1109\/NTMS.2016.7792460"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"175","DOI":"10.1016\/j.diin.2014.05.019","article-title":"Forensic analysis of smart TV: A current issue and call to arms","volume":"11","author":"Sutherland","year":"2014","journal-title":"Digit. Investig."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1016\/j.diin.2019.01.003","article-title":"Sifting through the ashes: Amazon Fire TV stick acquisition and analysis","volume":"28","author":"Hadgkiss","year":"2019","journal-title":"Digit. Investig."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Baggili, I., Oduro, J., Anthony, K., Breitinger, F., and McGee, G. (2015, January 24\u201327). Watch What You Wear: Preliminary Forensic Analysis of Smart Watches. Proceedings of the 10th International Conference on Availability, Reliability and Security, Toulouse, France.","DOI":"10.1109\/ARES.2015.39"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Feng, X., Dawam, E.S., and Amin, S. (2017, January 21\u201323). A New Digital Forensics Model of Smart City Automated Vehicles. Proceedings of the IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), Exeter, UK.","DOI":"10.1109\/iThings-GreenCom-CPSCom-SmartData.2017.47"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Hossain, M., Hasan, R., and Zawoad, S. (2017, January 25\u201330). Trust-IoV: A Trustworthy Forensic Investigation Framework for the Internet of Vehicles (IoV). Proceedings of the IEEE International Congress on Internet of Things (ICIOT), Honolulu, HI, USA.","DOI":"10.1109\/IEEE.ICIOT.2017.13"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"S22","DOI":"10.1016\/j.diin.2019.01.012","article-title":"IoT forensic challenges and opportunities for digital traces","volume":"28","author":"Servida","year":"2019","journal-title":"Digit. Investig."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"S15","DOI":"10.1016\/j.diin.2017.06.010","article-title":"Digital forensic approaches for Amazon Alexa ecosystem","volume":"22","author":"Chung","year":"2017","journal-title":"Digit. Investig."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Yusoff, Y., Ismail, R., and Hassan, Z. (2011). Common Phases of Computer Forensics Investigation Models. Int. J. Comput. Sci. Inf. Technol., 3.","DOI":"10.5121\/ijcsit.2011.3302"},{"key":"ref_36","unstructured":"AccessData Corp (2019, August 09). FTK Imager version 4.2.1. Available online: https:\/\/accessdata.com\/product-download\/ftk-imager-version-4-2-1."},{"key":"ref_37","unstructured":"Carrier, B. (2019, August 09). Autopsy\u2014The Sleuth Kit. Available online: http:\/\/www.sleuthkit.org\/autopsy\/."},{"key":"ref_38","unstructured":"CGSecurity (2019, August 09). PhotoRec ES\u2014CGSecurity. Available online: http:\/\/www.cgsecurity.org\/wiki\/PhotoRec_ES."},{"key":"ref_39","unstructured":"Zimmerman, E. (2019, August 12). Eric Zimmerman\u2019s Tools. Available online: https:\/\/ericzimmerman.github.io\/."},{"key":"ref_40","unstructured":"Carvey, H. (2019, August 12). RegRipper. Available online: https:\/\/github.com\/keydet89\/RegRipper2.8."},{"key":"ref_41","unstructured":"dkovar (2019, August 13). Analyze MFT. Available online: https:\/\/github.com\/dkovar\/analyzeMFT."},{"key":"ref_42","unstructured":"Nir Sofer (2019, August 15). ESEDatabaseView\u2014View\/Open ESE Database Files (Jet Blue\/.edb files). Available online: https:\/\/www.nirsoft.net\/utils\/ese_database_view.html."},{"key":"ref_43","unstructured":"Torres \u00c1lvarez, J.B. (2016). Detecci\u00f3n Antiforense Open Source. [Master\u2019s Thesis, Universidad Internacional de La Rioja]."},{"key":"ref_44","unstructured":"Matt, B. (2019, August 26). A Journey into NTFS. Available online: https:\/\/medium.com\/@bromiley\/a-journey-into-ntfs-part-1-e2ac6a6367ec."},{"key":"ref_45","unstructured":"Niemiro\u2013Sysnative Forums (2019, August 21). Restoring a Backup of the COMPONENTS Hive\u2014What are the Issues?. Available online: https:\/\/www.sysnative.com\/forums\/threads\/restoring-a-backup-of-the-components-hive-what-are-the-issues.11691\/."},{"key":"ref_46","unstructured":"Chen, R. (2019, August 22). The Default User is Not the Default User\u2014The Old New Thing. Available online: https:\/\/devblogs.microsoft.com\/oldnewthing\/20070302-00\/?p=27783."},{"key":"ref_47","unstructured":"Wong, L.W. (2019, August 22). Forensic Analysis of the Windows Registry\u2014ForensicFocus.com. Available online: https:\/\/www.forensicfocus.com\/Content\/pid=73\/page=1\/."},{"key":"ref_48","unstructured":"Windows Dev Center (2019, August 23). Predefined Keys\u2014Windows Applications\u2014Microsoft Docs. Available online: https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/sysinfo\/predefined-keys."},{"key":"ref_49","unstructured":"(2019, August 23). Understanding NTUser.dat in Windows 10\u2014Windows Enterprise Desktop. Available online: https:\/\/searchenterprisedesktop.techtarget.com\/blog\/Windows-Enterprise-Desktop\/Understanding-NTUserdat-in-Windows-10."},{"key":"ref_50","unstructured":"Tilbury, C. (2019, August 23). SANS Digital Forensics and Incident Response Blog-Computer Forensic Artifacts: Windows 7 Shellbags\u2014SANS Institute. Available online: https:\/\/digital-forensics.sans.org\/blog\/2011\/07\/05\/shellbags."},{"key":"ref_51","unstructured":"Rouse, M. (2019, August 26). What is Windows Event Log?\u2014Definition from WhatIs.com. Available online: https:\/\/searchwindowsserver.techtarget.com\/definition\/Windows-event-log."},{"key":"ref_52","unstructured":"Hoffman, C. (2019, August 26). What Is the Windows Event Viewer, and How Can I Use It?. Available online: https:\/\/www.howtogeek.com\/123646\/htg-explains-what-the-windows-event-viewer-is-and-how-you-can-use-it\/."},{"key":"ref_53","unstructured":"Volatility Foundation (2019, September 02). Releases\u2014Volatilityfoundation. An Advanced Memory Forensics Framework. Available online: https:\/\/www.volatilityfoundation.org\/releases."},{"key":"ref_54","unstructured":"Zimmerman, E. (2019, September 05). Kroll Artifact Parser and Extractor\u2014KAPE. Available online: https:\/\/www.kroll.com\/en\/insights\/publications\/cyber\/kroll-artifact-parser-extractor-kape."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/21\/12\/1141\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T13:36:47Z","timestamp":1760189807000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/21\/12\/1141"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,11,22]]},"references-count":54,"journal-issue":{"issue":"12","published-online":{"date-parts":[[2019,12]]}},"alternative-id":["e21121141"],"URL":"https:\/\/doi.org\/10.3390\/e21121141","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2019,11,22]]}}}