Ok Google, Start a Fire. IoT devices as witnesses and actors in fire investigations

Fire incidents are amongst the most destructive events an investigator might encounter, completely transforming a scene with most of the objects left in ashes or highly damaged. Until now, fire investigations relied heavily on burn patterns and electrical artifacts to find possible starting locations, as well as witness statements and more recently witness imagery. As Internet of Things (IoT) devices, often seen as connected smart devices, become more common, the various sensors embedded within them provide a novel source of traces about the environment and events within. They collect and store information in different locations, often not touched by the event, such as remote servers (cloud) or companion smartphones, widening the investigation field for fire incidents. This work presents two controlled fire incidents in apartments that we furnished, equipped with IoT devices, and subsequently burnt. We studied the traces retrievable from the objects themselves after the incident, the companion smartphone apps, and the cloud and assessed the value of the information they conveyed. This research highlighted the pertinence to consider traces from IoT devices in the forensic process of fire investigation.