IoT forensics: Exploiting log records from the DAHUA technology CCTV systems

Area of Science:

• Digital Forensics
• Cybersecurity
• Internet of Things (IoT)

Background:

• Closed-circuit television (CCTV) surveillance systems are prevalent IoT devices crucial for crime investigations.
• DAHUA Technology is a major CCTV manufacturer, yet digital forensic research on its systems is limited.
• Current forensic analysis primarily focuses on video footage, neglecting valuable data in system log records.

Purpose of the Study:

• To investigate the forensic potential of log records from DAHUA Technology CCTV systems.
• To identify and present the value of previously unexploited digital evidence within these logs.
• To enhance digital forensic capabilities for investigating incidents involving DAHUA CCTV systems.

Main Methods:

• Thorough analysis of multiple DAHUA Technology CCTV systems.
• Examination of system log files for hidden digital artifacts.
• Evaluation of the forensic significance of identified log data.

Main Results:

• Log records contain vital user activity information (e.g., drive formatting, recording deactivation).
• This data is often overlooked by commercial forensic tools.
• Log artifacts can help attribute actions to specific users and reconstruct event timelines.

Conclusions:

• DAHUA Technology CCTV log records offer significant, yet underexplored, forensic value.
• Integrating log analysis into digital forensics can provide critical evidence for investigations.
• Further research and tool development are needed to exploit these log artifacts effectively.