Survey on Internet of Things (IOT) Forensics: Challenges, Approaches, Privacy-Aware Frameworks and Open Issues

The pervasive growth of IoT devices in vital fields such as health, finance, transit, and smart cities has transformed the domain of digital forensics. Although IoT devices generate rich streams of evidence data, forensic investigators encounter new challenges due to the heterogeneity of devices, the volatility of data, cross-border legal issues, and end-to-end encryption. This paper presents a structured and holistic review of the state-of-the art in IoT Forensics by describing the taxonomy of IoT devices, a careful study of forensic issues in device layer, network layer, and cloud layer, and a comparative analysis of six investigation methods such as AI/ML based forensics, blockchain based evidence management, privacy preserving framework, Forensics-as-a-Service (FaaS) [1][,[2],[3]. The performance of these six methods, based on detection accuracy and analysis time, is evaluated through experiments, showing that AI/ML-based forensics can achieve a detection rate of 87.4% with a minimum analysis time of 95 minutes. The privacy-aware methods achieve the best formal assurance with the differential privacy approach [4],[5],[6]. The privacy-utility trade-off in the health, smart home, and generic IoT domains is investigated, and best practices for implementation in these domains are recommended. Finally, open research questions such as standardisation issues, Byzantine reliable aggregation, and proactive forensics are discussed.