The Internet of Things: An Overlooked Tool for Digital Forensics Investigators

Your smart TV is watching you. Your fitness tracker knows your heart rate. Your doorbell has a camera. Your car logs everywhere you go.

IoT, the Internet of Things, is everywhere. And those connected devices are priceless sources of digital evidence for investigators. The question is: Do you know how to get to the data those devices collect?

Our guest Amber Schroader is a proud Trekkie and a self-taught, self-styled "computer nerd" who's been doing digital forensics for over 30 years. She's founder of Paraben Corporation, a software company specializing in digital forensics. And she's one of the people pushing this field to think bigger about what devices can tell investigators in all kinds of cases — and how to legally capture that information.

Paraben's website: https://paraben.com/

FInd Amber Schroader on LinkedIn. 

Host: Hal Humphreys 

Guest: Amber Schroader

Sponsored by: TLOxp®

Music provided by Jason White, who composed our theme.

Special thanks to Kim Green and Stephanie Mitchell, who produced this episode.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
Pursuit Magazine and PI Education are part of StoryboardEMP, a media and education company in Nashville, TN. Pursuit, a free online magazine for private investigators, explores all things investigative, from gumshoe techniques and surveillance tech to industry news and crime in media. PI Education, its sister brand, provides online continuing education for licensed PIs. Pursuit and PIed are owned and edited by husband-wife team Hal Humphreys, a PI, and Kim Green, a writer and radio producer.

In this podcast, you'll find episodes that dive deep into the work and the business of private investigations. And at PI Education's YouTube channel, you can dive even deeper into the knowledge pool of this fascinating profession, with regular briefings and webinars. Subscribe to stay up to date!

Pursuit Magazine: https://pursuitmag.com/​
PI Education: https://pieducation.com/​
Our channel: https://www.youtube.com/c/PIEducation​

Transcript

SPEAKER_00 0:02

Your smart TV is watching you. Your fitness tracker knows your heart rate. Your doorbell has a camera. And your car keeps a log of everywhere you've been. IoT, the Internet of Things is everywhere. I literally just installed a refrigerator, a wall oven, and a range oven, and all three of those things are connected to the Internet. My HVAC system is connected to the Internet. These are all parts of the Internet of Things, not to mention that pesky little thing in the corner, the little the little ball called Alexa that listens to everything we're saying. All of these connected devices, they're becoming some of the most valuable sources of digital evidence investigators have ever seen. The question is, how do you know how to get to it? My guest today has been doing digital forensics for over thirty years, and she's one of the people pushing our field to think bigger about what devices can tell us, how to legally capture that information, and why the old rules don't apply anymore. Stick around and learn more.

SPEAKER_01 1:15

Ready to streamline your investigations? Find hidden connections and fresh leads that power successful cases with TLO XP from TransUnion. Replace manual searches with advanced analytics that examine 10,000 data sources and deliver actionable insights in seconds. Automatically uncover undetected links between individuals, assets, and organizations to keep your investigations moving. You'll build stronger cases and close them faster with TLO XP from TransUnion. For details, visit TLO.com.

SPEAKER_00 1:50

Welcome back. My guest today is Amber Schroeder. We met at the Florida Association of Private Investigators FAPI conference in March. Super impressive person. She's a digital forensics expert, software developer, instructor, and founder of Paraben Corporation. She's been working in this field for more than 30 years and has built tools used by investigators all over the world to recover data from smartphones, hard drives, cloud storage, email, and even gaming systems. She's also the purse behind what she calls a 360-degree approach to digital evidence. The idea that you can't just look at one device or one data point. You've got to look at the whole picture. And I'm really excited to bring in Amber Schroeder. Amber, welcome to The Sound of Pursuit and thank you for taking the time to be here with us today.

SPEAKER_02 2:37

Thank you so much for having me. Happy to be here.

SPEAKER_00 2:40

Um I saw your presentation in Florida, and you know, I'm I'm not terribly easily impressed by presentations, but I was kind of blown away by what you had to say. And and um Oh, wow.

SPEAKER_02 2:52

Well, excellent.

SPEAKER_00 2:54

It makes me look at things differently. Um, but before we get into the Internet of Things stuff, I want to hear your story. How did you end up in digital forensics?

SPEAKER_02 3:05

You know, it was kind of a weird thing. I started back when I was 14. Um, I am dyslexic, so you neurodivergent people out there, you might um be able to relate to that. So um I do everything backwards, which is really the truth of doing digital investigations. It's the exact opposite direction of security, or how you use a device is trying to think of all the other stuff that got left behind. So it really clicked for my brain, which was fantastic because normally stuff did not click very quickly. So I was given an opportunity and I worked my way up through a company and then I started my own on the side. So I'm that weird self-taught computer nerd.

SPEAKER_00 3:47

I love that. Um, you know, I was diagnosed with dyslexia in college, and um it hits hard sometimes. So I ordered a toilet paper roll holder the other day from England, and it's from the Great Western Railway. And I thought I thought that it said Paddington Station. And when it came in, it said patent pending.

SPEAKER_02 4:14

That has happened to me all the time. I'm kind of with you. You know, it's one of those that, you know, I will do a class and I'll be teaching a class. And I used to like write on a whiteboard, like, here's your process, write it out and everything. And I would keep going, and everyone in the class was looking at me like I was a nut. And I'm like, okay, what are what are our questions? They're like, we have no idea what you wrote. And it's because I will write the first letter, the last letter, and that middle bit gets really out of order in the process.

SPEAKER_00 4:43

Yeah, yeah, yeah. I I gave a presentation a couple of months ago where I had done the slides ahead of time, Amber, and oh yeah, I had a misspelling on there. And I as we were talking about mistakes and reports and whatnot, somebody pointed out that I had a mistake, and I just opened up the slide deck, marked the red line, and said, There, I fixed it and popped it back up.

SPEAKER_02 5:04

So you know. Oh, yeah. No, I always use PowerPoint now. It's a blessing because then I can check things ahead of time. I do very little live on a whiteboard anymore.

SPEAKER_00 5:13

Yeah, so we we in in the host intro, I talked about the IoT. Um, let's just get into it. For anyone who might not be deep into the digital forensics world, what is IoT and why does it matter to us as investigators?

SPEAKER_02 5:27

So, IoT is the internet of things. It's um literally anything that is a connected device that's not like a smartphone or a computer, but it's all these other pieces. And you guys can probably see in the background, I have quite a few IoT things back there because I do find the entire industry kind of fascinating because it's our first step into what I consider science fiction. And I am a total science fiction nerd. Um, I have dogs named after Star Trek characters, I have kids named after Star Trek characters. Like I was into it. I'm I'm I'm a full subscriber. And this was the first chance that I saw that leaking into our everyday lives, is what IoT brought to us.

SPEAKER_00 6:11

Yeah, yeah. And when we think of IoT, you know, my wife and I just built a little cabin here in Tennessee on the Buffalo River, and I installed um a wall oven and a range oven and a refrigerator, all three of which are connected to the internet.

SPEAKER_02 6:28

Connected.

SPEAKER_00 6:29

Yeah, yeah.

SPEAKER_02 6:30

I know you're gonna have a bossy fridge now.

SPEAKER_00 6:32

I know.

SPEAKER_02 6:33

It's gonna be like, where's the milk?

SPEAKER_00 6:35

So, as as Star Trek fan, is that right?

SPEAKER_02 6:39

Yep, Star Trek. I like Star Wars as well, but more Trek than Wars.

SPEAKER_00 6:43

Yeah, I mean the so Star Trek fan, um, have you watched Strange New Worlds and are you a fan of that version of the narrative?

SPEAKER_02 6:50

I love it, and to the point that you might see my little corgi dog here. His name is Pike after Captain Pike, of course. So I was obviously a big fan.

SPEAKER_00 7:00

You do know that Anson Mount went to college just down the street from you.

SPEAKER_02 7:04

I know. I've actually met him because yes, I've been on a Star Trek cruise as well.

SPEAKER_00 7:09

That is so awesome.

SPEAKER_02 7:10

And he has um he has a farm over in the northeast, and we were talking farming stuff. Uh, so uh he mentioned he went to University of the South over in Suwanee.

SPEAKER_00 7:20

Yeah, yeah. Well, let me ask you this. How did we get to the spot where everything seems to be connected now? Um, five years ago, it didn't feel like we were, you know, paying attention to everything being connected. It certainly wasn't on most investigators' radars. What changed?

SPEAKER_02 7:37

5G. So as you guys start probably noticed, um, you know, you got that big push that, oh, we have 5G coverage, oh, it's covering everywhere, and the map of the colors of all the different providers sort of getting broader and broader and broader. That entire design was actually for IoT. This is for our self-driving cars, which are part of IoT or all these connected devices. It's fiber over the air. So that's why it had its big explosion.

SPEAKER_00 8:09

So the tinfoil hat people out there to say and you know, the 5G, it's controlling us, they're not entirely wrong.

SPEAKER_02 8:18

No, I mean, it is, I think in general, the internet is controlling us more than probably 5G is. But um, but yeah, it did definitely change the way that we were looking at signals because we changed from a network that was really designed off of towers to a network that is a mesh of all the devices together. That's the big difference.

SPEAKER_00 8:40

Yeah, and you know, seriously thinking about this. Roomba, Alexa, automated floor sweepers, um watches, refrigerators, microwaves, range ovens, wall ovens. My um H V A C system, the thermostat, is a connected device. It has sensors throughout the house.

SPEAKER_02 9:10

Um it's literally my dogs have IoT.

SPEAKER_00 9:15

It's everywhere.

SPEAKER_02 9:16

It's it's literally everywhere. And I think it's kind of difficult in the fact that like if you if you think just basics of like a smart TV, when was the last time you saw a dumb TV?

unknown 9:27

Yeah.

SPEAKER_02 9:28

Like you can't even buy a dumb one in the thrift store anymore. It's you only can have smart devices, and that's really where that evolution is coming into impact what we look at it in investigations, but it really impacts our entire lives. I mean, there's a lot of choices to be made on how connected you want to be.

SPEAKER_00 9:45

Yeah. So you you mentioned investigations, the impact uh on investigations for these kinds of devices. Do you have a real world example that you could walk me through where IoT devices ended up being key evidence in a case, something that would have been completely invisible to investigators even 10 years ago?

SPEAKER_02 10:04

So I think the best example is I'm actually going to give a personal example. So I was in a car crash years ago, and I blacked out. So they're like, okay, I don't know what happened. And that's the worst position for a forensic investigator because we like to know everything that's happening. And so I'm like, all right, let's put it together. And based on this accident, I went through the guardrails and I'm like, all right, so I have no idea what was happening before, after, during. So let's figure it out. And I was wearing a Fitbit and I had an Alexa in my car as well. Because I only have dumb cars. I do not have a smart car on purpose. I only have dumb cars. So I can enhance my dumb car by making a smarter, adding an Alexa. And I put the pieces together for my attorney that was representing me of what happened, because that's just how it worked in the particular state I was in this accident. But my Fitbit told me the exact speed of which I had impacted the guardrails. It also told me the moment that it happened for an exact timestamp, because the first thing that happens when a car um collides with something is all the Bluetooth shuts down. Yeah. It's one of those points you don't think about with your car, but it happens every time. So then the Alexa was off. The real reason I was gathering the forensic evidence is they're like, oh, were you just distracted driving? You know, texting and driving, it's it's a thing, it changes the rules. And I'm like, no, of course not. That is not what I'm doing. So let's find all the things to prove this. And my Alexa showed where I was in the audiobook it was reading. You know, all of these pieces came together. And I had a perfect timeline based on all the IoT devices.

SPEAKER_00 11:51

That is wild. Um, and I think it's what people don't realize. These devices are logging things nonstop.

SPEAKER_02 11:59

They are. They're absolutely uh alive and low power for a reason. And I say alive, but because their entire design is as sensor, it's a sensor network. Yeah. Whether it's a connected device, an embedded device, um, one of the many IoT environments we live in, it still does something that's going to benefit us all the time.

SPEAKER_00 12:24

I'm curious. With the Fitbit, you could tell the speed you were going. Could you also tell the rapid deceleration from the Fitbit? Would that show?

SPEAKER_02 12:35

It did because you're going by second, that it's keeping it down. So you could tell what I was driving before at impact, and then um that stopping point. So I also had the statistics of all day driving of what I was doing. So it's a different way that I looked at vehicle forensics that didn't involve actually taking apart the vehicle, doing the black box or any of that. It's I took all the other pieces. And that's that's where I think we're changing the way that we look at our investigations, is that we want to look at all of it, not just this tiny piece of it. Don't get so um overly hyper-focused in one area.

SPEAKER_00 13:15

If I'm an investigator who shows up at a scene and I see a smart TV, a ring doorbell, an Alexa Fitbit, what do I do? Walk me through how I seize and capture this information.

SPEAKER_02 13:28

So the first thing that I do when I look at a scene with those kind of things in it is I actually start at the router. And it's because if I'm walking into an environment that is naturally connected, like I know they're kind of a subscriber to the newsletter, so to speak, then there's probably more devices involved. And the router is going to be your integrating hub for everything that connects. So it's almost giving you a checklist to your entire scene.

unknown 13:55

Okay.

SPEAKER_02 13:56

It's like, I know I have this one, I know I have that one, so on and so forth. After I collect the router, I start looking at each individual device and I look for the next coordinating device, which is typically a smartphone. And then I keep going down the list from there and I gather them all together, and then it's about processing. Many of them also integrate with the cloud, but the good thing for me is they drop all their keys onto the integrating device and I can get into the cloud from there.

SPEAKER_00 14:22

So you say the drop all the keys on the integrating device. Um, is there, for lack of a better word, an audit trail of things that are connected that is a like a printable thing? You could say this is connected, this is connected, this is connected.

SPEAKER_02 14:36

Absolutely. That's what you get out of the logs with the router. And as far as the keys, that's actually your passwords to log into all your IoT devices.

SPEAKER_00 14:44

Okay. Okay. What stuff gets missed?

SPEAKER_02 14:49

I think a lot of people are still actually missing the collection of IoT. They haven't really found it to be like something they're paying attention to. We've gotten so overly inundated with smartphones or computers that they forget entirely about the router or they forget about like the teddy bear on the shelf behind me, which is the connected IoT teddy bear, you know, or oh, the Alexa, which has all of our information in the cloud, but she records just a little bit after there's overlap. You know, those kind of things get forgotten. And because of it, I think you get a very limited scope of what someone's true digital fingerprint is, because it is so much more than just a phone or just a computer.

SPEAKER_00 15:37

What's the biggest mistake investigators make when they're dealing with IoT devices?

SPEAKER_02 15:44

I think it's probably that they don't start at the router. And I say that because I can be in an audience. I think I did this in the presentation you saw where I say, how many of you have collected a router lately? And not a single person raised their hands. I don't even think people look at their router on a regular basis.

SPEAKER_01 16:01

Right.

SPEAKER_02 16:02

You know, once you set up your network, you're like, oh, good. I'm walking away and everything's happy. But you know, that really is your connection point that starts everything.

SPEAKER_00 16:12

So from a practical standpoint for investigators, if if you walk into a situation and you see that you've got, you know, a router and these things connected to it, you say you start at the router. I mean, do you physically seize the router?

SPEAKER_02 16:24

Do you do you it's gonna sound so silly? You just flip it over. And I say that because if you think about most people and how they set up their network, they pull it out of the box, they plug it into their connection, and they're good to go, right? They're not changing what the passwords are associated with the admin account or anything else with it. And after that, they just connect. It's why people have, you know, very odd, silly router passwords because they don't know how to change them themselves. And so most people leave it on the default. And the default login for the routers are on a sticker on the back.

SPEAKER_00 16:59

Yeah, yeah. And look, in my experience, if the default password doesn't work, it's written down somewhere nearby.

SPEAKER_02 17:07

Yeah, someone put a sticky note on something because they're not going to remember.

SPEAKER_00 17:10

Yeah, yeah. All right, let's talk about, let's let's kind of shift gears and talk about the data security angle. These devices create risks, not just for criminal cases, but for everyday people. What should ordinary citizens out there, not just investigators, understand about what their devices are collecting?

SPEAKER_02 17:28

So I think when you look at the devices and how you're choosing to have your digital fingerprint, um, I'm actually working on a book right now and it's called The Digital Breakup. And the concept is that you actually break up your identity into subsections. So I have my IoT devices that are related with entertainment connected to one portion of my identity. I have them with finance, for example, connected to another, so on and so forth. And I break up my identity into those other areas. And the reason is if I have a failure, so I have a breach that occurs because that happens all the time. Let's be serious, then I know it's only to one point. And we're really gonna have to start managing our lives in that digital fingerprint differently in the future with the emergence of more and more IoT, with the increase of AI in IoT. It's just, it's a lot for one fingerprint to handle, so to speak. So I want to break it up. I want to make sure I can track it better than just getting one more breach notice in my email, and we all get them. This is, oh, you've been breached. They feel really bad about it. You're gonna get part of this massive settlement and you get a dollar fifty.

SPEAKER_00 18:44

Along with the other two million people that got breached.

SPEAKER_02 18:47

Exactly. And you're like, okay, well, that dollar fifty isn't gonna help me that my passwords were breached for everything I have.

SPEAKER_00 18:54

Yeah, yeah.

SPEAKER_02 18:55

So unless we all get paid like a dollar fifty an hour.

SPEAKER_00 18:58

I'm almost envisioning, you know, building your own digital fingerprint map for yourself. So, like you said, this part goes here, this part goes here, and but like you've got to be conscientious enough to know when you get a new thing, it needs to go here, it needs to be cataloged correctly, it needs to go into the Dewey Decimal system of my digital fingerprint system in the right spot.

SPEAKER_02 19:22

A whole bunch of Gen Zers just went, what is a Dewey decimal system?

SPEAKER_00 19:25

I know, I know.

SPEAKER_02 19:27

Yeah, no, I mean that's that's our onus, uh, especially as we have more things connect in, we have to really decide to take an active management role. So um, I love a spreadsheet, I love a mind map, I manage them in both. I'm trying to get, I've actually kind of created that structure for my parents as well, because the whole concept is just way too much for them. But this is how I'm gonna be able to tackle a future where my IoT devices now are going to have AI and they're gonna get smarter and smarter. So you think of just an evolution of a Tesla. It was released, it was a smart car, it did a lot of smart things associated with it. It actually logs everything on its cameras, you know, very, very smart IoT sensor. Then it gets upgraded and now it can drive very well on its own.

SPEAKER_00 20:18

Yeah.

SPEAKER_02 20:19

And we see more of those. Um, I was just up in Nashville a couple weeks ago and I saw that they got Waymo's.

SPEAKER_00 20:25

Yeah.

SPEAKER_02 20:26

And I was like, oh wow. I had only I rode in one in San Francisco, and I was like, I wonder if they're gonna add them in to Nashville because it's the largest city by me, because it has a very different road system because it's mostly highways that kind of intersect it. Yeah, no problem. They still added it. San Francisco doesn't have the highway system, so I was a little worried that everyone in Tennessee drives really fast.

SPEAKER_00 20:51

Yes, we do.

SPEAKER_02 20:52

So true.

SPEAKER_00 20:53

Yes, and we're not we're not kind drivers either. Like you're not going to merge in front of me. You can merge behind me.

SPEAKER_02 20:59

No, and I don't know how they're gonna take a car that's driving all by itself.

SPEAKER_00 21:05

I gotta be honest. I have to be completely honest. I've seen the Waymo cars around. I'm I'm I'm uh intellectually, I'm okay with the idea, but I I cannot bring myself to get into one. I just can't Oh, you have to.

SPEAKER_02 21:19

I know I loved it. It was so cool to see. You gotta sit in the front too, because you get a whole heads-up display and you can see it mapping all the people.

SPEAKER_00 21:30

Oh, wow. Crazy.

SPEAKER_02 21:31

It maps all the people, the objects, everything. It's fascinating.

SPEAKER_00 21:34

All right. So getting back on track, you've been working on software for this kind of stuff for decades. What's the hardest data to get and what surprised you most about what's actually recoverable?

SPEAKER_02 21:46

So the hardest data to get, of course, is um bypassing any encryption. That's always the hardest to get. Um, I started originally at a company that specialized in cryptography because, again, that backwards brain of mine kind of worked its way through past. In a different method than other people did. But encryption is still the hardest. Um, but I'm always surprised by the fact that every app, every IoT device I've ever looked at, and there's been a lot, the user account information, which is your username, your password, what network you're connecting into, is always not encrypted.

SPEAKER_00 22:25

Yeah. Yeah.

SPEAKER_02 22:28

So some of the content is, but there's always portions that are not encrypted. It's always one of those that you just have to look because you just don't know. An update can totally mess something up too. And so it might change.

SPEAKER_00 22:41

Yeah. Now you talk about something called the forensics of everything, the FOE approach. Tell me what that means and why you think the field needs it.

SPEAKER_02 22:49

So when I look at data, no matter where it's generated, I believe it has some type of evidentiary impact. That's really truly the forensics of everything. It's not just a smartphone, it's not just a computer, it's not just your social media. All of these things are contributing into what that digital fingerprint is associated with a person. And when you're doing an investigation, it's all of it. I don't look at it as you're going to be able to quantify and take pieces out, not unless you've broken up your identity appropriately. But otherwise, it should all be part of that investigation. Otherwise, how do you keep that perspective?

SPEAKER_00 23:28

Yeah. So all right. So I I feel like this is kind of a really long teaser episode to get people intrigued about this notion of um the forensics of everything, that 360-degree approach. For a listener out there right now who wants to get better at this, where do they start?

SPEAKER_02 23:49

So it obviously starts with uh curiosity, which I know is silly to say, and imagination. I think those two things don't get talked about enough. I think we spend all this time on analytics and you know getting into the bits and the whites, and you don't forget about some of those core fundamental investigative skills, which are kind of your gut. But if you really want to get interested in it, um, I maintain a blog at paraben.com. It's called Forensic Impact. I try to go through and review interesting artifacts that come through. I have guest posts by people. I've been really trying to maintain that for the community. Obviously, if you want to dabble in the technology, we do technology trials so people can take a look at their Fitbit data or their Apple Watch, which has even more data. Um, so on and so forth. You can even look at things like the bear, the doll, or the Barbie, or your Oculus Um Xboxes. All of those things are very impactful to what your digital fingerprint is, and they get forgotten. Pardon the expression, they're the redheaded stepchild of digital evidence. I know.

SPEAKER_00 24:52

A joke you can make, I cannot.

SPEAKER_02 24:54

You cannot, no, no.

SPEAKER_00 24:57

Okay, Amber, thank you. Thank you. Thank you for taking the time to be with us today and have this really brief chat about the Internet of Things and the forensics of everywhere. Uh I've I've been looking forward to this podcast since we met in Florida. Um, and it's always nice to talk to a fellow Tennessean. Um, where can people find you and learn more about the work you're doing?

SPEAKER_02 25:20

So I am on LinkedIn at Amber Schroeder. That's the easiest way to be able to follow and kind of get information about it. I'm on Twitter as well, not as much as I used to be, but I'm Ginger Wonder Mom on Twitter. I am a huge Wonder Woman fan. You cannot see that side of my office. There's an entire wall just dedicated to Wonder Woman. Because that was the inspiration to get into digital evidence at the end of the day. It's a fight for justice.

SPEAKER_00 25:46

Wow. Uh, you truly are a nerd par excellence. And and I think that's one of the reasons you and I get along so well, because when it comes to the world, we can have another podcast that we will not air on this channel or any other channel for that matter, uh, about our Star Trek nerdery and Star Wars characters and and Wonder Woman and the whole business. Um, Amber, thank you so much for being here today.

SPEAKER_02 26:14

Thank you so much for having me, and hopefully everyone gets that opportunity to jump into IoT.

SPEAKER_00 26:20

And for everybody out there listening, check out Parab Incorporation, check out Amber's work. Um I've enjoyed this conversation with her today. I hope you have too. I'm Hal Humphreys. This is the Sound of Pursuit. Have a good week.

SPEAKER_01 26:38

You've been listening to The Sound of Pursuit, a podcast by Pursuit Magazine and PI Education.