Centre for Police Technology (CPT) presents a 31-Day Cybersecurity Knowledge Series for Police, LEAs, Corporate Investigators, Digital Forensics, Fraud, Cyber Risk and Security Professionals.
October 13, 2026: Smartwatches track our movements, home cameras record activity, smart speakers respond to our voices, and connected vehicles generate streams of data.
But what happens when these devices are hacked, misused or linked to a crime?
IoT forensics is the process of identifying, collecting and analysing digital evidence from Internet of Things (IoT) devices and their connected systems.
Day 13 of the Centre for Police Technology (CPT) 31-Day Cybersecurity Knowledge Series explores how connected devices support investigations, how criminals exploit them and how individuals can protect themselves.
What Is IoT Forensics?
The Internet of Things refers to physical devices connected to networks that collect, exchange or process data.
Examples include:
- Smart home devices: Cameras, doorbells, speakers and connected locks.
- Wearables: Smartwatches and fitness trackers recording activity and movement.
- Connected vehicles: Systems that may store location, diagnostic and connectivity information.
- Industrial sensors: Devices monitoring machinery and operations.
- Medical devices: Connected equipment that records or transmits health-related data.
IoT forensics examines information from these devices, their applications, connected phones, network records and cloud services.
What Evidence Can IoT Devices Reveal?
Depending on the device and its configuration, investigators may recover:
- Timestamps showing device activity.
- Location or movement records.
- Camera footage and audio recordings.
- Device connection and access logs.
- Sensor readings and event histories.
- Pairing records and account activity.
- Cloud-stored information associated with connected devices.
Such evidence may help establish when an event occurred, which devices were active and whether recorded activity supports other findings.
However, device clocks may be inaccurate, records may be incomplete, and cloud data may be unavailable or automatically deleted.
Connected devices can provide valuable clues, but their records must be verified and interpreted in context.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
How Can Criminals Exploit IoT Devices?
Criminals can misuse connected devices as tools to facilitate cybercrime, invade privacy and gather information about potential victims.
Surveillance and Stalking: Compromised smart cameras or location-enabled wearables may expose a person’s movements, routines or activities.
Burglary Planning: Information exposed by smart home devices or connected accounts could reveal when a property appears unoccupied, potentially helping criminals identify opportunities for theft.
Botnet Recruitment: Attackers may compromise poorly secured IoT devices and use them in botnets to launch distributed denial-of-service (DDoS) attacks against websites and online services.
Credential Theft and Account Takeover: Criminals may target device accounts to access personal information, recordings or connected services.
Extortion and Privacy Abuse: Unauthorised access to private recordings or sensitive device data may be exploited for intimidation, blackmail or financial demands.
Business and Infrastructure Disruption: Compromised industrial sensors or connected operational devices can disrupt services, interfere with monitoring or provide a foothold for attacks against wider networks.
These activities may leave evidence in device logs, account-access records, network traffic, cloud histories or connected applications.
For investigators, the key question is not just which device was compromised, but how it was accessed, what information was exposed and whether it was used to facilitate another crime.
How Can Police and LEAs Use IoT Forensics?
IoT evidence may support investigations involving burglary, stalking, cybercrime, fraud, suspicious deaths and unauthorised access.
Investigators may compare camera recordings, access logs, wearable records and network timestamps to reconstruct events.
Proper evidence handling is essential. Investigators should document how data was obtained, preserve original records where possible, calculate hashes when appropriate and maintain chain of custody.
They must also consider privacy, legal authority and the limitations of each device.
A device recording is an investigative lead, not automatic proof of who performed an action.
How Can Ordinary People Protect Themselves?
You do not need to be a cybersecurity expert to make connected devices safer.
- Change default passwords: Use strong, unique passwords for cameras, routers and smart home accounts.
- Enable multifactor authentication: Protect accounts that support it.
- Install updates: Keep device firmware, mobile applications and router software updated.
- Secure your Wi-Fi: Use modern encryption, change the router’s default administrator password and avoid sharing access unnecessarily.
- Review permissions: Check which apps can access your location, microphone, camera and personal data.
- Disable unused features: Turn off unnecessary connectivity or remote access when practical.
- Check account activity: Investigate unfamiliar logins, unexpected device movements or unknown connected devices.
- Choose trusted manufacturers: Prefer products with clear security-update policies and ongoing support.
If you suspect a device has been compromised, secure the associated account from a trusted device and contact the manufacturer or a qualified professional. If the device may contain evidence of a crime, avoid resetting it before seeking appropriate advice.
How Can Organisations Strengthen IoT Security?
Organisations should maintain an inventory of connected devices, change default credentials, segment IoT devices from critical systems and monitor unusual network activity.
Regular firmware updates, restricted access, secure configurations and documented incident-response procedures can reduce the risk of compromise.
Where investigations are necessary, relevant device and cloud records should be preserved promptly.
The Future of Connected-Device Investigations
As homes, vehicles, workplaces and public infrastructure become more connected, IoT devices will continue to generate evidence that may be important in digital investigations.
For police and LEAs, IoT forensics can reveal activity that conventional computer examinations may miss. For organisations, it highlights the need to secure every connected endpoint. For individuals, it reinforces the importance of treating smart devices as computers that require protection.
The central principle is simple: Every connected device can leave a digital trail. Protect it, preserve it and investigate it responsibly.
Day 13 — IoT Forensics
31 Days | 31 Key Topics | October 2026
A Cybersecurity Awareness Month Knowledge Initiative
Created by Centre for Police Technology (CPT) (CPT).
Follow Centre for Police Technology (CPT) for the complete 31-Day Cybersecurity Knowledge Series.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
