A Layered Digital Investigation Framework for Internet of Things (IoT) Forensics: A Smart Home Camera Case Study

The rapid adoption of Internet of Things (IoT) technology in various sectors, such as smart homes, healthcare, and transportation, has provided significant efficiency. Nevertheless, many IoT devices are developed without a serious review of security standards, and forensic readiness consideration. As a result, these IoT devices are vulnerable to cyber-attacks that can potentially lead to malware attacks, and system manipulation. This study aims to propose and validate a digital forensic investigation framework in the IoT ecosystem. The framework layers designed in this study consist of the device layer, network layer, and cloud layer. Validation is carried out through a simulated crime scenario recorded by the Mi 360° smart home camera. Meanwhile, the analysis phase focuses on data source artifacts from the device layer, video metadata, technical attributes, and cryptographic integrity verification using hash values (MD5 and SHA-1) documented in the Chain of Custody (CoC) method. The experimental results of this study indicate that digital evidence artifacts sourced from across layers have reliable temporal and structural consistency in reconstructing the chronology of events. This framework successfully correlated artifacts across three layers to reconstruct a complete event timeline, demonstrating its practical validity in distributed IoT forensic investigation.