Blog

Amazon Echo: New IoT Witness

During the 2016 holiday season, the Amazon Echo device was a top seller with Consumer Intelligence Research Partners estimating that the retail giant has sold 5.1 million of the smart speakers in the U.S. since it debuted two years ago.(1) These devices have grown in such popularity that they will soon become a common piece of evidence for digital forensics. Although we have just done some basics on the research, the benefit for most forensic investigators is that much of the Echo data is shared in the App and can be viewed with your forensic tools. As is common with many of the App programs, the data is stored in a SQLite file and can be viewed in a parser for that data.

Data location based on Android device as the parent device**:

/File System (Android Backup)/data/data/com.amazon.dee.app/app_webview/Cookies
Cookies

/File System (Android Backup)/data/data/com.amazon.dee.app/app_webview/Databases/DataStore.db – there is limited information about two tasks (created date, last updated date, customer id)
No screen shot as the device tasks were not shareable.

/File System (Android Backup)/data/data/com.amazon.dee.app/app_webview/Databases/map_data_storage.db – there is limited information about account (timestamp, display name, tokens, device name)
User data

The big question that will come from future research is if authentication keys exist to be able to access the data that the device stores in the cloud. As is becoming common place, many Apps are now transferring their data into the cloud. Echo is no exception with recordings of your requests being stored in the cloud. Recently a case has come to light where investigators wanted to get the data the Echo might have recorded of a crime.(2) This will be the first of many as these listening devices spread to more and more homes.

As the Consumer Electronic Show ends, all the talk was about the 2017 Amazon Echo that will have an improved speaker and a 7” touch screen. In the future, we will be taking a look at the Google Home device and what fun data it keeps.

**Screen shots were done using Paraben’s E3:Universal software tool that did device acquisition and analysis.

(1)http://www.geekwire.com
(2)http://www.forensicmag.com


The post about the Echo: Alexa, How Do You Hide a Dead Body?