Started Off Local, Now We're in the Cloud: Forensic Examination of the Amazon Echo Show 15 Smart Display
Jona Crasselt, Gaston Pugliese

TL;DR
This paper presents the first forensic analysis of the Amazon Echo Show 15, revealing methods to access local and cloud data, and identifying new forensic artifacts and APIs for investigation.
Contribution
It introduces a non-invasive technique to access the Echo Show 15's file system and uncovers new forensic artifacts and cloud APIs for the first time.
Findings
Non-invasive data access method for Echo Show 15
Identification of local usage artifacts and cloud data
Discovery of new Amazon APIs through network analysis
Abstract
Amazon Echo is one of the most popular product families of smart speakers and displays. Considering their growing presence in modern households as well as the digital traces associated with residents' interactions with these devices, analyses of Echo products are likely to become more common for forensic investigators at "smart home" crime scenes. With this in mind, we present the first forensic examination of the Echo Show 15, Amazon's largest smart display running on Fire OS and the first Echo device with Visual ID, a face recognition feature. We unveil a non-invasive method for accessing the unencrypted file system of the Echo Show 15 based on an undocumented pinout for the eMMC interface which we discovered on the main logic board. On the device, we identify various local usage artifacts, such as searched products, streamed movies, visited websites, metadata of photos and videos as…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsDigital and Cyber Forensics · Privacy, Security, and Data Protection · User Authentication and Security Systems
