Smart Home IoT Forensics in Matter Ecosystems: A Data Extraction Method Using Multi-Admin

As the smart home ecosystem expands with the adoption of Matter, a wide variety of Internet of Things (IoT) devices are entering the market, and these devices are becoming more complex, as they support diverse functionalities. Consequently, smart home forensics often requires data extraction procedures that are specific to each device and platform, which increases the technical burden and time costs for investigators. To address these challenges, this study proposes a method that leverages Matter Multi-Admin support for multiple fabrics to enable efficient data acquisition from Matter-enabled IoT devices, regardless of the underlying smart home platform. This method configures a forensic Matter controller using chip-tool and commissions IoT devices that have already been commissioned to a smart home platform into a secondary fabric via Multi-Admin. The forensic controller then performs data extraction using standardized Matter interfaces. The proposed approach was validated on our smart home testbed by targeting a Matter smart bulb commissioned to the SmartThings platform and successfully extracting data generated by the platform, thereby demonstrating the utility of the method. The results indicate that the method enables nondestructive and efficient evidence acquisition from smart home IoT devices and can support future research and real-world investigations.