The Preservation stage in digital forensics is dedicated to protecting evidence from any form of alteration, contamination, or destruction. In an IoT context, this involves actions taken to secure the evidence in its original state. This can include isolating devices from the network to prevent remote wiping or data modification, documenting the scene, and creating bit-for-bit copies (forensic images) of digital media. These actions are crucial for maintaining the integrity and admissibility of the evidence in legal proceedings. The question's focus on preventing alteration directly aligns with the core purpose of the preservation phase.

A. Presentation and Reporting: This is the final stage where findings are documented and presented; it does not involve preventing evidence alteration at the scene.

B. Data Analysis: This stage involves examining the collected and preserved data to find evidence; it occurs after preservation is complete.

C. Evidence Identification and Collection: This stage focuses on locating and gathering potential evidence, while preservation is the specific step to ensure its integrity.

1. Oriwoh

E.

& Sant

P. (2013). The Internet of Things Forensics: Challenges and Approaches. In 9th International Conference on Innovations in Information Technology (IIT). IEEE. (Section III

"A Proposed IoT Forensic Model

" outlines the phases

describing Preservation as the phase to "preserve the identified evidence from being contaminated or tampered with.") DOI: 10.1109/INNOVATIONS.2013.6544424

2. Conti

M.

Dehghantanha

A.

Franke

K.

& Watson

S. (2018). Internet of Things security and forensics: Challenges and opportunities. Future Generation Computer Systems

78

544-546. (The article discusses the forensic process

emphasizing that preservation is key to ensuring data integrity for later analysis

p. 545). DOI: https://doi.org/10.1016/j.future.2017.07.060

3. Zawoad

S.

& Hasan

R. (2015). Digital Forensics in the Age of Big Data: A Research Agenda for IoT Forensics. Journal of Digital Forensics

Security and Law

10(4). (Article 2

Section 4

"IoT Forensic Process Model

" describes the preservation phase as crucial for maintaining the chain of custody and evidence integrity). Available at: https://commons.erau.edu/jdfsl/vol10/iss4/2