始于本地，现入云端：Amazon Echo Show 15 智能显示屏的取证检验
Started Off Local, Now We're in the Cloud: Forensic Examination of the Amazon Echo Show 15 Smart Display
AI总结：
本文首次对 Amazon Echo Show 15 智能显示屏进行取证检验，利用 eMMC 接口未记录引脚非侵入式访问未加密本地文件系统，并借助不安全令牌结合新发现的 Amazon API 将取证范围扩展至云端远程数据。
摘要：
Amazon Echo 是最受欢迎的智能音箱和显示屏产品系列之一。考虑到它们在现代家庭中日益普及的存在，以及居民与这些设备交互产生的数字痕迹，对 Echo 产品的分析对于“智能家居”犯罪现场的取证调查人员来说可能会变得更加普遍。考虑到这一点，我们对 Echo Show 15 进行了首次取证检验，这是 Amazon 运行 Fire OS 的最大智能显示屏，也是首款配备 Visual ID（一种面部识别功能）的 Echo 设备。我们揭示了一种非侵入式方法，用于访问 Echo Show 15 的未加密文件系统，该方法基于我们在主逻辑板上发现的 eMMC 接口的未记录引脚排列。在设备上，我们识别了各种本地使用痕迹，例如搜索过的产品、流媒体电影、访问过的网站、照片和视频的元数据，以及 Visual ID 关于内置摄像头检测到的移动和用户的日志事件。此外，我们利用 Echo Show 15 上不安全存储的令牌获取了对 Amazon 云中远程用户痕迹的访问权限，包括 Alexa 语音请求、日历、联系人、对话、照片和视频。在这方面，我们还通过两个配套应用程序（即 Alexa 和 Photos）的网络流量分析识别了新的 Amazon API。总体而言，就实际相关性而言，我们的发现展示了一种针对 Echo Show 15 设备的非破坏性数据获取方式，以及如何将取证痕迹的范围从设备上的本地痕迹提升到存储在云端的远程痕迹。
英文摘要：
Amazon Echo is one of the most popular product families of smart speakers and displays. Considering their growing presence in modern households as well as the digital traces associated with residents' interactions with these devices, analyses of Echo products are likely to become more common for forensic investigators at "smart home" crime scenes. With this in mind, we present the first forensic examination of the Echo Show 15, Amazon's largest smart display running on Fire OS and the first Echo device with Visual ID, a face recognition feature. We unveil a non-invasive method for accessing the unencrypted file system of the Echo Show 15 based on an undocumented pinout for the eMMC interface which we discovered on the main logic board. On the device, we identify various local usage artifacts, such as searched products, streamed movies, visited websites, metadata of photos and videos as well as logged events of Visual ID about movements and users detected by the built-in camera. Furthermore, we utilize an insecurely stored token on the Echo Show 15 to obtain access to remote user artifacts in Amazon's cloud, including Alexa voice requests, calendars, contacts, conversations, photos, and videos. In this regard, we also identify new Amazon APIs through network traffic analysis of two companion apps, namely Alexa and Photos. Overall, in terms of practical relevance, our findings demonstrate a non-destructive way of data acquisition for Echo Show 15 devices as well as how to lift the scope of forensic traces from local artifacts on the device to remote artifacts stored in the cloud.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
