Chapter 34 — Further Reading

Foundations (🔬 / deeper)

• "Practical IoT Hacking" — Chantzis, Stais, Calderón, Deirmentzoglou & Woods (No Starch Press). The hardware chapters of this book in long form: finding and using UART, JTAG, and SPI, dumping flash, and analyzing firmware. The single best companion to the embedded-extraction section.
• "The IoT Hacker's Handbook" — Aditya Gupta (Apress). Hardware and firmware exploitation from a forensic-adjacent angle — chip identification, bus protocols, binwalk, and emulation — with the depth to go where a GUI tool stops.
• Chung, Park & Lee, "Digital Forensic Approaches for Amazon Alexa Ecosystem" (DFRWS, Digital Investigation). The academic paper that mapped the Echo's three tiers — device, companion app (com.amazon.dee.app), and unofficial cloud API — and made voice-assistant forensics a discipline. The model in this chapter descends directly from it.

Approachable explanations (everyone)

• Joe Grand (Kingpin), JTAGulator talks and Grand Idea Studio site. Clear, hands-on demonstrations of discovering undocumented UART and JTAG pinouts on real boards — the exact problem the chapter's "find the pads with a multimeter" section describes.
• The binwalk and flashrom project wikis. Short, practical docs that turn the firmware-analysis and SPI-dumping commands here into muscle memory; the flashrom supported-devices list tells you whether your programmer will speak to a given chip.
• OWASP Firmware Security Testing Methodology (FSTM). A free, step-by-step checklist for going from a firmware blob to findings — extraction, file-system carving, hard-coded-secret hunting, and emulation — that frames the whole embedded workflow.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 🔍 Berla iVe (berla.co) and its vehicle-coverage list. The dominant vehicle infotainment/telematics platform; the first thing to check on any car job is whether the make/model/year is supported and at what acquisition level.
• 🔍 Bosch Crash Data Retrieval (CDR) tool + NHTSA 49 CFR Part 563 / SAE J1698. The standard EDR reader and the regulation that defines the data set — read the rule so you can testify to exactly what the "black box" records and what it does not.
• 🛡️ binwalk, firmadyne / Firmware Analysis Toolkit, OpenOCD, and a JTAGulator. The free embedded toolchain: carve and emulate firmware, drive JTAG, and discover pinouts. Build this bench on hardware you own.
• 🔍 Magnet AXIOM and Cellebrite (IoT / cloud / wearable modules). Commercial suites that parse Apple Health, companion-app databases, and some IoT clouds — useful where supported, never a substitute for understanding the underlying artifacts.
• 💾 Garmin FIT SDK and a SQLite browser. Parse FIT files (timestamps, semicircles) and open companion-app and Home Assistant databases directly — the recovery-side reading of the same artifacts the examiner uses.
• 📜 SWGDE best-practice documents on vehicle infotainment and IoT, plus Riley v. California, Carpenter v. United States, and the Stored Communications Act. The posture, not the technique, governs this chapter; read the case law before you plug into a car.

Reference (this book)

• Appendix A — File Signatures Reference: the uImage, SquashFS (hsqs), JFFS2, CramFS, and TRX magic bytes for carving firmware.
• Appendix C — Tool Reference and Appendix H — Command-Line Reference: iVe, binwalk, flashrom, unsquashfs, strings, and SQLite usage.
• Appendix E — Legal Frameworks Reference: SCA, CLOUD Act, MLAT, Riley, and Carpenter — the authority behind every tier.
• Chapter 24 — Mobile Device Forensics · Chapter 9 — SSD and Flash Recovery · Chapter 21 — Timeline Analysis · Chapter 31 — Cloud Forensics: the chapters this one threads back to.

Do, don't just read

• Stand up a hub and read it. Run Home Assistant for a week, then image the SD card and query home-assistant_v2.db — watch the schema drift between versions firsthand.
• Dump a chip. Buy a $5 CH341A and a SOIC-8 clip, read the SPI flash of a router you own with flashrom, then binwalk -e and unsquashfs the image and grep for keys and credentials.
• Find the front door. Locate the UART pads on an old router, identify TX/RX/GND with a multimeter, attach a USB-TTL adapter, and capture the boot log — see how often it drops to a shell.
• Parse your own body. Export your Fitbit or Garmin data, parse a FIT file with the SDK, and convert its 1989-epoch timestamps and semicircle positions to UTC and decimal degrees by hand.

Next: Chapter 35 — AI-Assisted Forensics and Deepfake Detection: when machine learning triages the oceans of evidence this chapter generates — and fabricates the media you must authenticate.