The IoT Forensics Challenge will span the DFRWS 2017 and 2018 Conferences.

Submission deadline: Feb. 21, 2018


Internet of Things Forensic Challenge:

This DFRWS Forensic Challenge aspires to motivate new approaches to forensic analysis and has four levels of participation.

  1. Evaluating and Expressing Conclusions: Formally evaluating and expressing the probability or likelihood ratio that the husband killed his wife versus some other unknown person.
  2. Device Level Analysis: Developing methods and tools to forensically process digital traces generated by IoT devices, including on mobile devices.
  3. Network and Cloud Level Analysis: Developing methods and tools to forensically process digital traces generated by IoT devices on networks and cloud systems.
  4. Correlation and Analysis: Developing methods and supporting tools that combine information from various data sources and automatically compute, visualize, or otherwise expose patterns of potential interest.

Details, tools, and materials can be obtained from



  • Contestants may enter individually, or as a team, with no restrictions.
  • Source code must be openly available under a free software license, such as those listed at The author(s) retain rights to the source code.
  • Tools may incorporate third-party free software, as long as it is compatible with your license and is included with your submission. However, submissions will be judged on the contribution your own work brings to the challenge.
  • Submissions must include clear instructions for building tool(s) from source code along with all relevant dependencies.
  • DFRWS will publish the results of the Challenge, both in detailed and summary form, along with the methodology used and the source of the specific version of each tool.



All participants must send an email to with the subject line "Solution submission". The email should contain official contact information for the participant/team members; it should also indicate to whom a check should be made out, in case the solution is selected for the grand prize.

The actual solution (code and relevant documentation) can be submitted in one of three ways:

  • Email attachment. If the entire submission can be packed in an archive of less than 5MB, then submission can be sent as an attachment to
  • http/ftp download. The submission email can contain a download link from where the submission can be downloaded as a single file.
  • svn/git checkout. The submission email should contain appropriate instructions and credentials (if applicable) for organizers to obtain the submission.

Ideally, submissions should be self-contained; however, if bundling of third-party code is not possible (e.g., due to licensing restrictions) appropriate instructions on building the tool should be included.

As stated above, this competition is for open source tools and, in the interest of open competition, DFRWS may publish the actual submissions along with test results. Beyond that, DFRWS will make no further attempts to distribute the solutions.


  • First Prize: DFRWS will provide free conference registration to one of our 2018 conferences for up to two members of the winning team.
  • Grand prize: DFRWS will award an additional $1,000 cash prize to the winners, if their solution exhibits all the attributes of a field-ready tool with the necessary robustness and performance.



Send all questions to (Your email will be used only for this purpose and will be forgotten after DFRWS2016.)


The DFRWS would like to thank the Digital Forensic Investigation Research Laboratory at Hallym University for the implementation of this Forensic Challenge. In particular, Joshua James implemented the challenge scenario in coordination with the DFRWS.