During the afternoon of Milipol Paris’ third day, a session on connected devices and vehicles highlighted how everyday technologies now shape forensic investigations. Experts from the French Gendarmerie and Rusolut detailed the technical, legal and operational challenges involved in extracting evidence from these increasingly complex systems.

At Milipol Paris, held this past 18 to 21 November, the conference session “Connected Devices and Vehicles: New Sources of Digital Evidence” drew attention to a rapidly expanding forensic frontier. Captain Nicolas Hugget, Head of the Vehicle Department at the Criminal Research Institute of the French Gendarmerie (IRCGN), and Alexander Sheremetov, Chief Technical Officer at Rusolut, explored how digital traces generated by cars, drones, household appliances and wearables are transforming investigative methods. Their presentations offered a candid overview of both the potential and the limits of these emerging evidence sources.


Connected technologies and the changing landscape of judicial evidence

Captain Hugget began by describing a world in which digital systems have become inseparable from everyday routines. He noted that watches, phones, personal computers and household devices now collect and transmit vast quantities of information, often designed to improve comfort or provide specific services. According to him, these data points, which include timestamps, locations, movement patterns and biometric signals, increasingly serve a second purpose as they can help reconstruct events in judicial investigations.
Conference session on connected devices and vehicles at Milipol Paris
He explained that digital evidence now appears in the majority of significant cases, but that its investigation is complicated by the sheer diversity of devices. Each piece of technology requires a specific processing method and may store data locally, on external applications or in remote servers. Cloud hosting introduces additional obstacles, particularly when servers are located abroad, since investigators must rely on international cooperation and judicial authorisations to access them.

The lack of standardisation across the connected ecosystem also poses practical challenges. Watches, for example, may contain one set of data, while their companion applications store another. Vehicles add an additional layer of complexity, as onboard systems operate autonomously, follow proprietary architectures and may be insufficiently documented. Hugget pointed out that many manufacturers resist sharing technical details, citing industrial secrecy or commercial positioning. As a result, investigators often face fragmented datasets spread across several sources, which lengthens procedures and increases the risk of losing evidence if systems are mishandled.


Forensic approaches and the slow development of analytical tools

Although the forensic community has long mastered data extraction from computers and smartphones, connected devices and vehicles remain less supported by commercial tools. Hugget mentioned that while software suites exist for mobile phones and some vehicle systems, many modern objects still fall outside established capabilities. This forces law-enforcement teams to develop their own methods. He described a three-level approach, starting with the least intrusive techniques such as navigating an unlocked interface and capturing information manually. When possible, investigators move to diagnostic ports left open by manufacturers or to authorised access paths for routine checks.

The final level involves the most technical procedures, including full disassembly and reverse engineering of hardware to read memory chips directly. This stage requires judicial approval and highly specialised expertise. Hugget emphasised that even with these tools, increasing encryption poses a significant barrier. European cybersecurity regulations encourage systematic data protection, complicating the work of investigators. Accessing encrypted data often requires long hours of reverse engineering or cooperation with manufacturers, which must remain compatible with legal frameworks and data-protection rules.

He noted that the tension between privacy safeguards and investigative needs continues to shape operational realities. Despite this, he insisted that connected devices and vehicles have already become major evidence sources and that forces must preserve their ability to access data as technical and regulatory frameworks evolve.


From smart homes to drones: forensic insights from the field

Alexander Sheremetov expanded the discussion by examining how private forensic-tool developers confront the diversity of connected devices. He explained that the term IoT evokes different meanings depending on the speaker, ranging from smartwatches to drones or domestic appliances. This diversity results in a wide range of file systems, data formats and encryption techniques, which makes universal analysis impossible.
He illustrated this with examples from Rusolut’s casework. Smart home gateways, for instance, may reveal activity logs such as lights switching on and off, which can help establish user presence. These devices sometimes store cloud account credentials, offering investigators access to synchronised data across an ecosystem. Sheremetov noted that even a single gateway with limited storage can contain WiFi passwords, event sequences and other small but meaningful fragments that help contextualise a case.
Milipol Paris session exploring connected devices as sources of digital evidence

Routers offer another source of information. In one investigation, a full memory extraction revealed detailed logs of IP leases and device connections. According to Sheremetov, such data can associate specific phones with a network at a given moment, adding context to a broader timeline. Smart TVs can retain browser histories, login credentials and traces of user actions. Even if these fragments do not constitute direct evidence, they complement other elements by demonstrating activity patterns.

Sheremetov reserved particular attention for drones. Some DJI models store images captured by downward-facing sensors used for stabilisation and landing. These photos can inadvertently record launch locations or individuals handling the device. He cited cases in which sensor images provided decisive leads, including partial faces or environmental cues linked to the operator. Smartwatches, meanwhile, may store GPS tracks, heart-rate patterns and movement data, often offering more detail than smartphones because they remain on the user’s body.

Both speakers agreed that IoT devices rarely serve as standalone evidence. Instead, they contribute pieces that support or challenge other findings, helping investigators refine timelines, confirm presence or identify behavioural cues. As Sheremetov explained, the field is still young and largely undefined, but agencies are beginning to recognise its value.

SMPP and KNDS Advance Precision Artillery Cooperation at Milipol Paris
Ceragon Networks Showcases Rapid-deployment Connectivity at Milipol Paris