Forensics Analysis of Xbox One Game Console
This addresses forensic investigators' need to analyze modern game consoles that support criminal activities, though it is incremental as it builds on existing physical examination methods.
The paper investigated the Xbox One game console's forensic value by analyzing both physical hard drive timestamps and logical GUI data, identifying potential forensic data sources and providing best practices for data collection.
Games console devices have been designed to be an entertainment system. However, the 8th generation games console have new features that can support criminal activities and investigators need to be aware of them. This paper highlights the forensics value of the Microsoft game console Xbox One, the latest version of their Xbox series. The Xbox One game console provides many features including web browsing, social networking, and chat functionality. From a forensic perspective, all those features will be a place of interest in forensic examinations. However, the available published literature focused on examining the physical hard drive artefacts, which are encrypted and cannot provide deep analysis of the user's usage of the console. In this paper, we carried out an investigation of the Xbox One games console by using two approaches: a physical investigation of the hard drive to identify the valuable file timestamp information and logical examination via the graphical user interface. Furthermore, this paper identifies potential valuable forensic data sources within the Xbox One and provides best practices guidance for collecting data in a forensically sound manner.