Forensic DHCP Information Extraction from Home Routers

This document explores the feasibility and admissibility of a so far unrecognized source for digital evidence. The extraction of a suspect’s home router’s main memory to obtain valuable evidence is proposed and implemented. This method aims at providing time lines of devices appearing in a home network, and therefore possibly in that home, along with their owner. The technique is implemented and tested on the standards of modern volatile memory forensics. The results show that the proposed method is viable and may be extended to a wide range of devices.