Dead Man's Switch: Forensic Autopsy of the Nintendo Switch
Frederick Barr−Smith‚ Thomas Farrant‚ Benjamin Leonard−Lagarde‚ Danny Rigby‚ Sash Rigby and Frederick Sibley−Calder
Abstract
The Nintendo Switch is a popular handheld gaming console that is used for a variety of purposes. The most common is that of gaming, however, there are supporting activities such as social networking, media consumption and internet connectivity. In this paper, we have detailed the processes that must be conducted in order to extract forensic evidence from Nintendo Switch devices. We extracted a number of different forensic artefacts from a NAND dump of several Nintendo Switch devices. We discovered several key artefacts, notably personally identifiable information, network connection history and displays that have been connected. We also assessed the forensic value of each artefact extracted from the device. We developed software to automate the process of dumping and extracting the content of the NAND memory. Additionally, we developed modules for the forensic software Autopsy and released these as open source software to automate the process of ingestion and analysis.