  The Internet of Things (IoT) has boomed in recent years, with an ever-growing
number of connected devices and a corresponding exponential increase in network
traffic. As a result, IoT devices have become potential witnesses of the
surrounding environment and people living in it, creating a vast new source of
forensic evidence. To address this need, a new field called IoT Forensics has
emerged. In this paper, we present \textit{CSI Sniffer}, a tool that integrates
the collection and management of Channel State Information (CSI) in Wi-Fi
Access Points. CSI is a physical layer indicator that enables human sensing,
including occupancy monitoring and activity recognition. After a description of
the tool architecture and implementation, we demonstrate its capabilities
through two application scenarios that use binary classification techniques to
classify user behavior based on CSI features extracted from IoT traffic. Our
results show that the proposed tool can enhance the capabilities of forensic
investigations by providing additional sources of evidence. Wi-Fi Access Points
integrated with \textit{CSI Sniffer} can be used by ISP or network managers to
facilitate the collection of information from IoT devices and the surrounding
environment. We conclude the work by analyzing the storage requirements of CSI
sample collection and discussing the impact of lossy compression techniques on
classification performance.
