  Internet of Things devices such as the Amazon Echo are undoubtedly great
sources of potential digital evidence due to their ubiquitous use and their
always on mode of operation, constituting a human life black box. The Amazon
Echo in particular plays a centric role for the cloud based intelligent virtual
assistant Alexa developed by Amazon Lab126. The Alexa enabled wireless smart
speaker is the gateway for all voice commands submitted to Alexa. Moreover, the
IVA interacts with a plethora of compatible IoT devices and third party
applications that leverage cloud resources. Understanding the complex cloud
ecosystem that allows ubiquitous use of Alexa is paramount on supporting
digital investigations when need raises. This paper discusses methods for
digital forensics pertaining to the IVA Alexa ecosystem. The primary
contribution of this paper consists of a new efficient approach of combining
cloud native forensics with client side forensics, to support practical digital
investigations. Based on a deep understanding of the targeted ecosystem, we
propose a proof of concept tool, CIFT, that supports identification,
acquisition and analysis of both native artifacts from the cloud and client
centric artifacts from local devices.
