Authors: Frederick Barr-Smith, Danny Rigby, Sash Rigby, Tom Farrant, Benjamin Leonard-Lagarde and Frederick Sibley-Calder
DFRWS EU 2021
Abstract
The Nintendo Switch is a popular handheld gaming console that is used for a variety of purposes. The most common is that of gaming, however, there are supporting activities such as social networking, media consumption and internet connectivity. In this paper, we have detailed the processes that must be conducted in order to extract forensic evidence from Nintendo Switch devices. We extracted a number of different forensic artefacts from a NAND dump of several Nintendo Switch devices. We discovered several key artefacts, notably personally identifiable information, network connection history and dis- plays that have been connected. We also assessed the forensic value of each artefact extracted from the device. We developed software to automate the process of dumping and extracting the content of the NAND memory. Additionally, we developed modules for the forensic software Autopsy and released these as open source software to automate the process of ingestion and analysis.