Document Type


Publication Date


Subject: LCSH

Cyber forensics, Computer forensics, Xbox One (Video game console)


Computer Engineering | Computer Sciences | Electrical and Computer Engineering | Forensic Science and Technology | Information Security


Video game consoles can no longer be viewed as just gaming consoles but rather as full multimedia machines, capable of desktop computer-like performance. The past has shown that game consoles have been used in criminal activities such as extortion, identity theft, and child pornography, but with their ever-increasing capabilities, the likelihood of the expansion of criminal activities conducted on or over the consoles increases. This research aimed to take the initial step of understanding the Xbox One, the most powerful Microsoft console to date. We report the outcome of conducting a forensic examination of the Xbox One, and we provide our Xbox One data set of hard drive images and unique files so that the forensic community may expand upon our work. The Xbox One was found to have increased security measures over its predecessor (Xbox 360). The encryption of the data and the new file types introduced made it difficult to discern potential digital evidence. While these added security features caused great difficulty in forensically acquiring digital forensic artifacts, some important and interesting digital evidence was gathered using open-source tools. We were able to find digital evidence such as times that the user initially set up the console, and times when the system was restored or shutdown. We were also able to determine what games and applications had been downloaded along with when the games were played. Finally, through our network forensic experiments, we were able to determine that various applications had different levels of security and that game traffic was encrypted.


© 2014 Digital Forensics Research Workshop. Published by Elsevier Ltd. All rights reserved. Posted with permission.

Dr. Baggili was appointed to the University of New Haven's Elder Family Endowed Chair in 2015.



Publisher Citation

Moore, J., Baggili, I., Marrington, A., & Rodrigues, A. (2014). Preliminary forensic analysis of the Xbox One. Digital Investigation, 11, S57-S65.

Check your library



To view the content in your browser, please download Adobe Reader or, alternately,
you may Download the file to your hard drive.

NOTE: The latest versions of Adobe Reader do not support viewing PDF files within Firefox on Mac OS and if you are using a modern (Intel) Mac, there is no official plugin for viewing PDF files within the browser window.