The current XR (Extended Reality) market is rapidly advancing with a variety of innovative technologies, such as VR (Virtual Reality), AR (Augmented Reality), and MR (Mixed Reality). XR technologies provide innovative user experiences through VR, AR, and MR. The advancement of XR technologies has led to the release of various XR devices. Moreover, the metaverse, a 3D virtual world implemented based on XR technologies, has attracted attention. In the metaverse, users can experience immersive environments comparable to reality without the constraints of time and space, and interact with numerous other users. While XR technology along with the metaverse is revolutionizing industrial environments, it can also causing several issues. The metaverse imitates elements of reality (self, place, currency, etc.) in virtual forms. Although this enhances user immersion, it also leads to the "synchronization of threats", where real-world threats are recreated in the metaverse, with actual cases reported. The threats associated with XR are not hypothetical. The types of threats are becoming more sophisticated, mimicking real-world threats, and their frequency is expected to increase. In the absence of XR technology standards, XR developed by various companies feature diverse architectures. The software and hardware supporting XR differ, and the operation methods and configuration of XR are diverse. Due to a lack of tools or significant research addressing digital forensic for XR, investigators face difficulties in this area. Therefore, it is important to understand the entire XR ecosystem, and to develop a universal digital forensic investigation method applicable to it. This study derives the XR ecosystem through an analysis of major XR vendors. Based on this, a digital forensic process is proposed throughout the lifecycle of users accessing the metaverse. To validate the proposed process, a scenario based on the XR environment of Meta, which is widely used, is designed. This scenario-based approach identified various artifacts across the ecosystem and presented their potential utilization. Keywords : Digital Forensic, Ecosystem, XR, Metaverse, VR HMD
